easyvibegate 0.6.2 → 0.6.9

package/dist/engine/checkers/static/secrets.js

@@ -1,5 +1,5 @@
-import { decodeJwtPayload, lineAt, looksLikePlaceholder, redact, shannonEntropy } from '../../util/text.js';
-import { createExposure } from '../../util/git-exposure.js';
+import { decodeJwtPayload, lineAt, looksLikePlaceholder, looksLikeTestOrDocPath, redact, shannonEntropy } from '../../util/text.js';
+import { createExposure, createHistoryChecker } from '../../util/git-exposure.js';
 import { partitionIgnores } from '../../config.js';
 /** No project-wide rules — used to run ONLY the inline-marker half of partitionIgnores. */
 const EMPTY_CONFIG = { ignore: [], ignorePaths: [] };
@@ -130,24 +130,29 @@ const PATTERNS = [
     {
         id: 'db_url_password',
         title: 'Database URL with an inline password',
-        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:/@"']+:([^\s:/@"']{4,})@[^\s"']+/gi,
+        // The trailing char classes exclude backtick/paren/bracket/comma/semicolon
+        // as well as the usual quote+whitespace: a URL written as a markdown-style
+        // example (`` `postgres://user:pass@host` `` in a comment or docstring)
+        // otherwise swallows the closing backtick into the host, which broke the
+        // local-host check below (`localhost\`` never matches `^localhost$`).
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:/@"'`)\];,]+:([^\s:/@"'`)\];,]{4,})@[^\s"'`)\];,]+/gi,
         severity: 'critical',
         fix: 'Move the connection string to a server-side env var and rotate the database password — a committed DB URL grants full data access.',
         // `postgres://opencut:opencut@localhost` in docker-compose / CI / a Dockerfile
         // is a local container's default login, not a credential. A password that
-        // equals the user name, or is a well-known default, is never reported; a
-        // weak password on a local/single-label host (a compose service name) is
-        // not either. A real-looking password on a real host still is.
+        // equals the user name, or is a well-known default, or is otherwise weak,
+        // is only exempt on a local/single-label host (a compose service name) —
+        // the exact same password on a real remote host is a live, guessable
+        // credential, not a throwaway dev default, and must still be reported.
         validate: (hit) => {
-            const m = /^[a-z+]+:\/\/([^\s:/@"']+):([^\s:/@"']+)@([^/\s:"']+)/i.exec(hit);
+            const m = /^[a-z+]+:\/\/([^\s:/@"'`)\];,]+):([^\s:/@"'`)\];,]+)@([^/\s:"'`)\];,]+)/i.exec(hit);
             if (!m)
                 return true;
             const [, user = '', pw = '', host = ''] = m;
-            if (pw.toLowerCase() === user.toLowerCase() || DEFAULT_PASSWORDS.has(pw.toLowerCase()))
-                return false;
             const local = /^(localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal|[a-z0-9_-]+)$/i.test(host);
             const strong = /[0-9]/.test(pw) && /[A-Za-z]/.test(pw) && shannonEntropy(pw) >= 3.0;
-            return !(local && !strong);
+            const weak = pw.toLowerCase() === user.toLowerCase() || DEFAULT_PASSWORDS.has(pw.toLowerCase()) || !strong;
+            return !(local && weak);
         },
     },
     {
@@ -171,8 +176,14 @@ const GENERIC = /\b([A-Za-z0-9_-]*(?:api[_-]?key|secret|token|passwd|password|pw
  * tracking ids, CSRF nonces, push tokens. 559 of 569 generic hits in one real
  * project were `tracking_token` / `pagination_token` inside cached API
  * responses.
+ *
+ * Deliberately NOT here: "session" and "reset". `sessionSecret` (the signing
+ * key for express-session/cookie-session — a real, common config secret) and
+ * `sessionToken`/`resetToken` (bearer auth / password-reset tokens, both
+ * enough to take over an account) are genuine credentials, not opaque ids —
+ * unlike `trackingToken`/`paginationToken`, they were being excluded outright.
