easyvibegate 0.6.2 → 0.6.9

package/dist/engine/detect.js

@@ -1,6 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-import { DNS_LABEL } from './util/text.js';
+import { DNS_LABEL, looksLikeTestOrDocPath } from './util/text.js';
+import { maskCode } from './util/mask.js';
 const SUPABASE_URL_FALLBACK = new RegExp(`https?://${DNS_LABEL}\\.supabase\\.co`, 'i');
 /** Infer the project's frameworks, backends, languages and package managers. */
 export function detect(root, files) {
@@ -104,10 +105,23 @@ export function detect(root, files) {
     // false positives from code that merely mentions a backend by name. Uses the
     // shared bounded DNS_LABEL (see util/text.ts) so this cannot go quadratic on
     // a long run of matching characters in a large file.
-    if (!backends.has('supabase') && files.some((f) => SUPABASE_URL_FALLBACK.test(f.content))) {
+    //
+    // Two independent guards against a project's own code making itself look
+    // like it uses a backend it only mentions: test/fixture files are excluded
+    // (a test suite for code that talks to Supabase routinely contains
+    // synthetic mock URLs shaped like a real project's own), and comments are
+    // masked before matching (an explanatory comment describing that exact URL
+    // shape is otherwise itself a match). Both were needed: this fallback once
+    // made EasyVibeGate's own test suite, and separately its own source
+    // comments, detect EasyVibeGate itself as a Supabase project — a security
+    // scanner flagging itself is exactly what dogfooding exists to catch.
+    // Strings are NOT masked: a real URL/call normally appears in one.
+    const nonTestFiles = files.filter((f) => !looksLikeTestOrDocPath(f.rel));
+    const codeOnly = (f) => maskCode(f.content, { file: f.rel });
+    if (!backends.has('supabase') && nonTestFiles.some((f) => SUPABASE_URL_FALLBACK.test(codeOnly(f)))) {
         backends.add('supabase');
     }
-    if (!backends.has('firebase') && files.some((f) => /\binitializeApp\s*\(/.test(f.content) && /firebase/i.test(f.content))) {
+    if (!backends.has('firebase') && nonTestFiles.some((f) => { const c = codeOnly(f); return /\binitializeApp\s*\(/.test(c) && /firebase/i.test(c); })) {
         backends.add('firebase');
     }
     return {

package/dist/engine/util/git-exposure.js

@@ -31,3 +31,44 @@ export function createExposure(root) {
         return ex;
     };
 }
+/**
+ * For a file that is NOT committed now (ignored or untracked): was THIS
+ * value ever in a version of it that WAS committed? Tells apart "moved to
+ * .gitignore before the real value was ever written here — never leaked"
+ * from "was committed with this exact credential, then removed — a real
+ * incident, still in history forever." Advice like "rotate it" is sound for
+ * the second and needless noise for the first, especially for a production
+ * key whose rotation itself carries real operational risk.
+ *
+ * Bounded to the file's last `maxCommits` commits touching it (a `git log`,
+ * then up to that many `git show` blob reads) — deliberate for a file with
+ * unusually long history; the answer degrades to "unknown", never "safe".
+ *
+ * Returns `true` (found it committed), `false` (checked history, never
+ * found), or `null` (no history to check, or git failed) — `null` must be
+ * treated as "no evidence either way", never as "confirmed safe".
+ */
+export function createHistoryChecker(root) {
+    const commitsCache = new Map();
+    const commitsFor = (rel, maxCommits) => {
+        const key = `${rel}\u0000${maxCommits}`;
+        const hit = commitsCache.get(key);
+        if (hit !== undefined)
+            return hit;
+        const log = git(root, ['log', '--all', '-n', String(maxCommits), '--format=%H', '--', rel]);
+        const commits = log === null ? null : log.split('\n').filter(Boolean);
+        commitsCache.set(key, commits);
+        return commits;
+    };
+    return (rel, value, maxCommits = 20) => {
+        const commits = commitsFor(rel, maxCommits);
+        if (commits === null || commits.length === 0)
+            return null; // never tracked at all, or git failed
+        for (const sha of commits) {
+            const blob = git(root, ['show', `${sha}:${rel}`]);
+            if (blob !== null && blob.includes(value))
+                return true;
+        }
+        return false;
+    };
+}

