easyvibegate 0.6.2 → 0.6.8

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { planTargets, runFlow } from '../orchestrator/flow.js';
@@ -262,6 +262,12 @@ async function main() {
     // Reports land next to the scanned project by default, so scanning several
     // projects from one shell never overwrites another project's report.
     const outDir = args.output !== undefined ? resolve(args.output) : join(root, 'easyvibegate-report');
+    // Excluding outDir from the scan only makes sense when something is
+    // actually going to be written there. With --no-report (format 'none'),
+    // nothing is ever written to it — so a `--no-report --output <project>/src`
+    // run must not exclude real source just because it shares a path with an
+    // output directory nothing will use.
+    const excludeOutDir = args.format !== 'none' ? [outDir] : [];
     // The report directory gets its OWN `.gitignore` (see prepareOutputDir) and
     // has its stale report files deleted on every run. Both are safe for a
     // directory that exists only to hold reports — neither is safe for the
@@ -292,7 +298,7 @@ async function main() {
     let result;
     if (useWizard) {
         result = await runWizard({
-            excludeAbs: [outDir],
+            excludeAbs: excludeOutDir,
             path: args.path,
             config: args.config,
             lang,
@@ -320,7 +326,7 @@ async function main() {
         };
         // Same contract as the wizard: plan the concrete targets once, ask about
         // exactly those, execute exactly those.
-        const staticResult = await scanStatic(root, { configPath: args.config, excludeAbs: [outDir] });
+        const staticResult = await scanStatic(root, { configPath: args.config, excludeAbs: excludeOutDir });
         const plan = planTargets(staticResult.files, loadConfig(root, args.config), {
             appUrl: args.appUrl,
             supabaseUrl: args.supabaseUrl,
@@ -373,18 +379,33 @@ async function main() {
     // Same contract in every mode: 2 critical, 1 warning, 3 incomplete, 0 clean.
     process.exit(exitCodeFor(summary));
 }
+// Written verbatim (never partially, never appended-to) so an exact match on
+// disk is proof WE created this directory, not the user re-pointing --output
+// at a folder of their own. Checking "does outDir === project root" only was
+// not enough: `--output docs` on a real docs/ folder replaced its real
+// .gitignore (losing rules like `drafts/`) and deleted a real docs/report.md.
+const OUTPUT_DIR_MARKER = '# Written by EasyVibeGate: this report can contain secret prefixes and hosts. Never commit it.\n*\n';
 /** Create the report dir and clear our own stale files, or explain why we cannot. */
 function prepareOutputDir(dir) {
     try {
-        if (existsSync(dir) && !statSync(dir).isDirectory())
+        const existed = existsSync(dir);
+        if (existed && !statSync(dir).isDirectory())
             return 'exists and is not a directory';
+        if (existed) {
+            const ownsIt = existsSync(join(dir, '.gitignore')) && readFileSync(join(dir, '.gitignore'), 'utf8') === OUTPUT_DIR_MARKER;
+            if (!ownsIt && readdirSync(dir).length > 0) {
+                return 'already exists, is not empty, and was not created by a previous EasyVibeGate run — refusing to overwrite its .gitignore or delete files in it; point --output at an empty or dedicated directory';
+            }
+        }
         mkdirSync(dir, { recursive: true });
         // The report names secret prefixes, database hosts and every endpoint —
         // exactly what must not be committed. A `.gitignore` containing `*` inside
         // the directory makes git ignore it wherever the project's own .gitignore
         // stands (the trick node_modules-style caches use); the user's files are
-        // never edited. Rewritten every run so a stray edit cannot un-ignore it.
-        writeFileSync(join(dir, '.gitignore'), '# Written by EasyVibeGate: this report can contain secret prefixes and hosts. Never commit it.\n*\n', 'utf8');
+        // never edited. Rewritten every run so a stray edit cannot un-ignore it —
+        // safe now because we only ever reach this line for a directory that was
+        // either empty or already marked as ours.
+        writeFileSync(join(dir, '.gitignore'), OUTPUT_DIR_MARKER, 'utf8');
         // Old report.md next to a fresh report.json told two different stories.
         for (const name of ['report.md', 'report.json', 'ai-fix-prompt.md']) {
             const p = join(dir, name);

package/dist/engine/checkers/static/client-exposure.js

@@ -1,10 +1,20 @@
 import { lineAt, looksLikePlaceholder, redact } from '../../util/text.js';
+import { maskCode } from '../../util/mask.js';
 import { classifyKey } from '../backend/supabase.js';
 // Public env prefixes are inlined into the browser bundle by the bundler.
 const PUBLIC_PREFIX = '(?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|PUBLIC_)';
 // Every public-prefixed assignment; what it carries is decided by the VALUE
-// first and the NAME second (below).
-const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)\\s*[:=]\\s*["']?([^"'\\s]{6,})`, 'gi');
+// first and the NAME second (below). The name gets an optional closing quote
+// before the `:`/`=` — a JSON/object literal's `"NEXT_PUBLIC_KEY": "value"`
+// otherwise never matched at all, since nothing after the bare name expected
+// that stray `"`. The gap between `:`/`=` and the value is same-line
+// whitespace only (`[ \t]*`, not `\s*`) — an EMPTY-valued var followed by
+// blank/commented lines otherwise let the value group skip straight past
+// them onto the NEXT var's name, reporting that name as a leaked secret
+// value. Once comments started getting masked to blank space (below), a
+// `.env.example`'s usual "KEY=\n\n# comment\nNEXT_KEY=" shape hit this on
+// real projects.
+const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)["']?\\s*[:=][ \\t]*["']?([^"'\\s]{6,})`, 'gi');
 // A public var whose NAME implies a real secret (not an anon/publishable key).
 const SECRET_NAME = /(SERVICE_ROLE|SECRET|PRIVATE|PASSWORD|PASSWD|TOKEN|CREDENTIAL|API_KEY|ACCESS_KEY)/i;
 // Value shapes that are server secrets no matter what the variable is called.
@@ -40,7 +50,10 @@ export const clientExposureChecker = {
         const advised = new Set();
         for (const file of ctx.files) {
             const { content, rel } = file;
-            for (const m of content.matchAll(PUBLIC_ASSIGN)) {
+            // Commented-out code is not a live exposure; masking preserves length
+            // and newlines so match offsets/line numbers still point at the source.
+            const scan = maskCode(content, { file: rel });
+            for (const m of scan.matchAll(PUBLIC_ASSIGN)) {
                 const name = m[1] ?? '';
                 const value = m[2] ?? '';
                 if (looksLikePlaceholder(value))

package/dist/engine/checkers/static/config-risks.js

@@ -37,7 +37,13 @@ const RULES = [
         // inside one string literal — so prose mentioning "insert" won't match.
         // Quantifiers are length-bounded ({0,200}) to prevent catastrophic
         // backtracking (ReDoS) on very long / minified lines.
-        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f["']\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^"'\n]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^"'\n]{0,200}\{/gi,
+        //
+        // The f-string branch tracks its OWN opening quote via a backreference
+        // (`(?:(?!\1)[^\n])` — any char that isn't a newline or that quote) rather
+        // than excluding both quote characters outright: `f"SELECT … WHERE name =
+        // '{x}'"` nests a single-quoted SQL string value inside a double-quoted
+        // f-string, and excluding `'` too made the whole pattern never match.
+        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f(["'])\s*(?:SELECT|INSERT|UPDATE|DELETE)\b(?:(?!\1)[^\n]){0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b(?:(?!\1)[^\n]){0,200}\{/gi,
         severity: 'warning',
         detail: 'Interpolating values into SQL invites SQL injection.',
         fix: 'Use parameterized queries / prepared statements instead of string interpolation.',
@@ -73,7 +79,11 @@ function isParameterizedTemplate(scan, backtickAt) {
  * from request data, so it is reported as info, not as an injection. About half
  * of the real-world hits were structural.
