easyvibegate 0.6.8 → 0.6.9

package/README.en.md

@@ -8,7 +8,16 @@
 
 Most scanners grep your code and say *"you might have leaked a key."* EasyVibeGate also goes to the running backend: for **Supabase/Firebase** it walks in with the public key and shows which tables are readable by anyone, with the exact `curl` — plus SQL to close it. It is honest about coverage: every check reports whether it actually ran, so a failed or skipped check is never shown as a green "all clear".
 
-> Status: **v0.5, early.** Best-supported stack: **Next.js + Supabase**. Code review runs on any stack; the live backend probe is read-only and Supabase/Firebase-focused. Not a penetration test.
+> Status: **actively maintained, version 0.6.8.** Best-supported stack: **Next.js + Supabase**. Code review runs on any stack; the live backend probe is read-only and Supabase/Firebase-focused. Not a penetration test.
+
+### What it actually checks
+
+1. **Secrets hardcoded in source** — API keys (OpenAI, Stripe, AWS, Supabase, etc.) and database passwords written directly into code instead of environment variables. If the code ever leaves your machine (a public repo, a screenshot, a shared link), those keys leak with it.
+2. **Row Level Security (RLS) disabled in the database** — if a Supabase/Postgres table has no row-level protection, anyone holding only your app's public (anon) key — i.e. literally every visitor — can read and sometimes write every user's data through the API, not just their own.
+3. **Secrets shipped in the client bundle** — variables prefixed `NEXT_PUBLIC_` / `VITE_` / `REACT_APP_` are baked straight into the JS every visitor's browser downloads. If a real secret ends up behind one of those prefixes, it's visible in the page source (F12 → Sources).
+4. **Dangerous config** — CORS allowing any origin, debug/verbose mode left on, use of `eval`, SQL built by string concatenation (injection risk), a JWT with `alg: none`.
+5. **`.env` / git hygiene** — a secret in a committed `.env` is already in git history and visible to anyone with repo access, even after the file is deleted later.
+6. **Live backend probe** (opt-in, your own projects only) — the tool actually talks to your running Supabase/Firebase with the public key and checks which tables/buckets are readable without auth, plus hits discovered API endpoints with no token. Read-only — it never writes or breaks anything.
 
 ## How to run
 
@@ -22,7 +31,6 @@ If you use **Cursor, Claude Code, or Codex**, you don't need to type anything in
 Check this project's security with EasyVibeGate and explain the result in plain language.
 
 1. Run at the project root:  npx easyvibegate . --no-wizard --deps
-   (After the npm release the short form is: npx easyvibegate . --no-wizard --deps)
    (Add  --url <my-app-url> --i-own-this  only if this is my project
     and I allow the live backend probe.)
 2. Open and read the file:  easyvibegate-report/ai-fix-prompt.md

package/README.md

@@ -8,7 +8,7 @@
 
 Большинство сканеров просто грепают код и говорят «возможно, ты слил ключ». EasyVibeGate идёт дальше: для **Supabase/Firebase** заходит публичным ключом и показывает, какие таблицы читаются кем угодно, с готовым `curl` и SQL для починки. И он честен про покрытие: каждая проверка сообщает, реально ли она выполнилась, поэтому упавшая или пропущенная проверка **никогда не выдаётся за зелёное «всё чисто»**.
 
-> Статус: **v0.5, ранняя версия.** Лучше всего поддержан стек **Next.js + Supabase**. Осмотр кода работает на любом стеке; живой пробинг бэкенда — только чтение и заточен под Supabase/Firebase. Это не пентест.
+> Статус: **активно развивается, версия 0.6.8.** Лучше всего поддержан стек **Next.js + Supabase**. Осмотр кода работает на любом стеке; живой пробинг бэкенда — только чтение и заточен под Supabase/Firebase. Это не пентест.
 
