easyvibegate 0.6.2 → 0.6.9

package/README.en.md

@@ -8,7 +8,16 @@
 
 Most scanners grep your code and say *"you might have leaked a key."* EasyVibeGate also goes to the running backend: for **Supabase/Firebase** it walks in with the public key and shows which tables are readable by anyone, with the exact `curl` — plus SQL to close it. It is honest about coverage: every check reports whether it actually ran, so a failed or skipped check is never shown as a green "all clear".
 
-> Status: **v0.5, early.** Best-supported stack: **Next.js + Supabase**. Code review runs on any stack; the live backend probe is read-only and Supabase/Firebase-focused. Not a penetration test.
+> Status: **actively maintained, version 0.6.8.** Best-supported stack: **Next.js + Supabase**. Code review runs on any stack; the live backend probe is read-only and Supabase/Firebase-focused. Not a penetration test.
+
+### What it actually checks
+
+1. **Secrets hardcoded in source** — API keys (OpenAI, Stripe, AWS, Supabase, etc.) and database passwords written directly into code instead of environment variables. If the code ever leaves your machine (a public repo, a screenshot, a shared link), those keys leak with it.
+2. **Row Level Security (RLS) disabled in the database** — if a Supabase/Postgres table has no row-level protection, anyone holding only your app's public (anon) key — i.e. literally every visitor — can read and sometimes write every user's data through the API, not just their own.
+3. **Secrets shipped in the client bundle** — variables prefixed `NEXT_PUBLIC_` / `VITE_` / `REACT_APP_` are baked straight into the JS every visitor's browser downloads. If a real secret ends up behind one of those prefixes, it's visible in the page source (F12 → Sources).
+4. **Dangerous config** — CORS allowing any origin, debug/verbose mode left on, use of `eval`, SQL built by string concatenation (injection risk), a JWT with `alg: none`.
+5. **`.env` / git hygiene** — a secret in a committed `.env` is already in git history and visible to anyone with repo access, even after the file is deleted later.
+6. **Live backend probe** (opt-in, your own projects only) — the tool actually talks to your running Supabase/Firebase with the public key and checks which tables/buckets are readable without auth, plus hits discovered API endpoints with no token. Read-only — it never writes or breaks anything.
 
 ## How to run
 
@@ -22,7 +31,6 @@ If you use **Cursor, Claude Code, or Codex**, you don't need to type anything in
 Check this project's security with EasyVibeGate and explain the result in plain language.
 
 1. Run at the project root:  npx easyvibegate . --no-wizard --deps
-   (After the npm release the short form is: npx easyvibegate . --no-wizard --deps)
    (Add  --url <my-app-url> --i-own-this  only if this is my project
     and I allow the live backend probe.)
 2. Open and read the file:  easyvibegate-report/ai-fix-prompt.md

package/README.md

@@ -8,7 +8,7 @@
 
 Большинство сканеров просто грепают код и говорят «возможно, ты слил ключ». EasyVibeGate идёт дальше: для **Supabase/Firebase** заходит публичным ключом и показывает, какие таблицы читаются кем угодно, с готовым `curl` и SQL для починки. И он честен про покрытие: каждая проверка сообщает, реально ли она выполнилась, поэтому упавшая или пропущенная проверка **никогда не выдаётся за зелёное «всё чисто»**.
 
-> Статус: **v0.5, ранняя версия.** Лучше всего поддержан стек **Next.js + Supabase**. Осмотр кода работает на любом стеке; живой пробинг бэкенда — только чтение и заточен под Supabase/Firebase. Это не пентест.
+> Статус: **активно развивается, версия 0.6.8.** Лучше всего поддержан стек **Next.js + Supabase**. Осмотр кода работает на любом стеке; живой пробинг бэкенда — только чтение и заточен под Supabase/Firebase. Это не пентест.
 
 ## 🇷🇺 Простыми словами
 
@@ -21,7 +21,16 @@
 2. Ответь на пару вопросов «да / нет».
 3. Получишь понятный отчёт и готовый план починки — вставь его в свой ИИ (Cursor/Claude), и он всё исправит.
 