  */
-const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*$/i;
+// A trailing `["']?` handles the equally common quoted-value shape
+// (`name = '${name}'`, `WHERE id = "${id}"`) — the SQL literal's own quote
+// sits directly before the hole, between the operator and `${`/`{`, and
+// without it that shape read as unquoted structure, not a value.
+const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*["']?\s*$/i;
 const PLACEHOLDER_EXPR = /^\s*(?:\w+\.)?(placeholders?|params?|marks|questions|qs|values|binds?)\b/i;
 function onlyStructuralInterpolation(scan, at) {
     // The literal: from the opening delimiter to its close (bounded).

package/dist/engine/checkers/static/rls-migrations.js

@@ -592,26 +592,6 @@ export const rlsMigrationsChecker = {
     level: 0,
     run(ctx) {
         const sqlFiles = ctx.files.filter((f) => f.ext === '.sql').sort((a, b) => a.rel.localeCompare(b.rel));
-        if (sqlFiles.length === 0) {
-            // A project that clearly talks to Supabase but ships no .sql migrations
-            // (schema managed from the dashboard, or migrations live in another repo)
-            // used to just say nothing — a silent, undeserved clean score on the exact
-            // check the tool exists for. Say what could not be checked instead.
-            const looksSupabase = ctx.detection.backends.includes('supabase') ||
-                ctx.files.some((f) => !/\.(md|mdx|txt|rst)$/i.test(f.rel) &&
-                    /(SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_|\/rest\/v1\b|postgrest)/i.test(f.content));
-            if (!looksSupabase)
-                return [];
-            return [{
-                    id: 'rls_unverifiable_no_migrations',
-                    severity: 'info',
-                    title: 'No SQL migrations found — RLS could not be checked statically',
-                    detail: 'This project talks to Supabase, but no .sql migration files exist in this repository (the schema may be managed from the dashboard, or migrations live in a different repo). A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
-                    fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
-                    checker: 'rls-migrations',
-                    level: 0,
-                }];
-        }
         // RLS is a PostgreSQL feature. The engine is decided per FILE, not per
         // project: a monorepo can hold a Postgres schema next to a Cloudflare D1
         // (SQLite) one, and a SQLite schema must never be told to enable RLS — that
@@ -681,8 +661,14 @@ export const rlsMigrationsChecker = {
                 file: skipped[0]?.file ?? '',
                 line: 1,
             }];
-        if (analyzed.length === 0)
-            return notApplicable;
+        // No early return here even when every SQL file present was a foreign
+        // engine (`analyzed.length === 0 && skipped.length > 0`): that settles
+        // those FILES (SQLite/MySQL truly have no RLS), but not the PROJECT — a
+        // Supabase project whose only local .sql happens to be a SQLite cache
+        // file has learned nothing about its real Postgres schema either. Both
+        // this case and zero SQL files at all fall through to the checks below,
+        // which decide from what was actually parsed (nothing, here) whether
+        // anything about the applicable backend's schema was learned.
         // "No RLS" is a hole only when untrusted clients reach the database directly
         // (Supabase/PostgREST with the anon key, Hasura). A Postgres that only server
         // code talks to has no RLS by default and is not exposed by that — a critical
@@ -694,7 +680,10 @@ export const rlsMigrationsChecker = {
         const serverOnly = !exposed &&
             (/"(pg|postgres|pg-promise|@prisma\/client|drizzle-orm|knex|kysely|typeorm|sequelize)"/i.test(pkg) ||
                 /\b(psycopg2?|asyncpg|sqlalchemy)\b/i.test(reqs));
-        const missingSeverity = exposed || !serverOnly ? 'critical' : 'warning';
+        // Server-only is 'advisory', not 'warning': the fix text for this exact
+        // case says "no action needed unless X" — a warning (−8 points, shown as
+        // a problem to look into) contradicted its own explanation of itself.
+        const missingSeverity = exposed || !serverOnly ? 'critical' : 'advisory';
         const events = [];
         const notUnderstood = [];
         analyzed.forEach((f, fileIdx) => {
@@ -708,7 +697,10 @@ export const rlsMigrationsChecker = {
         events.sort((a, b) => a.fileIdx - b.fileIdx || a.offset - b.offset);
         const state = new Map();
         for (const e of events) {
-            const cur = state.get(e.key) ?? { created: false, enabled: false, file: e.file, line: e.line, display: e.display, stateFile: e.file, guarded: false, keys: new Set([e.key]) };
+            const cur = state.get(e.key) ?? {
+                created: false, everCreated: false, everDropped: false, enabled: false, file: e.file, line: e.line,
+                display: e.display, stateFile: e.file, stateLine: e.line, guarded: false, keys: new Set([e.key]),
+            };
             if (e.kind === 'rename') {
                 const to = e.toKey;
                 cur.keys.add(to);
@@ -716,13 +708,14 @@ export const rlsMigrationsChecker = {
                     // Which name the table ends up under is unknown: keep it under both, both in doubt.
                     cur.guarded = true;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     state.set(e.key, cur);
                     if (!state.has(to))
                         state.set(to, { ...cur, keys: new Set(cur.keys), display: e.toDisplay ?? cur.display });
                     continue;
                 }
                 state.delete(e.key);
-                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file });
+                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file, stateLine: e.line });
                 continue;
             }
             // Doubt is a property of ANY guarded statement, not just a guarded ENABLE.
@@ -734,6 +727,7 @@ export const rlsMigrationsChecker = {
                 // (the outcome that leaves data exposed), and record the uncertainty.
                 if (e.kind === 'create' && !cur.created) {
                     cur.created = true;
+                    cur.everCreated = true;
                     cur.enabled = false;
                     cur.file = e.file;
                     cur.line = e.line;
@@ -745,6 +739,7 @@ export const rlsMigrationsChecker = {
                     cur.enabled = false;
                 cur.guarded = true;
                 cur.stateFile = e.file;
+                cur.stateLine = e.line;
                 state.set(e.key, cur);
                 continue;
             }
@@ -753,27 +748,33 @@ export const rlsMigrationsChecker = {
                     if (e.ifNotExists && cur.created)
                         break; // existing table: no-op, keep RLS state
                     cur.created = true;
+                    cur.everCreated = true;
                     cur.enabled = false;
                     cur.file = e.file;
                     cur.line = e.line;
                     cur.display = e.display;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'enable':
                     cur.enabled = true;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'disable':
                     cur.enabled = false;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'drop':
                     cur.created = false;
+                    cur.everDropped = true;
                     cur.enabled = false;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
             }
@@ -791,40 +792,107 @@ export const rlsMigrationsChecker = {
         const turnsOff = (k) => k === 'disable' || k === 'create';
         const findings = [];
         for (const [key, s] of state) {
-            if (!s.created || isTempKey(key))
+            if (isTempKey(key))
                 continue; // temp tables are session-only: PostgREST never sees them
+            // Confirmed gone: created here then legitimately DROPped (the original,
+            // well-tested case), OR never created here at all but still reached by
+            // an unconditional DROP this scan DID see — an external table whose
+            // removal this repo's migrations confirm, not merely reference. Either
+            // way there is nothing left to hold RLS state, on or off.
+            if (!s.created && s.everDropped)
+                continue;
+            // Reaching here means one of two things: `s.created` (created here and
+            // still exists — the original, well-tested case), or `!s.everCreated`
+            // (this key is only ever the target of ALTER/RENAME — an EXTERNAL
+            // table this repo never creates, managed from the dashboard or a
+            // migration outside this scan). Both get the SAME ambiguity/guard
+            // evaluation below: a DISABLE right there in the scanned file is not
+            // "no information" just because we cannot confirm the table exists,
+            // and an unconditional ENABLE on either is equally provably safe.