 ## 🇷🇺 Простыми словами
 
@@ -21,7 +21,16 @@
 2. Ответь на пару вопросов «да / нет».
 3. Получишь понятный отчёт и готовый план починки — вставь его в свой ИИ (Cursor/Claude), и он всё исправит.
 
-Разбираться в том, что внутри, не нужно: сложное — под капотом, снаружи одна команда и вопросы «да / нет».
+Разбираться в том, что внутри, не нужно: сложное — под капотом, снаружи одна команда и вопросы «да / нет». Но если интересно — вот что конкретно проверяется.
+
+### Что именно оно ищет
+
+1. **Секреты прямо в коде** — API-ключи (OpenAI, Stripe, AWS, Supabase и т.д.) и пароли от базы, вписанные в код текстом, а не через переменные окружения. Если код когда-нибудь попадёт наружу (публичный репозиторий, скриншот, share-ссылка) — эти ключи утекут вместе с ним.
+2. **Отключённый RLS (Row Level Security) в базе** — если у таблицы в Supabase/Postgres не включена построчная защита, то любой человек, у которого есть только публичный (анонимный) ключ твоего приложения — то есть буквально каждый посетитель сайта — может через API читать и иногда менять данные ВСЕХ пользователей, а не только свои.
+3. **Секреты в клиентском бандле** — переменные с префиксом `NEXT_PUBLIC_` / `VITE_` / `REACT_APP_` попадают прямо в JS-файлы, которые скачивает браузер каждого посетителя. Если под таким префиксом лежит не публичный, а секретный ключ — его видно в исходниках страницы (F12 → Sources).
+4. **Опасные настройки конфигурации** — CORS, разрешающий запросы с любого домена, включённый debug/verbose-режим, использование `eval`, сборка SQL-запроса через склейку строк (риск SQL-инъекции), JWT с `alg: none`.
+5. **Гигиена `.env` и git** — секрет в закоммиченном `.env` уже попал в историю git и виден всем, у кого есть доступ к репозиторию (даже если файл потом удалить — история останется).
+6. **Живая проверка бэкенда** (по желанию, только на своих проектах) — инструмент реально обращается к твоему работающему Supabase/Firebase с публичным ключом и смотрит, какие таблицы/бакеты читаются без авторизации, плюс дёргает найденные API-эндпоинты без токена. Только чтение, ничего не пишет и не ломает.
 