-Разбираться в том, что внутри, не нужно: сложное — под капотом, снаружи одна команда и вопросы «да / нет».
+Разбираться в том, что внутри, не нужно: сложное — под капотом, снаружи одна команда и вопросы «да / нет». Но если интересно — вот что конкретно проверяется.
+
+### Что именно оно ищет
+
+1. **Секреты прямо в коде** — API-ключи (OpenAI, Stripe, AWS, Supabase и т.д.) и пароли от базы, вписанные в код текстом, а не через переменные окружения. Если код когда-нибудь попадёт наружу (публичный репозиторий, скриншот, share-ссылка) — эти ключи утекут вместе с ним.
+2. **Отключённый RLS (Row Level Security) в базе** — если у таблицы в Supabase/Postgres не включена построчная защита, то любой человек, у которого есть только публичный (анонимный) ключ твоего приложения — то есть буквально каждый посетитель сайта — может через API читать и иногда менять данные ВСЕХ пользователей, а не только свои.
+3. **Секреты в клиентском бандле** — переменные с префиксом `NEXT_PUBLIC_` / `VITE_` / `REACT_APP_` попадают прямо в JS-файлы, которые скачивает браузер каждого посетителя. Если под таким префиксом лежит не публичный, а секретный ключ — его видно в исходниках страницы (F12 → Sources).
+4. **Опасные настройки конфигурации** — CORS, разрешающий запросы с любого домена, включённый debug/verbose-режим, использование `eval`, сборка SQL-запроса через склейку строк (риск SQL-инъекции), JWT с `alg: none`.
+5. **Гигиена `.env` и git** — секрет в закоммиченном `.env` уже попал в историю git и виден всем, у кого есть доступ к репозиторию (даже если файл потом удалить — история останется).
+6. **Живая проверка бэкенда** (по желанию, только на своих проектах) — инструмент реально обращается к твоему работающему Supabase/Firebase с публичным ключом и смотрит, какие таблицы/бакеты читаются без авторизации, плюс дёргает найденные API-эндпоинты без токена. Только чтение, ничего не пишет и не ломает.
 
 ## Как запустить
 

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { planTargets, runFlow } from '../orchestrator/flow.js';
@@ -262,6 +262,12 @@ async function main() {
     // Reports land next to the scanned project by default, so scanning several
     // projects from one shell never overwrites another project's report.
     const outDir = args.output !== undefined ? resolve(args.output) : join(root, 'easyvibegate-report');
+    // Excluding outDir from the scan only makes sense when something is
+    // actually going to be written there. With --no-report (format 'none'),
+    // nothing is ever written to it — so a `--no-report --output <project>/src`
+    // run must not exclude real source just because it shares a path with an
+    // output directory nothing will use.
+    const excludeOutDir = args.format !== 'none' ? [outDir] : [];
     // The report directory gets its OWN `.gitignore` (see prepareOutputDir) and
     // has its stale report files deleted on every run. Both are safe for a
     // directory that exists only to hold reports — neither is safe for the
@@ -292,7 +298,7 @@ async function main() {
     let result;
     if (useWizard) {
         result = await runWizard({
-            excludeAbs: [outDir],
+            excludeAbs: excludeOutDir,
             path: args.path,