+            // Reusing one model — instead of a second, separate one for external
+            // tables that has to relearn DROP/RENAME/guard/cross-directory order
+            // on its own — is what keeps them from disagreeing with each other.
+            const external = !s.everCreated;
             const ambiguous = events.some((e) => s.keys.has(e.key) && dirOf(e.file) !== dirOf(s.stateFile) && (s.enabled ? turnsOff(e.kind) : e.kind === 'enable'));
             if (s.enabled && !ambiguous && !s.guarded)
-                continue; // provably protected
+                continue; // provably protected (or provably fine, if external)
             // `guarded` means a statement we had to GUESS about decided this table's
             // state — a conditional ENABLE, DISABLE, CREATE, DROP or RENAME. Calling
             // that "critical" would be the same false confidence as calling it clean,
             // so it is reported as unconfirmed. A warning still fails CI (exit 1); it
             // just does not claim to know what only the database can tell.
-            const kind = ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
+            const kind = external ? 'external' : ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
             findings.push({
                 id: 'rls_missing',
                 severity: kind === 'missing' ? missingSeverity : 'warning',
-                title: kind === 'missing'
-                    ? (missingSeverity === 'critical'
-                        ? `Table "${s.display}" created without RLS`
-                        : `Table "${s.display}" has no RLS (server-only database)`)
-                    : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
-                        : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
-                detail: kind === 'missing'
-                    ? (missingSeverity === 'critical'
-                        ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
-                        : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
-                    : kind === 'order'
-                        ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
-                        : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
-                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`,
+                title: kind === 'external' ? `Table "${s.display}" may have RLS disabled here, but is never created in this repo`
+                    : kind === 'missing'
+                        ? (missingSeverity === 'critical'
+                            ? `Table "${s.display}" created without RLS`
+                            : `Table "${s.display}" has no RLS (server-only database)`)
+                        : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
+                            : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
+                detail: kind === 'external'
+                    ? `"${s.display}" is not created by any migration this scan can see, but this project's SQL leaves it with Row Level Security off — or its state cannot be confirmed statically (a conditional branch, or statements in different directories with no reliable apply order). Either the table is real — created from the dashboard, or in a migration outside this repo — and RLS on it may now be off, or it does not exist and this is a no-op. This cannot be told apart statically — check the deployed state.`
+                    : kind === 'missing'
+                        ? (missingSeverity === 'critical'
+                            ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
+                            : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
+                        : kind === 'order'
+                            ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
+                            : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
+                // The REVOKE-from-anon step only makes sense where an `anon` role is a
+                // real thing to revoke from — the same condition `missingSeverity`
+                // itself uses. Recommending it unconditionally told a server-only
+                // Postgres user (no Supabase, no anon role) to revoke privileges from
+                // a role that does not exist in their database, right next to a
+                // detail explaining that RLS is not needed there at all. An external
+                // table gets its own fix: we do not even know it exists, so neither
+                // the anon-revoke step nor the server-only "nothing to do" fits.
+                fix: kind === 'external'
+                    ? `Confirm whether "${s.display}" exists in the deployed database. If it does, re-enable RLS: ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; and add an owner/tenant policy.`
+                    : exposed || !serverOnly
+                        ? `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`
+                        : `No action needed unless a client-facing data API (Supabase/PostgREST, Hasura) is ever put in front of this database — if it is, first ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY and add an owner/tenant policy, then REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM the role that API uses to connect.`,
                 checker: 'rls-migrations',
                 level: 0,
-                file: s.file,
-                line: s.line,
+                file: external ? s.stateFile : s.file,
+                line: external ? s.stateLine : s.line,
             });
         }
+        // Zero findings can mean two very different things: every table here has
+        // RLS handled correctly, or no table definition was ever found in the SQL
+        // at all — a maintenance script (`SELECT now();`), a seed file with no
+        // CREATE TABLE (schema itself made from the dashboard), or literally zero
+        // .sql files. `sqlFiles.length === 0` alone used to gate this and missed
+        // the first two: presence of a .sql file is not presence of schema
+        // information. `events` tells the two apart directly — a table that was
+        // found and IS clean still produced a 'create' event, just no finding.
+        //
+        // A TEMP table's own 'create' does NOT count: it is session-only and
+        // PostgREST never sees it (the same reason it is excluded from findings
+        // below), so a migration that creates only a staging TEMP table — even
+        // one that also DISABLEs RLS on a persistent table this repo never
+        // defines — learned nothing about the real, permanent schema either.
+        // `findings.length > 0` also counts as "learned something": an external
+        // table (no local CREATE at all) can still produce a real finding — an
+        // explicit DISABLE sitting right in the scanned file — and that finding
+        // must not be thrown away just because no CREATE ever ran anywhere.
+        const sawAnyTable = findings.length > 0 || events.some((e) => e.kind === 'create' && !isTempKey(e.key));
+        if (!sawAnyTable && notUnderstood.length === 0 && ctx.detection.backends.includes('supabase')) {
+            return {
+                findings: [...notApplicable, {
+                        id: 'rls_unverifiable_no_migrations',
+                        severity: 'info',
+                        title: 'No table definitions found in SQL — RLS could not be checked statically',
+                        detail: 'This project talks to Supabase, but no CREATE TABLE (or SELECT ... INTO) was found in any .sql file here — either there are no migrations, or the ones present (a seed script, a maintenance query) do not define a schema. The schema may be managed from the dashboard, or migrations may live in a different repo. A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
+                        fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
+                        checker: 'rls-migrations',
+                        level: 0,
+                    }],
+                partial: 'no table definitions found in SQL for a Supabase project — RLS could not be checked for any table',
+            };
+        }
         const all = [...findings, ...notApplicable];
         if (notUnderstood.length === 0)
             return all;

package/dist/engine/checkers/static/secrets.js

@@ -1,4 +1,4 @@
-import { decodeJwtPayload, lineAt, looksLikePlaceholder, redact, shannonEntropy } from '../../util/text.js';
+import { decodeJwtPayload, lineAt, looksLikePlaceholder, looksLikeTestOrDocPath, redact, shannonEntropy } from '../../util/text.js';
 import { createExposure } from '../../util/git-exposure.js';
 import { partitionIgnores } from '../../config.js';
 /** No project-wide rules — used to run ONLY the inline-marker half of partitionIgnores. */
@@ -130,24 +130,29 @@ const PATTERNS = [
     {
         id: 'db_url_password',
         title: 'Database URL with an inline password',
-        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:/@"']+:([^\s:/@"']{4,})@[^\s"']+/gi,
+        // The trailing char classes exclude backtick/paren/bracket/comma/semicolon
+        // as well as the usual quote+whitespace: a URL written as a markdown-style
+        // example (`` `postgres://user:pass@host` `` in a comment or docstring)
+        // otherwise swallows the closing backtick into the host, which broke the
+        // local-host check below (`localhost\`` never matches `^localhost$`).
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:/@"'`)\];,]+:([^\s:/@"'`)\];,]{4,})@[^\s"'`)\];,]+/gi,
         severity: 'critical',
         fix: 'Move the connection string to a server-side env var and rotate the database password — a committed DB URL grants full data access.',
         // `postgres://opencut:opencut@localhost` in docker-compose / CI / a Dockerfile
         // is a local container's default login, not a credential. A password that
-        // equals the user name, or is a well-known default, is never reported; a
-        // weak password on a local/single-label host (a compose service name) is
-        // not either. A real-looking password on a real host still is.