 ## Как запустить
 

package/dist/engine/checkers/deep/deps.js

@@ -1,5 +1,18 @@
 import { execFile } from 'node:child_process';
 const MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
+/**
+ * Extra args that restrict the audit to non-dev dependencies, per manager.
+ * Used for a SECOND audit pass so dev-only tooling (eslint, vitest, turbo —
+ * never shipped, never run on the server) can be told apart from the runtime
+ * dependency tree, without guessing from node_modules paths.
+ */
+const PROD_ONLY_ARGS = {
+    npm: ['audit', '--omit=dev', '--json'],
+    pnpm: ['audit', '--prod', '--json'],
+    // yarn's --groups takes each value as its OWN argument, not comma-joined —
+    // `--groups dependencies,optionalDependencies` silently audited 0 packages.
+    yarn: ['audit', '--groups', 'dependencies', 'optionalDependencies', '--json'],
+};
 function run(cmd, args, cwd, timeoutMs) {
     return new Promise((resolve) => {
         execFile(cmd, args, { cwd, timeout: timeoutMs, maxBuffer: 20 * 1024 * 1024 }, (err, stdout) => {
@@ -48,6 +61,128 @@ function validCounts(v) {
     }
     return out;
 }
+/** `fixAvailable` in npm's (and yarn's) newer `vulnerabilities` map: `true`, an object, or absent/false. */
+function formatFixAvailable(fixAvailable) {
+    if (fixAvailable === true)
+        return 'update available';
+    if (fixAvailable && typeof fixAvailable === 'object') {
+        const f = fixAvailable;
+        if (f.name && f.version)
+            return `needs ${f.name}@${f.version}${f.isSemVerMajor ? ' (major)' : ''}`;
+    }
+    return undefined;
+}
+/** Keep the worst-severity entry per package name, in original order, capped. */
+function dedupePackages(list, cap) {
+    const rank = { critical: 0, high: 1, moderate: 2, low: 3, info: 4 };
+    const best = new Map();
+    for (const p of list) {
+        const cur = best.get(p.name);
+        if (!cur || (rank[p.severity] ?? 9) < (rank[cur.severity] ?? 9))
+            best.set(p.name, p);
+    }
+    return [...best.values()].slice(0, cap);
+}
+/**
+ * Normalize one audit run's stdout into counts + a package list, across three
+ * incompatible report shapes:
+ *  - npm (v7+) / yarn's `vulnerabilities` map, keyed by package name, each
+ *    entry carrying `name`/`severity`/`range`/`fixAvailable` directly.
+ *  - pnpm's `advisories` map — the OLDER npm-audit-v1 report shape pnpm still
+ *    emits, keyed by numeric advisory id, each entry carrying `module_name` /
+ *    `vulnerable_versions` / `patched_versions` instead. A package with
+ *    several advisories appears more than once, so results get deduped by
+ *    name. (The previous version of this reader only knew the newer shape,
+ *    so pnpm projects silently got an empty package list — 0 names, always —
+ *    even though `metadata.vulnerabilities` parsed fine.)
+ *  - yarn v1's NDJSON stream of `{type, data}` lines: one `auditSummary` line
+ *    with the counts, and one `auditAdvisory` line per finding, each nesting
+ *    the same `module_name`/`vulnerable_versions`/`patched_versions` shape as
+ *    pnpm's under `data.advisory`.
+ */
+function parseAuditPayload(pm, stdout) {
+    if (pm === 'yarn') {
+        let counts = null;
+        const packages = [];
+        for (const line of stdout.split('\n')) {
+            const s = line.trim();
+            if (!s.startsWith('{'))
+                continue;
+            let obj;
+            try {
+                obj = JSON.parse(s);
+            }
+            catch {
+                continue;
+            }
+            if (obj.type === 'auditSummary') {
+                counts = validCounts(obj.data?.vulnerabilities);
+            }
+            else if (obj.type === 'auditAdvisory') {
+                const a = obj.data?.advisory;
+                if (a && typeof a['module_name'] === 'string' && typeof a['severity'] === 'string') {
+                    packages.push({
+                        name: a['module_name'],
+                        severity: a['severity'],
+                        range: typeof a['vulnerable_versions'] === 'string' ? a['vulnerable_versions'] : undefined,
+                        fix: typeof a['patched_versions'] === 'string' ? a['patched_versions'] : undefined,
+                    });
+                }
+            }
+        }
+        return counts ? { counts, packages } : null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        const line = stdout.trim().split('\n').filter(Boolean).pop() ?? '';
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (typeof parsed !== 'object' || parsed === null || parsed['error'] !== undefined)
+        return null;
+    const counts = validCounts(parsed['metadata']?.vulnerabilities);