             config: args.config,
             lang,
@@ -320,7 +326,7 @@ async function main() {
         };
         // Same contract as the wizard: plan the concrete targets once, ask about
         // exactly those, execute exactly those.
-        const staticResult = await scanStatic(root, { configPath: args.config, excludeAbs: [outDir] });
+        const staticResult = await scanStatic(root, { configPath: args.config, excludeAbs: excludeOutDir });
         const plan = planTargets(staticResult.files, loadConfig(root, args.config), {
             appUrl: args.appUrl,
             supabaseUrl: args.supabaseUrl,
@@ -373,18 +379,33 @@ async function main() {
     // Same contract in every mode: 2 critical, 1 warning, 3 incomplete, 0 clean.
     process.exit(exitCodeFor(summary));
 }
+// Written verbatim (never partially, never appended-to) so an exact match on
+// disk is proof WE created this directory, not the user re-pointing --output
+// at a folder of their own. Checking "does outDir === project root" only was
+// not enough: `--output docs` on a real docs/ folder replaced its real
+// .gitignore (losing rules like `drafts/`) and deleted a real docs/report.md.
+const OUTPUT_DIR_MARKER = '# Written by EasyVibeGate: this report can contain secret prefixes and hosts. Never commit it.\n*\n';
 /** Create the report dir and clear our own stale files, or explain why we cannot. */
 function prepareOutputDir(dir) {
     try {
-        if (existsSync(dir) && !statSync(dir).isDirectory())
+        const existed = existsSync(dir);
+        if (existed && !statSync(dir).isDirectory())
             return 'exists and is not a directory';
+        if (existed) {
+            const ownsIt = existsSync(join(dir, '.gitignore')) && readFileSync(join(dir, '.gitignore'), 'utf8') === OUTPUT_DIR_MARKER;
+            if (!ownsIt && readdirSync(dir).length > 0) {
+                return 'already exists, is not empty, and was not created by a previous EasyVibeGate run — refusing to overwrite its .gitignore or delete files in it; point --output at an empty or dedicated directory';
+            }
+        }
         mkdirSync(dir, { recursive: true });
         // The report names secret prefixes, database hosts and every endpoint —
         // exactly what must not be committed. A `.gitignore` containing `*` inside
         // the directory makes git ignore it wherever the project's own .gitignore
         // stands (the trick node_modules-style caches use); the user's files are
-        // never edited. Rewritten every run so a stray edit cannot un-ignore it.
-        writeFileSync(join(dir, '.gitignore'), '# Written by EasyVibeGate: this report can contain secret prefixes and hosts. Never commit it.\n*\n', 'utf8');
+        // never edited. Rewritten every run so a stray edit cannot un-ignore it —
+        // safe now because we only ever reach this line for a directory that was
+        // either empty or already marked as ours.
+        writeFileSync(join(dir, '.gitignore'), OUTPUT_DIR_MARKER, 'utf8');
         // Old report.md next to a fresh report.json told two different stories.
         for (const name of ['report.md', 'report.json', 'ai-fix-prompt.md']) {
             const p = join(dir, name);