+        // equals the user name, or is a well-known default, or is otherwise weak,
+        // is only exempt on a local/single-label host (a compose service name) —
+        // the exact same password on a real remote host is a live, guessable
+        // credential, not a throwaway dev default, and must still be reported.
         validate: (hit) => {
-            const m = /^[a-z+]+:\/\/([^\s:/@"']+):([^\s:/@"']+)@([^/\s:"']+)/i.exec(hit);
+            const m = /^[a-z+]+:\/\/([^\s:/@"'`)\];,]+):([^\s:/@"'`)\];,]+)@([^/\s:"'`)\];,]+)/i.exec(hit);
             if (!m)
                 return true;
             const [, user = '', pw = '', host = ''] = m;
-            if (pw.toLowerCase() === user.toLowerCase() || DEFAULT_PASSWORDS.has(pw.toLowerCase()))
-                return false;
             const local = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal|[a-z0-9_-]+)$/i.test(host);
             const strong = /[0-9]/.test(pw) && /[A-Za-z]/.test(pw) && shannonEntropy(pw) >= 3.0;
-            return !(local && !strong);
+            const weak = pw.toLowerCase() === user.toLowerCase() || DEFAULT_PASSWORDS.has(pw.toLowerCase()) || !strong;
+            return !(local && weak);
         },
     },
     {
@@ -171,8 +176,14 @@ const GENERIC = /\b([A-Za-z0-9_-]*(?:api[_-]?key|secret|token|passwd|password|pw
  * tracking ids, CSRF nonces, push tokens. 559 of 569 generic hits in one real
  * project were `tracking_token` / `pagination_token` inside cached API
  * responses.
+ *
+ * Deliberately NOT here: "session" and "reset". `sessionSecret` (the signing
+ * key for express-session/cookie-session — a real, common config secret) and
+ * `sessionToken`/`resetToken` (bearer auth / password-reset tokens, both
+ * enough to take over an account) are genuine credentials, not opaque ids —
+ * unlike `trackingToken`/`paginationToken`, they were being excluded outright.
  */
-const NON_SECRET_NAME = /(pagination|tracking|page|next|prev|continuation|cursor|csrf|xsrf|cancel|request|device|push|fcm|expo|invite|share|verification|unsubscribe|reset|confirm|session)/i;
+const NON_SECRET_NAME = /(pagination|tracking|page|next|prev|continuation|cursor|csrf|xsrf|cancel|request|device|push|fcm|expo|invite|share|verification|unsubscribe|confirm)/i;
 /** Base64 blobs (thumbnails, binary) and anything longer than a real token. */
 const looksLikeBlob = (v) => v.length > 200 || /^(\/9j\/|iVBOR|data:|R0lGOD|UklGR)/.test(v);
 const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
@@ -206,15 +217,320 @@ function isConfigish(rel) {
     return /(^|\/)\.env($|\.)/.test(rel) || /\.(ya?ml|toml|ini|conf|properties|npmrc|netrc)$/.test(rel)
         || /(^|\/)(Dockerfile|\.npmrc|\.netrc)$/.test(rel) || /docker-compose\.ya?ml$/.test(rel);
 }
+const dirOf = (rel) => (rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '');
+const isExampleEnv = (rel) => /(^|\/)\.env[^/]*\.(example|sample|template|dist)$/i.test(rel) || /(^|\/)(example|sample)\.env$/i.test(rel);
 /**
- * Documentation, examples and test fixtures are where sample keys legitimately
- * live. A hit there is worth mentioning but is not a credential leak.
+ * Values from the REAL env files, per directory. A committed .env.example
+ * that carries the same value as its sibling .env is not an example — it is
+ * the key, published. (Seen in the wild: OPENAI/ANTHROPIC keys identical
+ * in .env and a committed .env.example.)
  */
-function isExampleContext(rel) {
-    return /\.(md|txt|mdx|rst)$/i.test(rel)
-        || /\.(example|sample|template|dist)$/i.test(rel)
-        || /(^|\/)(docs?|examples?|fixtures?|__fixtures__|__tests__|test|tests|spec|__mocks__)(\/|$)/i.test(rel)
-        || /\.(test|spec)\.[a-z]+$/i.test(rel);
+function collectRealEnvValues(files) {
+    const realEnvValues = new Map();
+    for (const f of files) {
+        if (!isEnvFile(f.rel))
+            continue;
+        const set = realEnvValues.get(dirOf(f.rel)) ?? new Set();
+        for (const m of f.content.matchAll(ASSIGN)) {
+            const v = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
+            if (v.length >= 8)
+                set.add(v);
+        }
+        realEnvValues.set(dirOf(f.rel), set);
+    }
+    return realEnvValues;
+}
+/**
+ * Severity = what the value is × how it can leak. The pattern says what it
+ * is; the example/docs path lowers confidence; git exposure decides how bad
+ * it is. Builds the per-file `push` used by every scan pass below, so that
+ * pipeline lives in one place instead of being reimplemented per pass.
+ */
+function makePush({ rel, env, example, ex, realEnvValues, findings }) {
+    return (f, proven = false, raw) => {
+        let out = f;
+        const realValueInExample = !!raw && isExampleEnv(rel) && (realEnvValues.get(dirOf(rel))?.has(raw) ?? false);
+        if (realValueInExample) {
+            // Not an example at all: the live value copied into the example file.
+            out = {
+                ...f,
+                severity: ex === 'committed' ? 'critical' : 'warning',
+                title: `${f.title} — the REAL value from .env, in an example file${ex === 'committed' ? ' that is committed' : ''}`,
+                detail: `${f.detail} This value is identical to the one in the sibling .env: the example file carries the real credential${ex === 'committed' ? ', and it is committed to git' : ''}.`,
+                fix: 'Replace the value in the example file with a placeholder, and rotate the credential — it has been published.',
+            };
+        }
+        else if (example && proven) {
+            out = {
+                ...f,
+                severity: f.severity === 'critical' ? 'warning' : f.severity,
+                title: `${f.title} (in docs/example path — looks real)`,
+                detail: `${f.detail} The path suggests documentation or a fixture, but the value has the structure of real key material — verify it, and rotate it if it is genuine.`,
+            };
+        }
+        else if (example) {
+            out = {
+                ...f,
+                severity: 'info',
+                title: `${f.title} (in docs/example file)`,
+                detail: `${f.detail} This looks like documentation or a fixture — confirm it is not a real credential.`,
+            };
+        }
+        // Git exposure. A committed secret keeps its full severity. Everything
+        // else cannot leak through the repository right now: an ignored file is
+        // doing exactly what it should (advisory); an untracked file in a repo
+        // or a folder that is not a repo is hygiene, capped at warning.
+        if (!realValueInExample && out.severity !== 'info') {
+            // A .env that is not committed is doing its job: secrets belong there.
+            // Whether it WILL be committed (untracked, no .gitignore entry) is the
+            // env-git check's finding, not this one's — reporting it twice at
+            // warning is what made people stop reading.
+            if (env && ex !== 'committed') {
+                // This also covers `ex === 'ignored'`: an env file is always the
+                // right place for a secret whether or not it's ALSO gitignored, so
+                // there is nothing a separate ignored-env-file branch would add.
+                out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
+            }
+            else if (ex === 'ignored') {
+                // Gitignored, but not an env file: a credential pasted into a tool
+                // config or a script (a prod DB password inside a permission rule in
+                // .claude/settings.local.json was reported as a mere advisory). It
+                // cannot leak through git today; it still does not belong there.