+    if (!counts)
+        return null;
+    const packages = [];
+    const vulnMap = parsed['vulnerabilities'];
+    if (vulnMap && typeof vulnMap === 'object') {
+        // npm v2 / yarn-berry-style: keyed by package name, one entry each.
+        for (const v of Object.values(vulnMap)) {
+            if (typeof v['name'] !== 'string' || typeof v['severity'] !== 'string')
+                continue;
+            packages.push({
+                name: v['name'],
+                severity: v['severity'],
+                range: typeof v['range'] === 'string' ? v['range'] : undefined,
+                fix: formatFixAvailable(v['fixAvailable']),
+            });
+        }
+    }
+    else {
+        // pnpm: the old npm-audit-v1 shape, keyed by numeric advisory id.
+        const advisories = parsed['advisories'];
+        if (advisories && typeof advisories === 'object') {
+            for (const a of Object.values(advisories)) {
+                if (typeof a['module_name'] !== 'string' || typeof a['severity'] !== 'string')
+                    continue;
+                packages.push({
+                    name: a['module_name'],
+                    severity: a['severity'],
+                    range: typeof a['vulnerable_versions'] === 'string' ? a['vulnerable_versions'] : undefined,
+                    fix: typeof a['patched_versions'] === 'string' ? a['patched_versions'] : undefined,
+                });
+            }
+        }
+    }
+    return { counts, packages };
+}
 /**
  * Level 1: dependency vulnerability audit via the project's package manager.
  * Returns a status so an audit that could not run (offline, missing tool,
@@ -99,78 +234,87 @@ export async function auditDeps(root, packageManagers, timeoutMs = 60000) {
         return failed(`${pm} audit exited with code ${res.code}`);
     if (!res.stdout.trim())
         return failed(`${pm} audit produced no output (offline or no lockfile?)`);
-    let counts = null;
-    let vulnMap = {};
-    if (pm === 'yarn') {
-        for (const line of res.stdout.split('\n')) {
-            const s = line.trim();
-            if (!s.startsWith('{'))
-                continue;
-            try {
-                const obj = JSON.parse(s);
-                if (obj.type === 'auditSummary')
-                    counts = validCounts(obj.data?.vulnerabilities);
-            }
-            catch { /* skip */ }
-        }
-        if (!counts)
-            return failed('unparseable audit output (no valid yarn auditSummary)');
-    }
-    else {
-        let parsed;
-        try {
-            parsed = JSON.parse(res.stdout);
-        }
-        catch {
-            const line = res.stdout.trim().split('\n').filter(Boolean).pop() ?? '';
-            try {
-                parsed = JSON.parse(line);
-            }
-            catch {
-                return failed('unparseable audit output (not JSON)');
-            }
-        }
-        // A valid JSON error envelope (e.g. registry unavailable) is NOT "clean".
-        if (typeof parsed !== 'object' || parsed === null || parsed.error !== undefined) {
-            return failed('audit returned an error envelope');
-        }
-        counts = validCounts(parsed.metadata?.vulnerabilities);
-        if (!counts)
-            return failed('unparseable audit output (metadata.vulnerabilities missing or malformed)');
-        vulnMap = parsed.vulnerabilities ?? {};
-    }
-    const { critical, high, moderate, low } = counts;
-    const total = counts.total ?? critical + high + moderate + low + counts.info;
+    const full = parseAuditPayload(pm, res.stdout);
+    if (!full)
+        return failed('unparseable audit output');
+    // Second pass, prod-only: tells apart a real runtime hole from a vulnerable
+    // devDependency (eslint, vitest, turbo — never shipped, never executed on
+    // the server) that would otherwise inflate the score and the verdict the
+    // same way a live SQL injection would. Best-effort: if this second call
+    // fails for any reason, fall back to treating the full count as the runtime
+    // count — never the other way around, so a failure here cannot make a real
+    // vulnerability look dev-only.
+    const prodRes = await run(pm, PROD_ONLY_ARGS[pm], root, timeoutMs);
+    const prod = !prodRes.failedToSpawn && prodRes.code !== null
+        && (prodRes.code === 0 || isVulnsFoundExit(pm, prodRes.code))
+        && prodRes.stdout.trim()
+        ? parseAuditPayload(pm, prodRes.stdout)
+        : null;
+    const runtime = prod ?? full;
+    // Only ever attribute MORE to dev, never invent runtime risk the tool
+    // itself never reported — clamp at 0 in case the two audit runs disagree