  */
-const NON_SECRET_NAME = /(pagination|tracking|page|next|prev|continuation|cursor|csrf|xsrf|cancel|request|device|push|fcm|expo|invite|share|verification|unsubscribe|reset|confirm|session)/i;
+const NON_SECRET_NAME = /(pagination|tracking|page|next|prev|continuation|cursor|csrf|xsrf|cancel|request|device|push|fcm|expo|invite|share|verification|unsubscribe|confirm)/i;
 /** Base64 blobs (thumbnails, binary) and anything longer than a real token. */
 const looksLikeBlob = (v) => v.length > 200 || /^(\/9j\/|iVBOR|data:|R0lGOD|UklGR)/.test(v);
 const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
@@ -206,15 +217,342 @@ function isConfigish(rel) {
     return /(^|\/)\.env($|\.)/.test(rel) || /\.(ya?ml|toml|ini|conf|properties|npmrc|netrc)$/.test(rel)
         || /(^|\/)(Dockerfile|\.npmrc|\.netrc)$/.test(rel) || /docker-compose\.ya?ml$/.test(rel);
 }
+const dirOf = (rel) => (rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '');
+const isExampleEnv = (rel) => /(^|\/)\.env[^/]*\.(example|sample|template|dist)$/i.test(rel) || /(^|\/)(example|sample)\.env$/i.test(rel);
 /**
- * Documentation, examples and test fixtures are where sample keys legitimately
- * live. A hit there is worth mentioning but is not a credential leak.
+ * Values from the REAL env files, per directory. A committed .env.example
+ * that carries the same value as its sibling .env is not an example — it is
+ * the key, published. (Seen in the wild: OPENAI/ANTHROPIC keys identical
+ * in .env and a committed .env.example.)
  */
-function isExampleContext(rel) {
-    return /\.(md|txt|mdx|rst)$/i.test(rel)
-        || /\.(example|sample|template|dist)$/i.test(rel)
-        || /(^|\/)(docs?|examples?|fixtures?|__fixtures__|__tests__|test|tests|spec|__mocks__)(\/|$)/i.test(rel)
-        || /\.(test|spec)\.[a-z]+$/i.test(rel);
+function collectRealEnvValues(files) {
+    const realEnvValues = new Map();
+    for (const f of files) {
+        if (!isEnvFile(f.rel))
+            continue;
+        const set = realEnvValues.get(dirOf(f.rel)) ?? new Set();
+        for (const m of f.content.matchAll(ASSIGN)) {
+            const v = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
+            if (v.length >= 8)
+                set.add(v);
+        }
+        realEnvValues.set(dirOf(f.rel), set);
+    }
+    return realEnvValues;
+}
+/**
+ * Severity = what the value is × how it can leak. The pattern says what it
+ * is; the example/docs path lowers confidence; git exposure decides how bad
+ * it is. Builds the per-file `push` used by every scan pass below, so that
+ * pipeline lives in one place instead of being reimplemented per pass.
+ */
+function makePush({ rel, env, example, ex, realEnvValues, findings, wasCommitted }) {
+    return (f, proven = false, raw) => {
+        let out = f;
+        const realValueInExample = !!raw && isExampleEnv(rel) && (realEnvValues.get(dirOf(rel))?.has(raw) ?? false);
+        if (realValueInExample) {
+            // Not an example at all: the live value copied into the example file.
+            out = {
+                ...f,
+                severity: ex === 'committed' ? 'critical' : 'warning',
+                title: `${f.title} — the REAL value from .env, in an example file${ex === 'committed' ? ' that is committed' : ''}`,
+                detail: `${f.detail} This value is identical to the one in the sibling .env: the example file carries the real credential${ex === 'committed' ? ', and it is committed to git' : ''}.`,
+                fix: 'Replace the value in the example file with a placeholder, and rotate the credential — it has been published.',
+            };
+        }
+        else if (example && proven) {
+            out = {
+                ...f,
+                severity: f.severity === 'critical' ? 'warning' : f.severity,
+                title: `${f.title} (in docs/example path — looks real)`,
+                detail: `${f.detail} The path suggests documentation or a fixture, but the value has the structure of real key material — verify it, and rotate it if it is genuine.`,
+            };
+        }
+        else if (example) {
+            out = {
+                ...f,
+                severity: 'info',
+                title: `${f.title} (in docs/example file)`,
+                detail: `${f.detail} This looks like documentation or a fixture — confirm it is not a real credential.`,
+            };
+        }
+        // Git exposure. A committed secret keeps its full severity. Everything
+        // else cannot leak through the repository right now: an ignored file is
+        // doing exactly what it should (advisory); an untracked file in a repo
+        // or a folder that is not a repo is hygiene, capped at warning.
+        if (!realValueInExample && out.severity !== 'info') {
+            // A .env that is not committed is doing its job: secrets belong there.
+            // Whether it WILL be committed (untracked, no .gitignore entry) is the
+            // env-git check's finding, not this one's — reporting it twice at
+            // warning is what made people stop reading.
+            if (env && ex !== 'committed') {
+                // This also covers `ex === 'ignored'`: an env file is always the
+                // right place for a secret whether or not it's ALSO gitignored, so
+                // there is nothing a separate ignored-env-file branch would add.