package/dist/engine/checkers/deep/deps.js

@@ -1,5 +1,18 @@
 import { execFile } from 'node:child_process';
 const MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
+/**
+ * Extra args that restrict the audit to non-dev dependencies, per manager.
+ * Used for a SECOND audit pass so dev-only tooling (eslint, vitest, turbo —
+ * never shipped, never run on the server) can be told apart from the runtime
+ * dependency tree, without guessing from node_modules paths.
+ */
+const PROD_ONLY_ARGS = {
+    npm: ['audit', '--omit=dev', '--json'],
+    pnpm: ['audit', '--prod', '--json'],
+    // yarn's --groups takes each value as its OWN argument, not comma-joined —
+    // `--groups dependencies,optionalDependencies` silently audited 0 packages.
+    yarn: ['audit', '--groups', 'dependencies', 'optionalDependencies', '--json'],
+};
 function run(cmd, args, cwd, timeoutMs) {
     return new Promise((resolve) => {
         execFile(cmd, args, { cwd, timeout: timeoutMs, maxBuffer: 20 * 1024 * 1024 }, (err, stdout) => {
@@ -48,6 +61,128 @@ function validCounts(v) {
     }
     return out;
 }
+/** `fixAvailable` in npm's (and yarn's) newer `vulnerabilities` map: `true`, an object, or absent/false. */
+function formatFixAvailable(fixAvailable) {
+    if (fixAvailable === true)
+        return 'update available';
+    if (fixAvailable && typeof fixAvailable === 'object') {
+        const f = fixAvailable;
+        if (f.name && f.version)
+            return `needs ${f.name}@${f.version}${f.isSemVerMajor ? ' (major)' : ''}`;
+    }
+    return undefined;
+}
+/** Keep the worst-severity entry per package name, in original order, capped. */
+function dedupePackages(list, cap) {
+    const rank = { critical: 0, high: 1, moderate: 2, low: 3, info: 4 };
+    const best = new Map();
+    for (const p of list) {
+        const cur = best.get(p.name);
+        if (!cur || (rank[p.severity] ?? 9) < (rank[cur.severity] ?? 9))
+            best.set(p.name, p);
+    }
+    return [...best.values()].slice(0, cap);
+}
+/**
+ * Normalize one audit run's stdout into counts + a package list, across three
+ * incompatible report shapes:
+ *  - npm (v7+) / yarn's `vulnerabilities` map, keyed by package name, each
+ *    entry carrying `name`/`severity`/`range`/`fixAvailable` directly.
+ *  - pnpm's `advisories` map — the OLDER npm-audit-v1 report shape pnpm still
+ *    emits, keyed by numeric advisory id, each entry carrying `module_name` /
+ *    `vulnerable_versions` / `patched_versions` instead. A package with
+ *    several advisories appears more than once, so results get deduped by
+ *    name. (The previous version of this reader only knew the newer shape,
+ *    so pnpm projects silently got an empty package list — 0 names, always —
+ *    even though `metadata.vulnerabilities` parsed fine.)
+ *  - yarn v1's NDJSON stream of `{type, data}` lines: one `auditSummary` line
+ *    with the counts, and one `auditAdvisory` line per finding, each nesting
+ *    the same `module_name`/`vulnerable_versions`/`patched_versions` shape as
+ *    pnpm's under `data.advisory`.
+ */
+function parseAuditPayload(pm, stdout) {
+    if (pm === 'yarn') {
+        let counts = null;
+        const packages = [];
+        for (const line of stdout.split('\n')) {
+            const s = line.trim();
+            if (!s.startsWith('{'))
+                continue;
+            let obj;
+            try {
+                obj = JSON.parse(s);
+            }
+            catch {
+                continue;
+            }
+            if (obj.type === 'auditSummary') {
+                counts = validCounts(obj.data?.vulnerabilities);
+            }
+            else if (obj.type === 'auditAdvisory') {
+                const a = obj.data?.advisory;
+                if (a && typeof a['module_name'] === 'string' && typeof a['severity'] === 'string') {
+                    packages.push({
+                        name: a['module_name'],
+                        severity: a['severity'],
+                        range: typeof a['vulnerable_versions'] === 'string' ? a['vulnerable_versions'] : undefined,
+                        fix: typeof a['patched_versions'] === 'string' ? a['patched_versions'] : undefined,
+                    });
+                }
+            }
+        }
+        return counts ? { counts, packages } : null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        const line = stdout.trim().split('\n').filter(Boolean).pop() ?? '';
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (typeof parsed !== 'object' || parsed === null || parsed['error'] !== undefined)
+        return null;
+    const counts = validCounts(parsed['metadata']?.vulnerabilities);