+    // (a lockfile changing between calls, or manager-specific flag quirks).
+    const devOnly = {
+        info: Math.max(0, full.counts.info - runtime.counts.info),
+        low: Math.max(0, full.counts.low - runtime.counts.low),
+        moderate: Math.max(0, full.counts.moderate - runtime.counts.moderate),
+        high: Math.max(0, full.counts.high - runtime.counts.high),
+        critical: Math.max(0, full.counts.critical - runtime.counts.critical),
+    };
+    const devTotal = devOnly.info + devOnly.low + devOnly.moderate + devOnly.high + devOnly.critical;
+    const splitKnown = prod !== null;
+    const { critical, high, moderate, low } = runtime.counts;
+    const runtimeTotal = runtime.counts.total ?? critical + high + moderate + low + runtime.counts.info;
     const findings = [...conflictFindings];
-    if (total > 0) {
+    if (runtimeTotal > 0) {
         const severity = critical + high > 0 ? 'critical' : moderate > 0 ? 'warning' : 'info';
+        const devNote = splitKnown && devTotal > 0
+            ? ` (plus ${devTotal} in dev-only tooling — not counted here, does not ship or run on the server)`
+            : !splitKnown
+                ? ' (dev/runtime split unavailable — this count includes dev dependencies)'
+                : '';
         findings.push({
             id: 'deps_vulnerabilities',
             severity,
-            title: `${total} vulnerable dependenc${total === 1 ? 'y' : 'ies'}`,
-            detail: `${pm} audit: ${critical} critical, ${high} high, ${moderate} moderate, ${low} low.`,
+            title: `${runtimeTotal} vulnerable runtime dependenc${runtimeTotal === 1 ? 'y' : 'ies'}${devNote}`,
+            detail: `${pm} audit (runtime only): ${critical} critical, ${high} high, ${moderate} moderate, ${low} low.`,
             fix: `Run \`${pm} audit${pm === 'npm' ? ' fix' : ''}\` and upgrade the flagged packages; check breaking changes.`,
             checker: 'deps',
             level: 1,
         });
-        const named = Object.values(vulnMap)
-            .filter((v) => v.severity === 'critical' || v.severity === 'high')
-            .map((v) => v.name)
-            .filter(Boolean)
-            .slice(0, 8);
+        const named = dedupePackages(runtime.packages.filter((p) => p.severity === 'critical' || p.severity === 'high'), 8);
         if (named.length) {
             findings.push({
                 id: 'deps_top_packages',
                 severity: 'info',
-                title: 'High/critical packages to upgrade',
-                detail: named.join(', '),
+                title: 'High/critical runtime packages to upgrade',
+                detail: named.map((p) => `${p.name} (${p.range ?? '?'})${p.fix ? ` → ${p.fix}` : ''}`).join(', '),
                 fix: 'Upgrade these first; they carry the most severe advisories.',
                 checker: 'deps',
                 level: 1,
             });
         }
     }
-    // "completed" with zero findings means genuinely no known vulns — the status,
-    // not an info finding, records that the check ran cleanly.
+    // Dev-only vulnerabilities are still worth knowing about (a compromised
+    // build-time tool can still do damage), but they are hygiene, not a hole a
+    // client can reach — info, and never why the gate fails.
+    if (splitKnown && devTotal > 0) {
+        const devCritHigh = devOnly.critical + devOnly.high;
+        const devNamed = dedupePackages(full.packages
+            .filter((p) => p.severity === 'critical' || p.severity === 'high')
+            .filter((p) => !runtime.packages.some((r) => r.name === p.name)), 8);
+        findings.push({
+            id: 'deps_dev_vulnerabilities',
+            severity: 'info',
+            title: `${devTotal} vulnerable dev-only dependenc${devTotal === 1 ? 'y' : 'ies'}`,
+            detail: `${devOnly.critical} critical, ${devOnly.high} high, ${devOnly.moderate} moderate, ${devOnly.low} low — only in build/test tooling (e.g. eslint, vitest, turbo), never shipped to the browser or run on the server.${devCritHigh > 0 && devNamed.length ? ` Top: ${devNamed.map((p) => p.name).join(', ')}.` : ''}`,
+            fix: `Worth updating on its own schedule — run \`${pm} audit\` (full) to see them; they do not affect this project's runtime exposure.`,
+            checker: 'deps',
+            level: 1,
+        });
+    }
+    // "completed" with zero runtime findings means genuinely no known runtime
+    // vulns — the status, not an info finding, records that the check ran
+    // cleanly. A dev-only info finding can still be present.
     return { findings, run: withNote({ id: 'deps', level: 1, status: 'completed' }) };
 }