+                out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
+            }
+            else if (ex === 'ignored' || ex === 'untracked') {
+                // Gitignored or untracked now — but "not committed NOW" is not the
+                // same claim as "never committed": a file `git rm --cached` removed
+                // after the mistake was noticed still carries the real value forever
+                // in history. For a structurally-proven credential (not a name-based
+                // guess), check whether THIS value ever showed up in a version of
+                // this file that WAS committed — "rotate immediately" is warranted
+                // for a real incident and needless (if harmless) urgency otherwise,
+                // and rotating a production service_role key across every
+                // environment that holds it is not a free action to ask for blindly.
+                const committedBefore = proven && !!raw ? wasCommitted(raw) : null;
+                const base = ex === 'ignored'
+                    ? `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.`
+                    : `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.`;
+                out = {
+                    ...out,
+                    severity: atMost(out.severity, 'warning'),
+                    detail: committedBefore === false
+                        ? `${base} Checked this file's git history for this exact value and did not find it — it does not look like it was ever actually committed, so this reads as a hygiene fix, not a confirmed leak.`
+                        : base,
+                    fix: committedBefore === false ? `${out.fix} (No evidence this exact value was ever committed, so rotation is precautionary here, not a confirmed-leak emergency.)` : out.fix,
+                };
+            }
+            else if (ex === 'no-git') {
+                out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} This folder is not a git repository, so nothing leaks through git; the risk is copying or zipping the folder. Move the value to an env var before this becomes a repo.` };
+            }
+        }
+        findings.push(out);
+    };
+}
+/** Vendor-shaped keys (OpenAI, AWS, Stripe, a DB URL password, a PEM block, …). */
+function scanVendorPatterns(content, rel, env, push) {
+    for (const p of PATTERNS) {
+        for (const m of content.matchAll(p.re)) {
+            const hit = m[0];
+            if (looksLikePlaceholder(hit))
+                continue; // YOUR_KEY / EXAMPLE / xxxxx / <...>
+            if (p.validate && !p.validate(hit))
+                continue;
+            // A secret in a server env/config file is expected — the risk is
+            // committing it (env-git flags that), so it is a warning, not a leak.
+            const severity = env && p.severity === 'critical' ? 'warning' : p.severity;
+            const proven = HIGH_CONFIDENCE.has(p.id) && looksLikeRealMaterial(p.id, hit, content, m.index ?? 0, m[1]);
+            push({
+                id: p.id,
+                severity,
+                title: env ? `${p.title} (in env/config file)` : p.title,
+                detail: env
+                    ? `${p.title} in ${rel} (${redact(hit)}). Normal for server env — keep this file gitignored and out of client bundles.`
+                    : `${p.title} found in source: ${redact(hit)}`,
+                fix: env ? 'Keep this file out of git and out of client bundles; rotate the value if it may have been committed.' : p.fix,
+                checker: 'secrets',
+                level: 0,
+                file: rel,
+                line: lineAt(content, m.index ?? 0),
+                evidence: redact(hit),
+            }, proven, hit);
+        }
+    }
+}
+/**
+ * Supabase service_role key (a JWT whose payload role is service_role). The
+ * decoded role proves what it is, so it is never a docs-only info.
+ */
+function scanServiceRoleJwt(content, rel, env, push) {
+    for (const m of content.matchAll(JWT)) {
+        const payload = decodeJwtPayload(m[0]);
+        if (payload && payload['role'] === 'service_role') {
+            push({
+                id: 'supabase_service_role_key',
+                severity: env ? 'warning' : 'critical',
+                title: env ? 'Supabase service_role key (in env/config file)' : 'Supabase service_role key in source',
+                detail: env
+                    ? `A service_role JWT is in ${rel}. Fine for server env only — never commit it or ship it to the client; keep the file gitignored.`
+                    : 'A service_role JWT bypasses Row Level Security entirely and is in source/client code. It must never ship to the client or the repo.',
+                fix: env
+                    ? 'Keep it server-side only, ensure the file is gitignored, and rotate it if it may have been committed.'
+                    : 'Remove it, rotate the service_role key in Supabase settings, and use it only in trusted server code.',
+                checker: 'secrets',
+                level: 0,
+                file: rel,
+                line: lineAt(content, m.index ?? 0),
+                evidence: redact(m[0]),
+            }, true, m[0]);
+        }
+    }
+}
+/** Quoted key/secret assignments in code, filtered by placeholder + entropy. */
+function scanGenericAssignments(content, rel, push) {
+    for (const m of content.matchAll(GENERIC)) {
+        const name = m[1] ?? '';
+        const value = m[2] ?? '';
+        if (NON_SECRET_NAME.test(name) || looksLikeBlob(value))
+            continue;
+        // Credentials have no whitespace ("Show password" is UI text) and carry
+        // digits or real length ("build-time-secret" is a label).