+                out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.` };
+            }
+            else if (ex === 'untracked') {
+                out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.` };
+            }
+            else if (ex === 'no-git') {
+                out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} This folder is not a git repository, so nothing leaks through git; the risk is copying or zipping the folder. Move the value to an env var before this becomes a repo.` };
+            }
+        }
+        findings.push(out);
+    };
+}
+/** Vendor-shaped keys (OpenAI, AWS, Stripe, a DB URL password, a PEM block, …). */
+function scanVendorPatterns(content, rel, env, push) {
+    for (const p of PATTERNS) {
+        for (const m of content.matchAll(p.re)) {
+            const hit = m[0];
+            if (looksLikePlaceholder(hit))
+                continue; // YOUR_KEY / EXAMPLE / xxxxx / <...>
+            if (p.validate && !p.validate(hit))
+                continue;
+            // A secret in a server env/config file is expected — the risk is
+            // committing it (env-git flags that), so it is a warning, not a leak.
+            const severity = env && p.severity === 'critical' ? 'warning' : p.severity;
+            const proven = HIGH_CONFIDENCE.has(p.id) && looksLikeRealMaterial(p.id, hit, content, m.index ?? 0, m[1]);
+            push({
+                id: p.id,
+                severity,
+                title: env ? `${p.title} (in env/config file)` : p.title,
+                detail: env
+                    ? `${p.title} in ${rel} (${redact(hit)}). Normal for server env — keep this file gitignored and out of client bundles.`
+                    : `${p.title} found in source: ${redact(hit)}`,
+                fix: env ? 'Keep this file out of git and out of client bundles; rotate the value if it may have been committed.' : p.fix,
+                checker: 'secrets',
+                level: 0,
+                file: rel,
+                line: lineAt(content, m.index ?? 0),
+                evidence: redact(hit),
+            }, proven, hit);
+        }
+    }
+}
+/**
+ * Supabase service_role key (a JWT whose payload role is service_role). The
+ * decoded role proves what it is, so it is never a docs-only info.
+ */
+function scanServiceRoleJwt(content, rel, env, push) {
+    for (const m of content.matchAll(JWT)) {
+        const payload = decodeJwtPayload(m[0]);
+        if (payload && payload['role'] === 'service_role') {
+            push({
+                id: 'supabase_service_role_key',
+                severity: env ? 'warning' : 'critical',
+                title: env ? 'Supabase service_role key (in env/config file)' : 'Supabase service_role key in source',
+                detail: env
+                    ? `A service_role JWT is in ${rel}. Fine for server env only — never commit it or ship it to the client; keep the file gitignored.`
+                    : 'A service_role JWT bypasses Row Level Security entirely and is in source/client code. It must never ship to the client or the repo.',
+                fix: env
+                    ? 'Keep it server-side only, ensure the file is gitignored, and rotate it if it may have been committed.'
+                    : 'Remove it, rotate the service_role key in Supabase settings, and use it only in trusted server code.',
+                checker: 'secrets',
+                level: 0,
+                file: rel,
+                line: lineAt(content, m.index ?? 0),
+                evidence: redact(m[0]),
+            }, true, m[0]);
+        }
+    }
+}
+/** Quoted key/secret assignments in code, filtered by placeholder + entropy. */
+function scanGenericAssignments(content, rel, push) {
+    for (const m of content.matchAll(GENERIC)) {
+        const name = m[1] ?? '';
+        const value = m[2] ?? '';
+        if (NON_SECRET_NAME.test(name) || looksLikeBlob(value))
+            continue;
+        // Credentials have no whitespace ("Show password" is UI text) and carry
+        // digits or real length ("build-time-secret" is a label).
+        if (/\s/.test(value) || (!/[0-9]/.test(value) && value.length < 24))
+            continue;
+        if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.2)
+            continue;
+        push({
+            id: 'generic_secret',
+            severity: 'warning',
+            title: 'Possible hardcoded secret',
+            detail: `A high-entropy value is assigned to a secret-looking name: ${redact(value)}`,
+            fix: 'If this is a real credential, move it to a server-side env var and rotate it. If not, rename the variable or add `// easyvibegate-ignore`.',
+            checker: 'secrets',
+            level: 0,
+            file: rel,
+            line: lineAt(content, m.index ?? 0),
+            evidence: redact(value),
+        }, false, value);
+    }
+}
+/**
+ * name=value / key: value assignments (env, config, Dockerfile ENV/ARG). Runs
+ * before scanInlineEnv so a plain, single-assignment line keeps this rule's
+ * more specific title/fix on the dedup tie in dedupeFindings, rather than the
+ * inline-assignment rule's generic one.
+ */
+function scanConfigAssignments(content, rel, env, push) {
+    if (!isConfigish(rel))
+        return;
+    for (const m of content.matchAll(ASSIGN)) {
+        const name = m[1] ?? '';
+        if (!SECRET_NAME.test(name))
+            continue;
+        const value = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
+        if (value.length < 8 || looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+            continue;
+        // "build-time-secret" is a label, not a credential: real values carry digits or length.
+        if (!/[0-9]/.test(value) && value.length < 24)
+            continue;
+        push({
+            id: 'env_secret',
+            severity: 'warning',
+            title: env ? 'Secret in env file' : 'Secret in config file',
+            detail: `"${name}" holds a high-entropy value in ${rel}: ${redact(value)}`,
+            fix: env
+                ? 'Fine for server env — keep this file gitignored and out of the client; rotate if it may have leaked.'
+                : 'Move this secret out of committed config into a server-side secret store, and rotate it.',
+            checker: 'secrets',
+            level: 0,
+            file: rel,
+            line: lineAt(content, m.index ?? 0),
+            evidence: redact(value),
+        }, false, value);
+    }
+}
+/**
+ * Inline shell-style assignments mid-line, in every file including
+ * config-ish ones. scanConfigAssignments is start-of-line and one-per-line,
+ * so it never sees a Compose `environment:` list item (`- TOKEN=…`), a CI
+ * step's inline `run: TOKEN=… cmd`, or a second KEY=VALUE later on the same
+ * Dockerfile ENV line — all real leaks it silently missed while this ran
+ * only for non-config files. Also still needed for the original case: a prod
+ * DB password inside a permission rule in .claude/settings.local.json,
+ * invisible to every other name-based rule.
+ */
+function scanInlineEnv(content, rel, push) {
+    for (const m of content.matchAll(INLINE_ENV)) {
+        const name = m[1] ?? '';
+        const value = m[2] ?? '';
+        if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+            continue;
+        if (!/[0-9]/.test(value) && value.length < 24)
+            continue;
+        push({
+            id: 'env_secret',
+            severity: 'warning',
+            title: 'Secret in an inline assignment',
+            detail: `"${name}" is assigned a high-entropy value inline in ${rel}: ${redact(value)}`,
+            fix: 'Move the value to a gitignored .env and reference it by name; rotate it if the file was ever shared.',
+            checker: 'secrets',
+            level: 0,
+            file: rel,
+            line: lineAt(content, m.index ?? 0),
+            evidence: redact(value),
+        }, false, value);
+    }
+}
+/**
+ * De-duplicate only true repeats: the same secret, same place, same rule.
+ * (Keying on file:line alone hid every extra key on a minified line.)
+ */
+function dedupeFindings(findings) {
+    const seen = new Map();
+    for (const f of findings) {
+        const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
+        const cur = seen.get(key);
+        if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
+            seen.set(key, f);
+    }
+    return [...seen.values()];
+}
+const NAME_BASED = new Set(['env_secret', 'generic_secret']);
+/**
+ * A vendor pattern or a decoded JWT already identifies a VALUE on a line; the
+ * name-based env_secret / generic_secret finding for that SAME value is the
+ * same fact twice. Keyed on file:line:evidence, not just file:line — two
+ * different secrets assigned on one line (`const key="sk-proj-…",
+ * password="…"`) are two different facts, and dropping the second because
+ * the first has a specific pattern hid it entirely.