package/dist/engine/checkers/index.js

@@ -4,6 +4,7 @@ import { configRisksChecker } from './static/config-risks.js';
 import { rlsMigrationsChecker } from './static/rls-migrations.js';
 import { envGitChecker } from './static/env-git.js';
 import { routeInventoryChecker } from './static/route-inventory.js';
+import { nextImageSsrfChecker } from './static/next-image-ssrf.js';
 /** Level 0 checkers: read-only static analysis, no install, any stack. */
 export const staticCheckers = [
     secretsChecker,
@@ -12,4 +13,5 @@ export const staticCheckers = [
     rlsMigrationsChecker,
     envGitChecker,
     routeInventoryChecker,
+    nextImageSsrfChecker,
 ];

package/dist/engine/checkers/static/next-image-ssrf.js

@@ -0,0 +1,137 @@
+import { lineAt } from '../../util/text.js';
+import { maskCode } from '../../util/mask.js';
+const NEXT_CONFIG_RE = /(^|\/)next\.config\.(js|mjs|cjs|ts)$/;
+const MIDDLEWARE_RE = /(^|\/)middleware\.(js|mjs|ts)$/;
+/**
+ * A `remotePatterns` entry with a wildcard hostname. Next.js's built-in image
+ * optimizer (`/_next/image?url=...`) will then fetch ANY https URL a caller
+ * gives it and return the decoded result — a textbook SSRF primitive (probe
+ * internal services, cloud metadata endpoints, port-scan the private network)
+ * independent of whatever RCE a given `next`/`sharp` version does or doesn't
+ * carry this month. Flagging only the version misses this: upgrading closes
+ * today's CVE but leaves the wildcard open for the next one.
+ */
+const WILDCARD_HOSTNAME = /hostname\s*:\s*["'`]\*{1,2}["'`]/;
+const REMOTE_PATTERNS_BLOCK = /remotePatterns\s*:\s*\[/g;
+/** How far past `remotePatterns: [` to look for a wildcard entry inside it. */
+const BLOCK_WINDOW = 2000;
+/**
+ * The Next.js docs' own idiom for "run this middleware on everything except
+ * X": a negative lookahead inside the matcher regex,
+ * `'/((?!_next/static|_next/image|favicon.ico).*)'`. `_next/image` appearing
+ * inside a matcher block that also contains a lookahead means the image
+ * optimizer is explicitly carved out of whatever auth gate this middleware
+ * otherwise enforces — reachable with no session at all.
+ */
+const MATCHER_BLOCK = /matcher\s*[:=]/g;
+const MATCHER_WINDOW = 500;
+const dirOf = (rel) => {
+    const i = rel.lastIndexOf('/');
+    return i === -1 ? '' : rel.slice(0, i);
+};
+/** middleware.ts commonly sits at the app root OR under src/ — normalize both to the app root. */
+const appRootOf = (rel) => {
+    const d = dirOf(rel);
+    return d.endsWith('/src') ? d.slice(0, -4) : d === 'src' ? '' : d;
+};
+function findWildcardRemotePatterns(content) {
+    const hits = [];
+    for (const m of content.matchAll(REMOTE_PATTERNS_BLOCK)) {
+        const start = (m.index ?? 0) + m[0].length;
+        const window = content.slice(start, start + BLOCK_WINDOW);
+        // Stop at the block's own closing `]` when it's inside the window, so a
+        // SECOND, unrelated remotePatterns array later in a long file is not
+        // credited with this one's wildcard.
+        const closeAt = window.indexOf(']');
+        const scoped = closeAt === -1 ? window : window.slice(0, closeAt);
+        if (WILDCARD_HOSTNAME.test(scoped))
+            hits.push(m.index ?? 0);
+    }
+    return hits;
+}
+function findImageExcludedMatchers(content) {
+    const hits = [];
+    for (const m of content.matchAll(MATCHER_BLOCK)) {
+        const start = m.index ?? 0;
+        const window = content.slice(start, start + MATCHER_WINDOW);
+        if (window.includes('(?!') && window.includes('_next/image'))
+            hits.push(start);
+    }
+    return hits;
+}
+/**
+ * Correlates two static signals that no per-file, per-checker rule can see
+ * together: an image optimizer open to any host (`next.config.*`), and an
+ * auth middleware that explicitly exempts the optimizer's own route
+ * (`middleware.*`). Neither file alone shows the hole; grep for either one in
+ * isolation reads as routine Next.js configuration.
+ */
+export const nextImageSsrfChecker = {
+    id: 'next-image-ssrf',
+    title: 'Next.js image optimizer open to any host',
+    level: 0,
+    run(ctx) {
+        const configFiles = ctx.files.filter((f) => NEXT_CONFIG_RE.test(f.rel));
+        const middlewareFiles = ctx.files.filter((f) => MIDDLEWARE_RE.test(f.rel));
+        const wildcardHits = [];