+    if (!counts)
+        return null;
+    const packages = [];
+    const vulnMap = parsed['vulnerabilities'];
+    if (vulnMap && typeof vulnMap === 'object') {
+        // npm v2 / yarn-berry-style: keyed by package name, one entry each.
+        for (const v of Object.values(vulnMap)) {
+            if (typeof v['name'] !== 'string' || typeof v['severity'] !== 'string')
+                continue;
+            packages.push({
+                name: v['name'],
+                severity: v['severity'],
+                range: typeof v['range'] === 'string' ? v['range'] : undefined,
+                fix: formatFixAvailable(v['fixAvailable']),
+            });
+        }
+    }
+    else {
+        // pnpm: the old npm-audit-v1 shape, keyed by numeric advisory id.
+        const advisories = parsed['advisories'];
+        if (advisories && typeof advisories === 'object') {
+            for (const a of Object.values(advisories)) {
+                if (typeof a['module_name'] !== 'string' || typeof a['severity'] !== 'string')
+                    continue;
+                packages.push({
+                    name: a['module_name'],
+                    severity: a['severity'],
+                    range: typeof a['vulnerable_versions'] === 'string' ? a['vulnerable_versions'] : undefined,
+                    fix: typeof a['patched_versions'] === 'string' ? a['patched_versions'] : undefined,
+                });
+            }
+        }
+    }
+    return { counts, packages };
+}
 /**
  * Level 1: dependency vulnerability audit via the project's package manager.
  * Returns a status so an audit that could not run (offline, missing tool,
@@ -99,78 +234,87 @@ export async function auditDeps(root, packageManagers, timeoutMs = 60000) {
         return failed(`${pm} audit exited with code ${res.code}`);
     if (!res.stdout.trim())
         return failed(`${pm} audit produced no output (offline or no lockfile?)`);
-    let counts = null;
-    let vulnMap = {};
-    if (pm === 'yarn') {
-        for (const line of res.stdout.split('\n')) {
-            const s = line.trim();
-            if (!s.startsWith('{'))
-                continue;
-            try {
-                const obj = JSON.parse(s);
-                if (obj.type === 'auditSummary')
-                    counts = validCounts(obj.data?.vulnerabilities);
-            }
-            catch { /* skip */ }
-        }
-        if (!counts)
-            return failed('unparseable audit output (no valid yarn auditSummary)');
-    }
-    else {
-        let parsed;
-        try {
-            parsed = JSON.parse(res.stdout);
-        }
-        catch {
-            const line = res.stdout.trim().split('\n').filter(Boolean).pop() ?? '';
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch {
-                return failed('unparseable audit output (not JSON)');
-            }
-        }
-        // A valid JSON error envelope (e.g. registry unavailable) is NOT "clean".
-        if (typeof parsed !== 'object' || parsed === null || parsed.error !== undefined) {
-            return failed('audit returned an error envelope');
-        }
-        counts = validCounts(parsed.metadata?.vulnerabilities);
-        if (!counts)
-            return failed('unparseable audit output (metadata.vulnerabilities missing or malformed)');
-        vulnMap = parsed.vulnerabilities ?? {};
-    }
-    const { critical, high, moderate, low } = counts;
-    const total = counts.total ?? critical + high + moderate + low + counts.info;
+    const full = parseAuditPayload(pm, res.stdout);
+    if (!full)
+        return failed('unparseable audit output');
+    // Second pass, prod-only: tells apart a real runtime hole from a vulnerable
+    // devDependency (eslint, vitest, turbo — never shipped, never executed on
+    // the server) that would otherwise inflate the score and the verdict the
+    // same way a live SQL injection would. Best-effort: if this second call
+    // fails for any reason, fall back to treating the full count as the runtime
+    // count — never the other way around, so a failure here cannot make a real
+    // vulnerability look dev-only.
+    const prodRes = await run(pm, PROD_ONLY_ARGS[pm], root, timeoutMs);
+    const prod = !prodRes.failedToSpawn && prodRes.code !== null
+        && (prodRes.code === 0 || isVulnsFoundExit(pm, prodRes.code))
+        && prodRes.stdout.trim()
+        ? parseAuditPayload(pm, prodRes.stdout)
+        : null;
+    const runtime = prod ?? full;
+    // Only ever attribute MORE to dev, never invent runtime risk the tool
+    // itself never reported — clamp at 0 in case the two audit runs disagree