+ */
+function dropRedundantNameBased(findings) {
+    const specificAt = new Set(findings.filter((f) => !NAME_BASED.has(f.id)).map((f) => `${f.file ?? ''}:${f.line ?? 0}:${f.evidence ?? ''}`));
+    return findings.filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}:${f.evidence ?? ''}`)));
+}
+/**
+ * Eleven advisories saying "secret in gitignored .env.local — fine" are one
+ * observation printed eleven times. Fold them into one line per file that
+ * names the variables; anything above advisory stays line by line.
+ *
+ * The final `applyIgnores` pass (scan.ts) only sees whatever this checker
+ * returns — once N findings become one summary Finding with a single `line`,
+ * a `// easyvibegate-ignore` comment placed above any secret but the first in
+ * the group can no longer reach it. Filter each candidate through the SAME
+ * inline-marker check first (an empty config so only the marker, not
+ * project-wide `ignore`/`ignorePaths` rules, applies here — those still run
+ * again, correctly, against whatever this returns), so an individually
+ * silenced secret is dropped before folding, not after.
+ */
+function foldEnvAdvisories(kept, allFiles) {
+    const byFile = new Map();
+    for (const f of kept) {
+        if (f.id !== 'env_secret' || f.severity !== 'advisory' || !isEnvFile(f.file ?? ''))
+            continue;
+        byFile.set(f.file ?? '', [...(byFile.get(f.file ?? '') ?? []), f]);
+    }
+    const folded = new Set();
+    const summaries = [];
+    for (const [file, allCandidates] of byFile) {
+        const group = partitionIgnores(allCandidates, EMPTY_CONFIG, allFiles).kept;
+        // A member the marker silenced must not reappear individually either —
+        // it is done with, not merely "too few left to fold".
+        for (const f of allCandidates)
+            if (!group.includes(f))
+                folded.add(f);
+        if (group.length < 2)
+            continue;
+        for (const f of group)
+            folded.add(f);
+        const names = group.map((f) => /^"([^"]+)"/.exec(f.detail)?.[1] ?? '?');
+        const first = group.reduce((a, b) => ((a.line ?? 0) <= (b.line ?? 0) ? a : b));
+        summaries.push({
+            ...first,
+            title: `${group.length} secrets in ${file} (not committed — where they belong)`,
+            detail: `${file} holds ${group.length} secret-looking values (${names.join(', ')}). The file is not committed, so nothing leaks through git; keep it that way and out of client bundles.`,
+            fix: 'Nothing to change here. Keep the file gitignored; rotate any value that may ever have been committed or shared.',
+            evidence: undefined,
+        });
+    }
+    return [...kept.filter((f) => !folded.has(f)), ...summaries];
 }
 export const secretsChecker = {
     id: 'secrets',
@@ -223,284 +539,21 @@ export const secretsChecker = {
     run(ctx) {
         const findings = [];
         const exposure = createExposure(ctx.root);
-        // Values from the REAL env files, per directory. A committed .env.example
-        // that carries the same value as its sibling .env is not an example — it is
-        // the key, published. (Seen in the wild: OPENAI/ANTHROPIC keys identical
-        // in .env and a committed .env.example.)
-        const realEnvValues = new Map();
-        for (const f of ctx.files) {
-            if (!isEnvFile(f.rel))
-                continue;
-            const dir = f.rel.includes('/') ? f.rel.slice(0, f.rel.lastIndexOf('/')) : '';
-            const set = realEnvValues.get(dir) ?? new Set();
-            for (const m of f.content.matchAll(ASSIGN)) {
-                const v = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
-                if (v.length >= 8)
-                    set.add(v);
-            }
-            realEnvValues.set(dir, set);
-        }
-        const dirOf = (rel) => (rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '');
-        const isExampleEnv = (rel) => /(^|\/)\.env[^/]*\.(example|sample|template|dist)$/i.test(rel) || /(^|\/)(example|sample)\.env$/i.test(rel);
+        const realEnvValues = collectRealEnvValues(ctx.files);
         for (const file of ctx.files) {
             const { rel } = file;
             const content = file.content.replace(/^\uFEFF/, ''); // a BOM must not eat line 1
             const env = isEnvFile(rel);
-            const example = isExampleContext(rel);
+            const example = looksLikeTestOrDocPath(rel);
             const ex = exposure(rel);
-            // `proven` = the hit is structurally real key material (see
-            // looksLikeRealMaterial). A docs/fixture path may only downgrade a
-            // heuristic or sample-looking hit to info; proven material stays at
-            // warning there — the path lowers confidence, it does not make it safe.
-            /**
-             * Severity = what the value is × how it can leak. The pattern says what it
-             * is; the example/docs path lowers confidence; git exposure decides how
-             * bad it is. `raw` is the unredacted value, only compared, never stored.
-             */
-            const push = (f, proven = false, raw) => {
-                let out = f;
-                const realValueInExample = !!raw && isExampleEnv(rel) && (realEnvValues.get(dirOf(rel))?.has(raw) ?? false);
-                if (realValueInExample) {
-                    // Not an example at all: the live value copied into the example file.
-                    out = {
-                        ...f,
-                        severity: ex === 'committed' ? 'critical' : 'warning',
-                        title: `${f.title} — the REAL value from .env, in an example file${ex === 'committed' ? ' that is committed' : ''}`,
-                        detail: `${f.detail} This value is identical to the one in the sibling .env: the example file carries the real credential${ex === 'committed' ? ', and it is committed to git' : ''}.`,
-                        fix: 'Replace the value in the example file with a placeholder, and rotate the credential — it has been published.',
-                    };
-                }
-                else if (example && proven) {
-                    out = {
-                        ...f,
-                        severity: f.severity === 'critical' ? 'warning' : f.severity,
-                        title: `${f.title} (in docs/example path — looks real)`,
-                        detail: `${f.detail} The path suggests documentation or a fixture, but the value has the structure of real key material — verify it, and rotate it if it is genuine.`,
-                    };
-                }
-                else if (example) {
-                    out = {
-                        ...f,
-                        severity: 'info',
-                        title: `${f.title} (in docs/example file)`,
-                        detail: `${f.detail} This looks like documentation or a fixture — confirm it is not a real credential.`,
-                    };
-                }
-                // Git exposure. A committed secret keeps its full severity. Everything
-                // else cannot leak through the repository right now: an ignored file is
-                // doing exactly what it should (advisory); an untracked file in a repo
-                // or a folder that is not a repo is hygiene, capped at warning.
-                if (!realValueInExample && out.severity !== 'info') {
-                    // A .env that is not committed is doing its job: secrets belong there.
-                    // Whether it WILL be committed (untracked, no .gitignore entry) is the
-                    // env-git check's finding, not this one's — reporting it twice at
-                    // warning is what made people stop reading.
-                    if (env && ex !== 'committed') {
-                        // This also covers `ex === 'ignored'`: an env file is always the
-                        // right place for a secret whether or not it's ALSO gitignored, so
-                        // there is nothing a separate ignored-env-file branch would add.
-                        out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
-                    }
-                    else if (ex === 'ignored') {
-                        // Gitignored, but not an env file: a credential pasted into a tool
-                        // config or a script (a prod DB password inside a permission rule in
-                        // .claude/settings.local.json was reported as a mere advisory). It
-                        // cannot leak through git today; it still does not belong there.
-                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.` };
-                    }
-                    else if (ex === 'untracked') {
-                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.` };
-                    }
-                    else if (ex === 'no-git') {
-                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} This folder is not a git repository, so nothing leaks through git; the risk is copying or zipping the folder. Move the value to an env var before this becomes a repo.` };
-                    }
-                }
-                findings.push(out);
-            };
-            for (const p of PATTERNS) {
-                for (const m of content.matchAll(p.re)) {
-                    const hit = m[0];
-                    if (looksLikePlaceholder(hit))
-                        continue; // YOUR_KEY / EXAMPLE / xxxxx / <...>
-                    if (p.validate && !p.validate(hit))
-                        continue;
-                    // A secret in a server env/config file is expected — the risk is
-                    // committing it (env-git flags that), so it is a warning, not a leak.