+        if (/\s/.test(value) || (!/[0-9]/.test(value) && value.length < 24))
+            continue;
+        if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.2)
+            continue;
+        push({
+            id: 'generic_secret',
+            severity: 'warning',
+            title: 'Possible hardcoded secret',
+            detail: `A high-entropy value is assigned to a secret-looking name: ${redact(value)}`,
+            fix: 'If this is a real credential, move it to a server-side env var and rotate it. If not, rename the variable or add `// easyvibegate-ignore`.',
+            checker: 'secrets',
+            level: 0,
+            file: rel,
+            line: lineAt(content, m.index ?? 0),
+            evidence: redact(value),
+        }, false, value);
+    }
+}
+/**
+ * name=value / key: value assignments (env, config, Dockerfile ENV/ARG). Runs
+ * before scanInlineEnv so a plain, single-assignment line keeps this rule's
+ * more specific title/fix on the dedup tie in dedupeFindings, rather than the
+ * inline-assignment rule's generic one.
+ */
+function scanConfigAssignments(content, rel, env, push) {
+    if (!isConfigish(rel))
+        return;
+    for (const m of content.matchAll(ASSIGN)) {
+        const name = m[1] ?? '';
+        if (!SECRET_NAME.test(name))
+            continue;
+        const value = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
+        if (value.length < 8 || looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+            continue;
+        // "build-time-secret" is a label, not a credential: real values carry digits or length.
+        if (!/[0-9]/.test(value) && value.length < 24)
+            continue;
+        push({
+            id: 'env_secret',
+            severity: 'warning',
+            title: env ? 'Secret in env file' : 'Secret in config file',
+            detail: `"${name}" holds a high-entropy value in ${rel}: ${redact(value)}`,
+            fix: env
+                ? 'Fine for server env — keep this file gitignored and out of the client; rotate if it may have leaked.'
+                : 'Move this secret out of committed config into a server-side secret store, and rotate it.',
+            checker: 'secrets',
+            level: 0,
+            file: rel,
+            line: lineAt(content, m.index ?? 0),
+            evidence: redact(value),
+        }, false, value);
+    }
+}
+/**
+ * Inline shell-style assignments mid-line, in every file including
+ * config-ish ones. scanConfigAssignments is start-of-line and one-per-line,
+ * so it never sees a Compose `environment:` list item (`- TOKEN=…`), a CI
+ * step's inline `run: TOKEN=… cmd`, or a second KEY=VALUE later on the same
+ * Dockerfile ENV line — all real leaks it silently missed while this ran
+ * only for non-config files. Also still needed for the original case: a prod
+ * DB password inside a permission rule in .claude/settings.local.json,
+ * invisible to every other name-based rule.
+ */
+function scanInlineEnv(content, rel, push) {
+    for (const m of content.matchAll(INLINE_ENV)) {
+        const name = m[1] ?? '';
+        const value = m[2] ?? '';
+        if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
+            continue;
+        if (!/[0-9]/.test(value) && value.length < 24)
+            continue;
+        push({
+            id: 'env_secret',
+            severity: 'warning',
+            title: 'Secret in an inline assignment',
+            detail: `"${name}" is assigned a high-entropy value inline in ${rel}: ${redact(value)}`,
+            fix: 'Move the value to a gitignored .env and reference it by name; rotate it if the file was ever shared.',
+            checker: 'secrets',
+            level: 0,
+            file: rel,
+            line: lineAt(content, m.index ?? 0),
+            evidence: redact(value),
+        }, false, value);
+    }
+}
+const NAME_BASED = new Set(['env_secret', 'generic_secret']);
+/**
+ * De-duplicate only true repeats: the same secret, same place, same rule.
+ * (Keying on file:line alone hid every extra key on a minified line.)
+ *
+ * env_secret and generic_secret are bucketed together (not by their own id):
+ * a config-ish file's single assignment runs through BOTH the line-anchored
+ * ASSIGN rule and the mid-line GENERIC rule, and when they independently
+ * derive the same value from the same line (an `auth_token = "env(NAME)"` in
+ * a Supabase config.toml matched both, each producing its own id) that is one
+ * fact reported twice, not two facts. Still keyed on evidence, not line alone
+ * — two DIFFERENT secrets on one line stay two findings either way.