+    // (a lockfile changing between calls, or manager-specific flag quirks).
+    const devOnly = {
+        info: Math.max(0, full.counts.info - runtime.counts.info),
+        low: Math.max(0, full.counts.low - runtime.counts.low),
+        moderate: Math.max(0, full.counts.moderate - runtime.counts.moderate),
+        high: Math.max(0, full.counts.high - runtime.counts.high),
+        critical: Math.max(0, full.counts.critical - runtime.counts.critical),
+    };
+    const devTotal = devOnly.info + devOnly.low + devOnly.moderate + devOnly.high + devOnly.critical;
+    const splitKnown = prod !== null;
+    const { critical, high, moderate, low } = runtime.counts;
+    const runtimeTotal = runtime.counts.total ?? critical + high + moderate + low + runtime.counts.info;
     const findings = [...conflictFindings];
-    if (total > 0) {
+    if (runtimeTotal > 0) {
         const severity = critical + high > 0 ? 'critical' : moderate > 0 ? 'warning' : 'info';
+        const devNote = splitKnown && devTotal > 0
+            ? ` (plus ${devTotal} in dev-only tooling — not counted here, does not ship or run on the server)`
+            : !splitKnown
+                ? ' (dev/runtime split unavailable — this count includes dev dependencies)'
+                : '';
         findings.push({
             id: 'deps_vulnerabilities',
             severity,
-            title: `${total} vulnerable dependenc${total === 1 ? 'y' : 'ies'}`,
-            detail: `${pm} audit: ${critical} critical, ${high} high, ${moderate} moderate, ${low} low.`,
+            title: `${runtimeTotal} vulnerable runtime dependenc${runtimeTotal === 1 ? 'y' : 'ies'}${devNote}`,
+            detail: `${pm} audit (runtime only): ${critical} critical, ${high} high, ${moderate} moderate, ${low} low.`,
             fix: `Run \`${pm} audit${pm === 'npm' ? ' fix' : ''}\` and upgrade the flagged packages; check breaking changes.`,
             checker: 'deps',
             level: 1,
         });
-        const named = Object.values(vulnMap)
-            .filter((v) => v.severity === 'critical' || v.severity === 'high')
-            .map((v) => v.name)
-            .filter(Boolean)
-            .slice(0, 8);
+        const named = dedupePackages(runtime.packages.filter((p) => p.severity === 'critical' || p.severity === 'high'), 8);
         if (named.length) {
             findings.push({
                 id: 'deps_top_packages',
                 severity: 'info',
-                title: 'High/critical packages to upgrade',
-                detail: named.join(', '),
+                title: 'High/critical runtime packages to upgrade',
+                detail: named.map((p) => `${p.name} (${p.range ?? '?'})${p.fix ? ` → ${p.fix}` : ''}`).join(', '),
                 fix: 'Upgrade these first; they carry the most severe advisories.',
                 checker: 'deps',
                 level: 1,
             });
         }
     }
-    // "completed" with zero findings means genuinely no known vulns — the status,
-    // not an info finding, records that the check ran cleanly.
+    // Dev-only vulnerabilities are still worth knowing about (a compromised
+    // build-time tool can still do damage), but they are hygiene, not a hole a
+    // client can reach — info, and never why the gate fails.
+    if (splitKnown && devTotal > 0) {
+        const devCritHigh = devOnly.critical + devOnly.high;
+        const devNamed = dedupePackages(full.packages
+            .filter((p) => p.severity === 'critical' || p.severity === 'high')
+            .filter((p) => !runtime.packages.some((r) => r.name === p.name)), 8);
+        findings.push({
+            id: 'deps_dev_vulnerabilities',
+            severity: 'info',
+            title: `${devTotal} vulnerable dev-only dependenc${devTotal === 1 ? 'y' : 'ies'}`,
+            detail: `${devOnly.critical} critical, ${devOnly.high} high, ${devOnly.moderate} moderate, ${devOnly.low} low — only in build/test tooling (e.g. eslint, vitest, turbo), never shipped to the browser or run on the server.${devCritHigh > 0 && devNamed.length ? ` Top: ${devNamed.map((p) => p.name).join(', ')}.` : ''}`,
+            fix: `Worth updating on its own schedule — run \`${pm} audit\` (full) to see them; they do not affect this project's runtime exposure.`,
+            checker: 'deps',
+            level: 1,
+        });
+    }
+    // "completed" with zero runtime findings means genuinely no known runtime
+    // vulns — the status, not an info finding, records that the check ran
+    // cleanly. A dev-only info finding can still be present.
     return { findings, run: withNote({ id: 'deps', level: 1, status: 'completed' }) };
 }