-                    const severity = env && p.severity === 'critical' ? 'warning' : p.severity;
-                    const proven = HIGH_CONFIDENCE.has(p.id) && looksLikeRealMaterial(p.id, hit, content, m.index ?? 0, m[1]);
-                    push({
-                        id: p.id,
-                        severity,
-                        title: env ? `${p.title} (in env/config file)` : p.title,
-                        detail: env
-                            ? `${p.title} in ${rel} (${redact(hit)}). Normal for server env — keep this file gitignored and out of client bundles.`
-                            : `${p.title} found in source: ${redact(hit)}`,
-                        fix: env ? 'Keep this file out of git and out of client bundles; rotate the value if it may have been committed.' : p.fix,
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(hit),
-                    }, proven, hit);
-                }
-            }
-            // Supabase service_role key (a JWT whose payload role is service_role).
-            // The decoded role proves what it is, so it is never a docs-only info.
-            for (const m of content.matchAll(JWT)) {
-                const payload = decodeJwtPayload(m[0]);
-                if (payload && payload['role'] === 'service_role') {
-                    push({
-                        id: 'supabase_service_role_key',
-                        severity: env ? 'warning' : 'critical',
-                        title: env ? 'Supabase service_role key (in env/config file)' : 'Supabase service_role key in source',
-                        detail: env
-                            ? `A service_role JWT is in ${rel}. Fine for server env only — never commit it or ship it to the client; keep the file gitignored.`
-                            : 'A service_role JWT bypasses Row Level Security entirely and is in source/client code. It must never ship to the client or the repo.',
-                        fix: env
-                            ? 'Keep it server-side only, ensure the file is gitignored, and rotate it if it may have been committed.'
-                            : 'Remove it, rotate the service_role key in Supabase settings, and use it only in trusted server code.',
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(m[0]),
-                    }, true, m[0]);
-                }
-            }
-            // Quoted key/secret assignments in code, filtered by placeholder + entropy.
-            for (const m of content.matchAll(GENERIC)) {
-                const name = m[1] ?? '';
-                const value = m[2] ?? '';
-                if (NON_SECRET_NAME.test(name) || looksLikeBlob(value))
-                    continue;
-                // Credentials have no whitespace ("Show password" is UI text) and carry
-                // digits or real length ("build-time-secret" is a label).
-                if (/\s/.test(value) || (!/[0-9]/.test(value) && value.length < 24))
-                    continue;
-                if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.2)
-                    continue;
-                push({
-                    id: 'generic_secret',
-                    severity: 'warning',
-                    title: 'Possible hardcoded secret',
-                    detail: `A high-entropy value is assigned to a secret-looking name: ${redact(value)}`,
-                    fix: 'If this is a real credential, move it to a server-side env var and rotate it. If not, rename the variable or add `// easyvibegate-ignore`.',
-                    checker: 'secrets',
-                    level: 0,
-                    file: rel,
-                    line: lineAt(content, m.index ?? 0),
-                    evidence: redact(value),
-                }, false, value);
-            }
-            // Inline shell-style assignments mid-line, outside env/config files (those
-            // go through ASSIGN below). A prod DB password inside a permission rule in
-            // .claude/settings.local.json was invisible to both other name-based rules.
-            if (!isConfigish(rel)) {
-                for (const m of content.matchAll(INLINE_ENV)) {
-                    const name = m[1] ?? '';
-                    const value = m[2] ?? '';
-                    if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
-                        continue;
-                    if (!/[0-9]/.test(value) && value.length < 24)
-                        continue;
-                    push({
-                        id: 'env_secret',
-                        severity: 'warning',
-                        title: 'Secret in an inline assignment',
-                        detail: `"${name}" is assigned a high-entropy value inline in ${rel}: ${redact(value)}`,
-                        fix: 'Move the value to a gitignored .env and reference it by name; rotate it if the file was ever shared.',
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(value),
-                    }, false, value);
-                }
-            }
-            // name=value / key: value assignments (env, config, Dockerfile ENV/ARG).
-            if (isConfigish(rel)) {
-                for (const m of content.matchAll(ASSIGN)) {
-                    const name = m[1] ?? '';
-                    if (!SECRET_NAME.test(name))
-                        continue;
-                    const value = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
-                    if (value.length < 8 || looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
-                        continue;
-                    // "build-time-secret" is a label, not a credential: real values carry digits or length.
-                    if (!/[0-9]/.test(value) && value.length < 24)
-                        continue;
-                    push({
-                        id: 'env_secret',
-                        severity: 'warning',
-                        title: env ? 'Secret in env file' : 'Secret in config file',
-                        detail: `"${name}" holds a high-entropy value in ${rel}: ${redact(value)}`,
-                        fix: env
-                            ? 'Fine for server env — keep this file gitignored and out of the client; rotate if it may have leaked.'
-                            : 'Move this secret out of committed config into a server-side secret store, and rotate it.',
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(value),
-                    }, false, value);
-                }
-            }
-        }
-        // De-duplicate only true repeats: the same secret, same place, same rule.
-        // (Keying on file:line alone hid every extra key on a minified line.)
-        const seen = new Map();
-        for (const f of findings) {
-            const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
-            const cur = seen.get(key);
-            if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
-                seen.set(key, f);
-        }
-        // A vendor pattern or a decoded JWT already identifies the value on a line;
-        // the name-based env_secret / generic_secret there is the same fact twice.
-        const NAME_BASED = new Set(['env_secret', 'generic_secret']);
-        const specificAt = new Set([...seen.values()].filter((f) => !NAME_BASED.has(f.id)).map((f) => `${f.file ?? ''}:${f.line ?? 0}`));
-        const kept = [...seen.values()].filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}`)));
-        // Eleven advisories saying "secret in gitignored .env.local — fine" are one
-        // observation printed eleven times. Fold them into one line per file that
-        // names the variables; anything above advisory stays line by line.
-        //
-        // The final `applyIgnores` pass (scan.ts) only sees whatever this checker
-        // returns — once N findings become one summary Finding with a single
-        // `line`, a `// easyvibegate-ignore` comment placed above any secret but
-        // the first in the group can no longer reach it. Filter each candidate
-        // through the SAME inline-marker check first (an empty config so only the
-        // marker, not project-wide `ignore`/`ignorePaths` rules, applies here —
-        // those still run again, correctly, against whatever this returns), so an
-        // individually silenced secret is dropped before folding, not after.
-        const byFile = new Map();
-        for (const f of kept) {
-            if (f.id !== 'env_secret' || f.severity !== 'advisory' || !isEnvFile(f.file ?? ''))
-                continue;
-            byFile.set(f.file ?? '', [...(byFile.get(f.file ?? '') ?? []), f]);
-        }
-        const folded = new Set();
-        const summaries = [];
-        for (const [file, allCandidates] of byFile) {
-            const group = partitionIgnores(allCandidates, EMPTY_CONFIG, ctx.files).kept;
-            // A member the marker silenced must not reappear individually either —
-            // it is done with, not merely "too few left to fold".