+ */
+function dedupeFindings(findings) {
+    const seen = new Map();
+    for (const f of findings) {
+        const bucket = NAME_BASED.has(f.id) ? 'name-based' : f.id;
+        const key = `${f.file ?? ''}:${f.line ?? 0}:${bucket}:${f.evidence ?? ''}`;
+        const cur = seen.get(key);
+        if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
+            seen.set(key, f);
+    }
+    return [...seen.values()];
+}
+/**
+ * A vendor pattern or a decoded JWT already identifies a VALUE on a line; the
+ * name-based env_secret / generic_secret finding for that SAME value is the
+ * same fact twice. Keyed on file:line:evidence, not just file:line — two
+ * different secrets assigned on one line (`const key="sk-proj-…",
+ * password="…"`) are two different facts, and dropping the second because
+ * the first has a specific pattern hid it entirely.
+ */
+function dropRedundantNameBased(findings) {
+    const specificAt = new Set(findings.filter((f) => !NAME_BASED.has(f.id)).map((f) => `${f.file ?? ''}:${f.line ?? 0}:${f.evidence ?? ''}`));
+    return findings.filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}:${f.evidence ?? ''}`)));
+}
+/**
+ * Eleven advisories saying "secret in gitignored .env.local — fine" are one
+ * observation printed eleven times. Fold them into one line per file that
+ * names the variables; anything above advisory stays line by line.
+ *
+ * The final `applyIgnores` pass (scan.ts) only sees whatever this checker
+ * returns — once N findings become one summary Finding with a single `line`,
+ * a `// easyvibegate-ignore` comment placed above any secret but the first in
+ * the group can no longer reach it. Filter each candidate through the SAME
+ * inline-marker check first (an empty config so only the marker, not
+ * project-wide `ignore`/`ignorePaths` rules, applies here — those still run
+ * again, correctly, against whatever this returns), so an individually
+ * silenced secret is dropped before folding, not after.
+ */
+function foldEnvAdvisories(kept, allFiles) {
+    const byFile = new Map();
+    for (const f of kept) {
+        if (f.id !== 'env_secret' || f.severity !== 'advisory' || !isEnvFile(f.file ?? ''))
+            continue;
+        byFile.set(f.file ?? '', [...(byFile.get(f.file ?? '') ?? []), f]);
+    }
+    const folded = new Set();
+    const summaries = [];
+    for (const [file, allCandidates] of byFile) {
+        const group = partitionIgnores(allCandidates, EMPTY_CONFIG, allFiles).kept;
+        // A member the marker silenced must not reappear individually either —
+        // it is done with, not merely "too few left to fold".
+        for (const f of allCandidates)
+            if (!group.includes(f))
+                folded.add(f);
+        if (group.length < 2)
+            continue;
+        for (const f of group)
+            folded.add(f);
+        const names = group.map((f) => /^"([^"]+)"/.exec(f.detail)?.[1] ?? '?');
+        const first = group.reduce((a, b) => ((a.line ?? 0) <= (b.line ?? 0) ? a : b));
+        summaries.push({
+            ...first,
+            title: `${group.length} secrets in ${file} (not committed — where they belong)`,
+            detail: `${file} holds ${group.length} secret-looking values (${names.join(', ')}). The file is not committed, so nothing leaks through git; keep it that way and out of client bundles.`,
+            fix: 'Nothing to change here. Keep the file gitignored; rotate any value that may ever have been committed or shared.',
+            evidence: undefined,
+        });
+    }
+    return [...kept.filter((f) => !folded.has(f)), ...summaries];
 }
 export const secretsChecker = {
     id: 'secrets',
@@ -223,284 +561,27 @@ export const secretsChecker = {
     run(ctx) {
         const findings = [];
         const exposure = createExposure(ctx.root);
-        // Values from the REAL env files, per directory. A committed .env.example
-        // that carries the same value as its sibling .env is not an example — it is
-        // the key, published. (Seen in the wild: OPENAI/ANTHROPIC keys identical
-        // in .env and a committed .env.example.)