+        // Comments never count as config: `// hostname: '**' — SSRF risk, do not
+        // do this` in a file that sets a real, specific hostname must not fire.
+        for (const f of configFiles) {
+            const masked = maskCode(f.content, { file: f.rel });
+            for (const index of findWildcardRemotePatterns(masked))
+                wildcardHits.push({ file: f.rel, index });
+        }
+        if (wildcardHits.length === 0)
+            return { findings: [] };
+        const excludedHits = [];
+        for (const f of middlewareFiles) {
+            const masked = maskCode(f.content, { file: f.rel });
+            for (const index of findImageExcludedMatchers(masked))
+                excludedHits.push({ file: f.rel, index });
+        }
+        // Pair a config hit with a middleware hit when there is only one of each
+        // in the whole project (the common single-app case), or when one file's
+        // app root is a prefix of the other's (a monorepo with `apps/<name>/`).
+        const pairFor = (configFile) => {
+            if (excludedHits.length === 1)
+                return excludedHits[0];
+            const root = appRootOf(configFile);
+            return excludedHits.find((h) => {
+                const hRoot = appRootOf(h.file);
+                return hRoot === root || hRoot.startsWith(root ? `${root}/` : '') || (root.startsWith(hRoot ? `${hRoot}/` : '') && hRoot !== '');
+            });
+        };
+        const findings = [];
+        for (const hit of wildcardHits) {
+            const file = ctx.files.find((f) => f.rel === hit.file);
+            const line = file ? lineAt(file.content, hit.index) : 1;
+            const paired = configFiles.length === 1 ? excludedHits[0] : pairFor(hit.file);
+            if (paired) {
+                findings.push({
+                    id: 'next_image_ssrf_unauth',
+                    severity: 'critical',
+                    title: 'Next.js image optimizer is open to any host AND reachable without auth',
+                    detail: `${hit.file}:${line} allows the built-in image optimizer (${'/_next/image'}) to fetch an https URL from ANY host (a wildcard \`hostname\` in \`remotePatterns\`). ${paired.file} explicitly excludes \`_next/image\` from its auth matcher, so any unauthenticated caller can make this server fetch an attacker-chosen URL — a classic SSRF (internal services, cloud metadata endpoints, private-network scanning), and a live vector for whatever RCE the installed \`next\`/\`sharp\` version carries in its image decoder. One \`GET\` request against the real path confirms this without needing to read either file in isolation.`,
+                    fix: 'Restrict `images.remotePatterns` to the specific hosts you actually serve images from — never a bare `\'*\'`/`\'**\'` hostname. If the optimizer must stay open to arbitrary hosts, remove `_next/image` from the middleware matcher exclusion so it is not reachable pre-auth. Also keep `next` and `sharp` on a current, patched version — the wildcard host and the decoder CVEs compound each other.',
+                    checker: 'next-image-ssrf',
+                    level: 0,
+                    file: hit.file,
+                    line,
+                });
+                continue;
+            }
+            findings.push({
+                id: 'next_image_ssrf_open',
+                severity: 'warning',
+                title: 'Next.js image optimizer accepts any remote host',
+                detail: `${hit.file}:${line} sets a wildcard \`hostname\` in \`images.remotePatterns\`, so the built-in image optimizer will fetch an https URL from any host a caller supplies. This is an SSRF primitive on its own — internal services, cloud metadata endpoints, and the private network become reachable through this server — independent of whether \`_next/image\` also sits behind auth.`,
+                fix: 'List the specific hosts you actually serve images from in `remotePatterns` instead of a bare `\'*\'`/`\'**\'` hostname. If the route is not behind auth, this is worth fixing regardless of the current `next`/`sharp` version.',
+                checker: 'next-image-ssrf',
+                level: 0,
+                file: hit.file,
+                line,
+            });
+        }
+        return { findings };
+    },
+};