package/dist/engine/checkers/index.js

@@ -4,6 +4,7 @@ import { configRisksChecker } from './static/config-risks.js';
 import { rlsMigrationsChecker } from './static/rls-migrations.js';
 import { envGitChecker } from './static/env-git.js';
 import { routeInventoryChecker } from './static/route-inventory.js';
+import { nextImageSsrfChecker } from './static/next-image-ssrf.js';
 /** Level 0 checkers: read-only static analysis, no install, any stack. */
 export const staticCheckers = [
     secretsChecker,
@@ -12,4 +13,5 @@ export const staticCheckers = [
     rlsMigrationsChecker,
     envGitChecker,
     routeInventoryChecker,
+    nextImageSsrfChecker,
 ];

package/dist/engine/checkers/static/client-exposure.js

@@ -1,10 +1,20 @@
 import { lineAt, looksLikePlaceholder, redact } from '../../util/text.js';
+import { maskCode } from '../../util/mask.js';
 import { classifyKey } from '../backend/supabase.js';
 // Public env prefixes are inlined into the browser bundle by the bundler.
 const PUBLIC_PREFIX = '(?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|PUBLIC_)';
 // Every public-prefixed assignment; what it carries is decided by the VALUE
-// first and the NAME second (below).
-const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)\\s*[:=]\\s*["']?([^"'\\s]{6,})`, 'gi');
+// first and the NAME second (below). The name gets an optional closing quote
+// before the `:`/`=` — a JSON/object literal's `"NEXT_PUBLIC_KEY": "value"`
+// otherwise never matched at all, since nothing after the bare name expected
+// that stray `"`. The gap between `:`/`=` and the value is same-line
+// whitespace only (`[ \t]*`, not `\s*`) — an EMPTY-valued var followed by
+// blank/commented lines otherwise let the value group skip straight past
+// them onto the NEXT var's name, reporting that name as a leaked secret
+// value. Once comments started getting masked to blank space (below), a
+// `.env.example`'s usual "KEY=\n\n# comment\nNEXT_KEY=" shape hit this on
+// real projects.
+const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)["']?\\s*[:=][ \\t]*["']?([^"'\\s]{6,})`, 'gi');
 // A public var whose NAME implies a real secret (not an anon/publishable key).
 const SECRET_NAME = /(SERVICE_ROLE|SECRET|PRIVATE|PASSWORD|PASSWD|TOKEN|CREDENTIAL|API_KEY|ACCESS_KEY)/i;
 // Value shapes that are server secrets no matter what the variable is called.
@@ -40,7 +50,10 @@ export const clientExposureChecker = {
         const advised = new Set();
         for (const file of ctx.files) {
             const { content, rel } = file;
-            for (const m of content.matchAll(PUBLIC_ASSIGN)) {
+            // Commented-out code is not a live exposure; masking preserves length
+            // and newlines so match offsets/line numbers still point at the source.
+            const scan = maskCode(content, { file: rel });
+            for (const m of scan.matchAll(PUBLIC_ASSIGN)) {
                 const name = m[1] ?? '';
                 const value = m[2] ?? '';
                 if (looksLikePlaceholder(value))

package/dist/engine/checkers/static/config-risks.js

@@ -37,7 +37,13 @@ const RULES = [
         // inside one string literal — so prose mentioning "insert" won't match.
         // Quantifiers are length-bounded ({0,200}) to prevent catastrophic
         // backtracking (ReDoS) on very long / minified lines.
-        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f["']\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^"'\n]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^"'\n]{0,200}\{/gi,
+        //
+        // The f-string branch tracks its OWN opening quote via a backreference
+        // (`(?:(?!\1)[^\n])` — any char that isn't a newline or that quote) rather
+        // than excluding both quote characters outright: `f"SELECT … WHERE name =
+        // '{x}'"` nests a single-quoted SQL string value inside a double-quoted
+        // f-string, and excluding `'` too made the whole pattern never match.
+        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f(["'])\s*(?:SELECT|INSERT|UPDATE|DELETE)\b(?:(?!\1)[^\n]){0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b(?:(?!\1)[^\n]){0,200}\{/gi,
         severity: 'warning',
         detail: 'Interpolating values into SQL invites SQL injection.',
         fix: 'Use parameterized queries / prepared statements instead of string interpolation.',
@@ -73,7 +79,11 @@ function isParameterizedTemplate(scan, backtickAt) {
  * from request data, so it is reported as info, not as an injection. About half
  * of the real-world hits were structural.
  */
-const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*$/i;
+// A trailing `["']?` handles the equally common quoted-value shape
+// (`name = '${name}'`, `WHERE id = "${id}"`) — the SQL literal's own quote
+// sits directly before the hole, between the operator and `${`/`{`, and
+// without it that shape read as unquoted structure, not a value.
+const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*["']?\s*$/i;
 const PLACEHOLDER_EXPR = /^\s*(?:\w+\.)?(placeholders?|params?|marks|questions|qs|values|binds?)\b/i;
 function onlyStructuralInterpolation(scan, at) {
     // The literal: from the opening delimiter to its close (bounded).