-        const realEnvValues = new Map();
-        for (const f of ctx.files) {
-            if (!isEnvFile(f.rel))
-                continue;
-            const dir = f.rel.includes('/') ? f.rel.slice(0, f.rel.lastIndexOf('/')) : '';
-            const set = realEnvValues.get(dir) ?? new Set();
-            for (const m of f.content.matchAll(ASSIGN)) {
-                const v = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
-                if (v.length >= 8)
-                    set.add(v);
-            }
-            realEnvValues.set(dir, set);
-        }
-        const dirOf = (rel) => (rel.includes('/') ? rel.slice(0, rel.lastIndexOf('/')) : '');
-        const isExampleEnv = (rel) => /(^|\/)\.env[^/]*\.(example|sample|template|dist)$/i.test(rel) || /(^|\/)(example|sample)\.env$/i.test(rel);
+        const history = createHistoryChecker(ctx.root);
+        const realEnvValues = collectRealEnvValues(ctx.files);
         for (const file of ctx.files) {
             const { rel } = file;
             const content = file.content.replace(/^\uFEFF/, ''); // a BOM must not eat line 1
             const env = isEnvFile(rel);
-            const example = isExampleContext(rel);
+            const example = looksLikeTestOrDocPath(rel);
             const ex = exposure(rel);
-            // `proven` = the hit is structurally real key material (see
-            // looksLikeRealMaterial). A docs/fixture path may only downgrade a
-            // heuristic or sample-looking hit to info; proven material stays at
-            // warning there — the path lowers confidence, it does not make it safe.
-            /**
-             * Severity = what the value is × how it can leak. The pattern says what it
-             * is; the example/docs path lowers confidence; git exposure decides how
-             * bad it is. `raw` is the unredacted value, only compared, never stored.
-             */
-            const push = (f, proven = false, raw) => {
-                let out = f;
-                const realValueInExample = !!raw && isExampleEnv(rel) && (realEnvValues.get(dirOf(rel))?.has(raw) ?? false);
-                if (realValueInExample) {
-                    // Not an example at all: the live value copied into the example file.
-                    out = {
-                        ...f,
-                        severity: ex === 'committed' ? 'critical' : 'warning',
-                        title: `${f.title} — the REAL value from .env, in an example file${ex === 'committed' ? ' that is committed' : ''}`,
-                        detail: `${f.detail} This value is identical to the one in the sibling .env: the example file carries the real credential${ex === 'committed' ? ', and it is committed to git' : ''}.`,
-                        fix: 'Replace the value in the example file with a placeholder, and rotate the credential — it has been published.',
-                    };
-                }
-                else if (example && proven) {
-                    out = {
-                        ...f,
-                        severity: f.severity === 'critical' ? 'warning' : f.severity,
-                        title: `${f.title} (in docs/example path — looks real)`,
-                        detail: `${f.detail} The path suggests documentation or a fixture, but the value has the structure of real key material — verify it, and rotate it if it is genuine.`,
-                    };
-                }
-                else if (example) {
-                    out = {
-                        ...f,
-                        severity: 'info',
-                        title: `${f.title} (in docs/example file)`,
-                        detail: `${f.detail} This looks like documentation or a fixture — confirm it is not a real credential.`,
-                    };
-                }
-                // Git exposure. A committed secret keeps its full severity. Everything
-                // else cannot leak through the repository right now: an ignored file is
-                // doing exactly what it should (advisory); an untracked file in a repo
-                // or a folder that is not a repo is hygiene, capped at warning.
-                if (!realValueInExample && out.severity !== 'info') {
-                    // A .env that is not committed is doing its job: secrets belong there.
-                    // Whether it WILL be committed (untracked, no .gitignore entry) is the
-                    // env-git check's finding, not this one's — reporting it twice at
-                    // warning is what made people stop reading.
-                    if (env && ex !== 'committed') {
-                        // This also covers `ex === 'ignored'`: an env file is always the
-                        // right place for a secret whether or not it's ALSO gitignored, so
-                        // there is nothing a separate ignored-env-file branch would add.
-                        out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
-                    }
-                    else if (ex === 'ignored') {
-                        // Gitignored, but not an env file: a credential pasted into a tool
-                        // config or a script (a prod DB password inside a permission rule in
-                        // .claude/settings.local.json was reported as a mere advisory). It
-                        // cannot leak through git today; it still does not belong there.
-                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.` };
-                    }
-                    else if (ex === 'untracked') {
-                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.` };
-                    }
-                    else if (ex === 'no-git') {
-                        out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} This folder is not a git repository, so nothing leaks through git; the risk is copying or zipping the folder. Move the value to an env var before this becomes a repo.` };
-                    }
-                }
-                findings.push(out);
-            };
-            for (const p of PATTERNS) {
-                for (const m of content.matchAll(p.re)) {
-                    const hit = m[0];
-                    if (looksLikePlaceholder(hit))
-                        continue; // YOUR_KEY / EXAMPLE / xxxxx / <...>
-                    if (p.validate && !p.validate(hit))
-                        continue;
-                    // A secret in a server env/config file is expected — the risk is
-                    // committing it (env-git flags that), so it is a warning, not a leak.