package/dist/engine/util/text.js

@@ -29,7 +29,17 @@ export function lineAt(content, index) {
     }
     return line;
 }
-const PLACEHOLDER = /(x{3,}|your[_-]?|<[^>]+>|\$\{|process\.env|import\.meta\.env|example|placeholder|changeme|dummy|test[_-]?key|xxxxx|\.\.\.)/i;
+/**
+ * A value that IS a reference to a secret, not the secret itself: `${NAME}`
+ * (shell/JS template), `env(NAME)` (Supabase CLI's config.toml substitution —
+ * the exact shape `supabase init` writes into every generated config, so this
+ * fired on every Supabase project's default file, not one repo's mistake),
+ * `{{ NAME }}` (Jinja/Helm/GitHub Actions expression), or a bare `$NAME`
+ * shell variable with nothing else in the value. The last one is anchored to
+ * the WHOLE value (`^...$`) — a real secret that merely contains a `$`
+ * somewhere must not be excluded, only a value that IS just a var reference.
+ */
+const PLACEHOLDER = /(x{3,}|your[_-]?|<[^>]+>|\$\{|process\.env|import\.meta\.env|example|placeholder|changeme|dummy|test[_-]?key|xxxxx|\.\.\.|env\(\s*[A-Z][A-Z0-9_]*\s*\)|\{\{\s*[\w.]+\s*\}\}|^\$[A-Z][A-Z0-9_]*$)/i;
 /** True if a captured value looks like a template/placeholder, not a real secret. */
 export function looksLikePlaceholder(value) {
     return PLACEHOLDER.test(value);
@@ -60,3 +70,17 @@ export function decodeJwtPayload(token) {
  * milliseconds — and no real hostname label is longer than this anyway.
  */
 export const DNS_LABEL = '[a-z0-9-]{1,63}';
+/**
+ * Documentation, examples and test/fixture paths — where a sample config
+ * value (a fake Supabase URL, a placeholder key) legitimately lives without
+ * describing anything about the real project. A test suite for code that
+ * TALKS to a backend routinely contains literal-looking URLs/keys for that
+ * backend as mock data; without this, scanning a project's own tests can
+ * make the project appear to use a backend it merely tests against.
+ */
+export function looksLikeTestOrDocPath(rel) {
+    return /\.(md|txt|mdx|rst)$/i.test(rel)
+        || /\.(example|sample|template|dist)$/i.test(rel)
+        || /(^|\/)(docs?|examples?|fixtures?|__fixtures__|__tests__|test|tests|spec|__mocks__)(\/|$)/i.test(rel)
+        || /\.(test|spec)\.[a-z]+$/i.test(rel);
+}

package/dist/engine/walk.js

@@ -15,22 +15,32 @@ const SKIP_DIRS = new Set([
 ]);
 /**
  * Names ambiguous enough that they are sometimes real source (a module named
- * "cache", a package called "tmp") and sometimes pure data. Skipped only when
- * `relDir` (the ambiguous directory's own path, relative to the project root,
- * e.g. "cache" or "data/cache") has at most 2 path segments — i.e. the
- * directory IS the root's own child, or is nested exactly one level below it.
- * The real-world evidence for this was `data/cache/*.json` full of API
- * pagination tokens, 559 of 569 "generic secrets" in one real project. Deeper
- * nesting (`apps/api/src/lib/cache/`, 4 segments) is ordinary source and stays
- * scanned; blanket name-matching at any depth once made a source directory
- * invisible to every check with no visible coverage gap.
+ * "cache", a package called "tmp") and sometimes pure data. Path depth alone
+ * does not tell them apart: `src/cache` and `data/cache` are both 2 segments,
+ * but the first is exactly as likely to be a project's own source directory
+ * (a caching module) as the second is to be scan output. What DOES tell them
+ * apart is the parent: a data-ish parent name (`data`, `var`, `storage`) means
+ * generated/fetched content; an ordinary source-tree parent does not. Skipped
+ * only when the ambiguous name is the project root's own child (`cache/`,
+ * `tmp/` at the top level), or its immediate parent is one of those data-ish
+ * names (`data/cache`, `var/tmp`). The real-world evidence for this was
+ * `data/cache/*.json` full of API pagination tokens, 559 of 569 "generic
+ * secrets" in one real project; blanket name-matching at any depth once made
+ * a source directory invisible to every check with no visible coverage gap,
+ * and matching by depth alone reopened that exact gap for `src/cache`.
  */
 const AMBIGUOUS_DATA_DIRS = new Set(['cache', 'caches', 'tmp', 'temp', '.tmp']);
-const isShallowDataDir = (name, relDir) => AMBIGUOUS_DATA_DIRS.has(name) && relDir.split('/').length <= 2;
+const DATA_ISH_PARENTS = new Set(['data', 'var', 'storage']);
+const isShallowDataDir = (name, relDir) => {
+    if (!AMBIGUOUS_DATA_DIRS.has(name))
+        return false;
+    const segs = relDir.split('/');
+    return segs.length === 1 || (segs.length === 2 && DATA_ISH_PARENTS.has((segs[0] ?? '').toLowerCase()));
+};
 const TEXT_EXT = new Set([
-    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte',
+    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.mts', '.cts', '.vue', '.svelte',
     '.py', '.rb', '.php', '.go', '.rs', '.java', '.kt', '.cs',
-    '.html', '.css', '.scss', '.json', '.yml', '.yaml', '.toml',
+    '.html', '.css', '.scss', '.json', '.jsonc', '.json5', '.yml', '.yaml', '.toml',
     '.env', '.sh', '.sql', '.md', '.txt', '.ini', '.conf', '.tf',
     '.pem', '.key', '.crt', '.cert', '.pkcs8',
     '.astro', '.properties', '.plist', '.swift', '.dart', '.ipynb', '.bash', '.zsh', '.mdx',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "easyvibegate",
-  "version": "0.6.2",
+  "version": "0.6.9",
   "description": "Interactive security scanner for vibe-coded apps (focus: Next.js + Supabase). Checks common risks and shows evidence where it can.",
   "type": "module",
   "bin": {