-            for (const f of allCandidates)
-                if (!group.includes(f))
-                    folded.add(f);
-            if (group.length < 2)
-                continue;
-            for (const f of group)
-                folded.add(f);
-            const names = group.map((f) => /^"([^"]+)"/.exec(f.detail)?.[1] ?? '?');
-            const first = group.reduce((a, b) => ((a.line ?? 0) <= (b.line ?? 0) ? a : b));
-            summaries.push({
-                ...first,
-                title: `${group.length} secrets in ${file} (not committed — where they belong)`,
-                detail: `${file} holds ${group.length} secret-looking values (${names.join(', ')}). The file is not committed, so nothing leaks through git; keep it that way and out of client bundles.`,
-                fix: 'Nothing to change here. Keep the file gitignored; rotate any value that may ever have been committed or shared.',
-                evidence: undefined,
-            });
+            const push = makePush({ rel, env, example, ex, realEnvValues, findings });
+            scanVendorPatterns(content, rel, env, push);
+            scanServiceRoleJwt(content, rel, env, push);
+            scanGenericAssignments(content, rel, push);
+            scanConfigAssignments(content, rel, env, push);
+            scanInlineEnv(content, rel, push);
         }
-        return [...kept.filter((f) => !folded.has(f)), ...summaries];
+        const kept = dropRedundantNameBased(dedupeFindings(findings));
+        return foldEnvAdvisories(kept, ctx.files);
     },
 };

package/dist/engine/detect.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { DNS_LABEL } from './util/text.js';
+import { DNS_LABEL, looksLikeTestOrDocPath } from './util/text.js';
+import { maskCode } from './util/mask.js';
 const SUPABASE_URL_FALLBACK = new RegExp(`https?://${DNS_LABEL}\\.supabase\\.co`, 'i');
 /** Infer the project's frameworks, backends, languages and package managers. */
 export function detect(root, files) {
@@ -104,10 +105,23 @@ export function detect(root, files) {
     // false positives from code that merely mentions a backend by name. Uses the
     // shared bounded DNS_LABEL (see util/text.ts) so this cannot go quadratic on
     // a long run of matching characters in a large file.
-    if (!backends.has('supabase') && files.some((f) => SUPABASE_URL_FALLBACK.test(f.content))) {
+    //
+    // Two independent guards against a project's own code making itself look
+    // like it uses a backend it only mentions: test/fixture files are excluded
+    // (a test suite for code that talks to Supabase routinely contains
+    // synthetic mock URLs shaped like a real project's own), and comments are
+    // masked before matching (an explanatory comment describing that exact URL
+    // shape is otherwise itself a match). Both were needed: this fallback once
+    // made EasyVibeGate's own test suite, and separately its own source
+    // comments, detect EasyVibeGate itself as a Supabase project — a security
+    // scanner flagging itself is exactly what dogfooding exists to catch.
+    // Strings are NOT masked: a real URL/call normally appears in one.
+    const nonTestFiles = files.filter((f) => !looksLikeTestOrDocPath(f.rel));
+    const codeOnly = (f) => maskCode(f.content, { file: f.rel });
+    if (!backends.has('supabase') && nonTestFiles.some((f) => SUPABASE_URL_FALLBACK.test(codeOnly(f)))) {
         backends.add('supabase');
     }
-    if (!backends.has('firebase') && files.some((f) => /\binitializeApp\s*\(/.test(f.content) && /firebase/i.test(f.content))) {
+    if (!backends.has('firebase') && nonTestFiles.some((f) => { const c = codeOnly(f); return /\binitializeApp\s*\(/.test(c) && /firebase/i.test(c); })) {
         backends.add('firebase');
     }
     return {

package/dist/engine/util/text.js

@@ -60,3 +60,17 @@ export function decodeJwtPayload(token) {
  * milliseconds — and no real hostname label is longer than this anyway.
  */
 export const DNS_LABEL = '[a-z0-9-]{1,63}';
+/**
+ * Documentation, examples and test/fixture paths — where a sample config
+ * value (a fake Supabase URL, a placeholder key) legitimately lives without
+ * describing anything about the real project. A test suite for code that
+ * TALKS to a backend routinely contains literal-looking URLs/keys for that
+ * backend as mock data; without this, scanning a project's own tests can
+ * make the project appear to use a backend it merely tests against.
+ */
+export function looksLikeTestOrDocPath(rel) {
+    return /\.(md|txt|mdx|rst)$/i.test(rel)
+        || /\.(example|sample|template|dist)$/i.test(rel)
+        || /(^|\/)(docs?|examples?|fixtures?|__fixtures__|__tests__|test|tests|spec|__mocks__)(\/|$)/i.test(rel)
+        || /\.(test|spec)\.[a-z]+$/i.test(rel);
+}

package/dist/engine/walk.js

@@ -15,22 +15,32 @@ const SKIP_DIRS = new Set([
 ]);
 /**
  * Names ambiguous enough that they are sometimes real source (a module named
- * "cache", a package called "tmp") and sometimes pure data. Skipped only when
- * `relDir` (the ambiguous directory's own path, relative to the project root,
- * e.g. "cache" or "data/cache") has at most 2 path segments — i.e. the
- * directory IS the root's own child, or is nested exactly one level below it.
- * The real-world evidence for this was `data/cache/*.json` full of API
- * pagination tokens, 559 of 569 "generic secrets" in one real project. Deeper
- * nesting (`apps/api/src/lib/cache/`, 4 segments) is ordinary source and stays
- * scanned; blanket name-matching at any depth once made a source directory
- * invisible to every check with no visible coverage gap.
+ * "cache", a package called "tmp") and sometimes pure data. Path depth alone
+ * does not tell them apart: `src/cache` and `data/cache` are both 2 segments,
+ * but the first is exactly as likely to be a project's own source directory
+ * (a caching module) as the second is to be scan output. What DOES tell them
+ * apart is the parent: a data-ish parent name (`data`, `var`, `storage`) means
+ * generated/fetched content; an ordinary source-tree parent does not. Skipped
+ * only when the ambiguous name is the project root's own child (`cache/`,
+ * `tmp/` at the top level), or its immediate parent is one of those data-ish
+ * names (`data/cache`, `var/tmp`). The real-world evidence for this was
+ * `data/cache/*.json` full of API pagination tokens, 559 of 569 "generic
+ * secrets" in one real project; blanket name-matching at any depth once made
+ * a source directory invisible to every check with no visible coverage gap,
+ * and matching by depth alone reopened that exact gap for `src/cache`.
  */
 const AMBIGUOUS_DATA_DIRS = new Set(['cache', 'caches', 'tmp', 'temp', '.tmp']);
-const isShallowDataDir = (name, relDir) => AMBIGUOUS_DATA_DIRS.has(name) && relDir.split('/').length <= 2;
+const DATA_ISH_PARENTS = new Set(['data', 'var', 'storage']);
+const isShallowDataDir = (name, relDir) => {
+    if (!AMBIGUOUS_DATA_DIRS.has(name))
+        return false;
+    const segs = relDir.split('/');
+    return segs.length === 1 || (segs.length === 2 && DATA_ISH_PARENTS.has((segs[0] ?? '').toLowerCase()));
+};
 const TEXT_EXT = new Set([
-    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte',
+    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.mts', '.cts', '.vue', '.svelte',
     '.py', '.rb', '.php', '.go', '.rs', '.java', '.kt', '.cs',
-    '.html', '.css', '.scss', '.json', '.yml', '.yaml', '.toml',
+    '.html', '.css', '.scss', '.json', '.jsonc', '.json5', '.yml', '.yaml', '.toml',
     '.env', '.sh', '.sql', '.md', '.txt', '.ini', '.conf', '.tf',
     '.pem', '.key', '.crt', '.cert', '.pkcs8',
     '.astro', '.properties', '.plist', '.swift', '.dart', '.ipynb', '.bash', '.zsh', '.mdx',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "easyvibegate",
-  "version": "0.6.2",
+  "version": "0.6.8",
   "description": "Interactive security scanner for vibe-coded apps (focus: Next.js + Supabase). Checks common risks and shows evidence where it can.",
   "type": "module",
   "bin": {