-                    const severity = env && p.severity === 'critical' ? 'warning' : p.severity;
-                    const proven = HIGH_CONFIDENCE.has(p.id) && looksLikeRealMaterial(p.id, hit, content, m.index ?? 0, m[1]);
-                    push({
-                        id: p.id,
-                        severity,
-                        title: env ? `${p.title} (in env/config file)` : p.title,
-                        detail: env
-                            ? `${p.title} in ${rel} (${redact(hit)}). Normal for server env — keep this file gitignored and out of client bundles.`
-                            : `${p.title} found in source: ${redact(hit)}`,
-                        fix: env ? 'Keep this file out of git and out of client bundles; rotate the value if it may have been committed.' : p.fix,
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(hit),
-                    }, proven, hit);
-                }
-            }
-            // Supabase service_role key (a JWT whose payload role is service_role).
-            // The decoded role proves what it is, so it is never a docs-only info.
-            for (const m of content.matchAll(JWT)) {
-                const payload = decodeJwtPayload(m[0]);
-                if (payload && payload['role'] === 'service_role') {
-                    push({
-                        id: 'supabase_service_role_key',
-                        severity: env ? 'warning' : 'critical',
-                        title: env ? 'Supabase service_role key (in env/config file)' : 'Supabase service_role key in source',
-                        detail: env
-                            ? `A service_role JWT is in ${rel}. Fine for server env only — never commit it or ship it to the client; keep the file gitignored.`
-                            : 'A service_role JWT bypasses Row Level Security entirely and is in source/client code. It must never ship to the client or the repo.',
-                        fix: env
-                            ? 'Keep it server-side only, ensure the file is gitignored, and rotate it if it may have been committed.'
-                            : 'Remove it, rotate the service_role key in Supabase settings, and use it only in trusted server code.',
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(m[0]),
-                    }, true, m[0]);
-                }
-            }
-            // Quoted key/secret assignments in code, filtered by placeholder + entropy.
-            for (const m of content.matchAll(GENERIC)) {
-                const name = m[1] ?? '';
-                const value = m[2] ?? '';
-                if (NON_SECRET_NAME.test(name) || looksLikeBlob(value))
-                    continue;
-                // Credentials have no whitespace ("Show password" is UI text) and carry
-                // digits or real length ("build-time-secret" is a label).
-                if (/\s/.test(value) || (!/[0-9]/.test(value) && value.length < 24))
-                    continue;
-                if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.2)
-                    continue;
-                push({
-                    id: 'generic_secret',
-                    severity: 'warning',
-                    title: 'Possible hardcoded secret',
-                    detail: `A high-entropy value is assigned to a secret-looking name: ${redact(value)}`,
-                    fix: 'If this is a real credential, move it to a server-side env var and rotate it. If not, rename the variable or add `// easyvibegate-ignore`.',
-                    checker: 'secrets',
-                    level: 0,
-                    file: rel,
-                    line: lineAt(content, m.index ?? 0),
-                    evidence: redact(value),
-                }, false, value);
-            }
-            // Inline shell-style assignments mid-line, outside env/config files (those
-            // go through ASSIGN below). A prod DB password inside a permission rule in
-            // .claude/settings.local.json was invisible to both other name-based rules.
-            if (!isConfigish(rel)) {
-                for (const m of content.matchAll(INLINE_ENV)) {
-                    const name = m[1] ?? '';
-                    const value = m[2] ?? '';
-                    if (looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
-                        continue;
-                    if (!/[0-9]/.test(value) && value.length < 24)
-                        continue;
-                    push({
-                        id: 'env_secret',
-                        severity: 'warning',
-                        title: 'Secret in an inline assignment',
-                        detail: `"${name}" is assigned a high-entropy value inline in ${rel}: ${redact(value)}`,
-                        fix: 'Move the value to a gitignored .env and reference it by name; rotate it if the file was ever shared.',
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(value),
-                    }, false, value);
-                }
-            }
-            // name=value / key: value assignments (env, config, Dockerfile ENV/ARG).
-            if (isConfigish(rel)) {
-                for (const m of content.matchAll(ASSIGN)) {
-                    const name = m[1] ?? '';
-                    if (!SECRET_NAME.test(name))
-                        continue;
-                    const value = (m[2] ?? '').trim().replace(/^["']|["']$/g, '').replace(/["'].*$/, '');
-                    if (value.length < 8 || looksLikePlaceholder(value) || shannonEntropy(value) < 3.0)
-                        continue;
-                    // "build-time-secret" is a label, not a credential: real values carry digits or length.
-                    if (!/[0-9]/.test(value) && value.length < 24)
-                        continue;
-                    push({
-                        id: 'env_secret',
-                        severity: 'warning',
-                        title: env ? 'Secret in env file' : 'Secret in config file',
-                        detail: `"${name}" holds a high-entropy value in ${rel}: ${redact(value)}`,
-                        fix: env
-                            ? 'Fine for server env — keep this file gitignored and out of the client; rotate if it may have leaked.'
-                            : 'Move this secret out of committed config into a server-side secret store, and rotate it.',
-                        checker: 'secrets',
-                        level: 0,
-                        file: rel,
-                        line: lineAt(content, m.index ?? 0),
-                        evidence: redact(value),
-                    }, false, value);
-                }
-            }
-        }
-        // De-duplicate only true repeats: the same secret, same place, same rule.
-        // (Keying on file:line alone hid every extra key on a minified line.)
-        const seen = new Map();
-        for (const f of findings) {
-            const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
-            const cur = seen.get(key);
-            if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
-                seen.set(key, f);
-        }
-        // A vendor pattern or a decoded JWT already identifies the value on a line;
-        // the name-based env_secret / generic_secret there is the same fact twice.
-        const NAME_BASED = new Set(['env_secret', 'generic_secret']);
-        const specificAt = new Set([...seen.values()].filter((f) => !NAME_BASED.has(f.id)).map((f) => `${f.file ?? ''}:${f.line ?? 0}`));
-        const kept = [...seen.values()].filter((f) => !(NAME_BASED.has(f.id) && specificAt.has(`${f.file ?? ''}:${f.line ?? 0}`)));
-        // Eleven advisories saying "secret in gitignored .env.local — fine" are one
-        // observation printed eleven times. Fold them into one line per file that
-        // names the variables; anything above advisory stays line by line.
-        //
-        // The final `applyIgnores` pass (scan.ts) only sees whatever this checker
-        // returns — once N findings become one summary Finding with a single
-        // `line`, a `// easyvibegate-ignore` comment placed above any secret but
-        // the first in the group can no longer reach it. Filter each candidate
-        // through the SAME inline-marker check first (an empty config so only the
-        // marker, not project-wide `ignore`/`ignorePaths` rules, applies here —
-        // those still run again, correctly, against whatever this returns), so an
-        // individually silenced secret is dropped before folding, not after.
-        const byFile = new Map();
-        for (const f of kept) {
-            if (f.id !== 'env_secret' || f.severity !== 'advisory' || !isEnvFile(f.file ?? ''))
-                continue;
-            byFile.set(f.file ?? '', [...(byFile.get(f.file ?? '') ?? []), f]);
-        }
-        const folded = new Set();
-        const summaries = [];
-        for (const [file, allCandidates] of byFile) {
-            const group = partitionIgnores(allCandidates, EMPTY_CONFIG, ctx.files).kept;
-            // A member the marker silenced must not reappear individually either —
-            // it is done with, not merely "too few left to fold".
-            for (const f of allCandidates)
-                if (!group.includes(f))
-                    folded.add(f);
-            if (group.length < 2)
-                continue;
-            for (const f of group)
-                folded.add(f);
-            const names = group.map((f) => /^"([^"]+)"/.exec(f.detail)?.[1] ?? '?');
-            const first = group.reduce((a, b) => ((a.line ?? 0) <= (b.line ?? 0) ? a : b));
-            summaries.push({
-                ...first,
-                title: `${group.length} secrets in ${file} (not committed — where they belong)`,
-                detail: `${file} holds ${group.length} secret-looking values (${names.join(', ')}). The file is not committed, so nothing leaks through git; keep it that way and out of client bundles.`,
-                fix: 'Nothing to change here. Keep the file gitignored; rotate any value that may ever have been committed or shared.',
-                evidence: undefined,
-            });
+            const wasCommitted = (raw) => history(rel, raw);
+            const push = makePush({ rel, env, example, ex, realEnvValues, findings, wasCommitted });
+            scanVendorPatterns(content, rel, env, push);
+            scanServiceRoleJwt(content, rel, env, push);
+            // scanConfigAssignments before scanGenericAssignments/scanInlineEnv: on
+            // a config-ish file, all three can match the same line, and this one's
+            // title/fix is the most specific (it knows the file IS config/env) —
+            // dedupeFindings keeps the first-pushed on a tie, so it should win.
+            scanConfigAssignments(content, rel, env, push);
+            scanGenericAssignments(content, rel, push);
+            scanInlineEnv(content, rel, push);
         }
-        return [...kept.filter((f) => !folded.has(f)), ...summaries];
+        const kept = dropRedundantNameBased(dedupeFindings(findings));
+        return foldEnvAdvisories(kept, ctx.files);
     },
 };