package/dist/engine/checkers/static/secrets.js

@@ -1,5 +1,5 @@
 import { decodeJwtPayload, lineAt, looksLikePlaceholder, looksLikeTestOrDocPath, redact, shannonEntropy } from '../../util/text.js';
-import { createExposure } from '../../util/git-exposure.js';
+import { createExposure, createHistoryChecker } from '../../util/git-exposure.js';
 import { partitionIgnores } from '../../config.js';
 /** No project-wide rules — used to run ONLY the inline-marker half of partitionIgnores. */
 const EMPTY_CONFIG = { ignore: [], ignorePaths: [] };
@@ -246,7 +246,7 @@ function collectRealEnvValues(files) {
  * it is. Builds the per-file `push` used by every scan pass below, so that
  * pipeline lives in one place instead of being reimplemented per pass.
  */
-function makePush({ rel, env, example, ex, realEnvValues, findings }) {
+function makePush({ rel, env, example, ex, realEnvValues, findings, wasCommitted }) {
     return (f, proven = false, raw) => {
         let out = f;
         const realValueInExample = !!raw && isExampleEnv(rel) && (realEnvValues.get(dirOf(rel))?.has(raw) ?? false);
@@ -291,15 +291,28 @@ function makePush({ rel, env, example, ex, realEnvValues, findings }) {
                 // there is nothing a separate ignored-env-file branch would add.
                 out = { ...out, severity: 'advisory', detail: `${out.detail} Not committed — this is where the value belongs; keep the file out of git and out of client bundles.` };
             }
-            else if (ex === 'ignored') {
-                // Gitignored, but not an env file: a credential pasted into a tool
-                // config or a script (a prod DB password inside a permission rule in
-                // .claude/settings.local.json was reported as a mere advisory). It
-                // cannot leak through git today; it still does not belong there.
-                out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.` };
-            }
-            else if (ex === 'untracked') {
-                out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.` };
+            else if (ex === 'ignored' || ex === 'untracked') {
+                // Gitignored or untracked now — but "not committed NOW" is not the
+                // same claim as "never committed": a file `git rm --cached` removed
+                // after the mistake was noticed still carries the real value forever
+                // in history. For a structurally-proven credential (not a name-based
+                // guess), check whether THIS value ever showed up in a version of
+                // this file that WAS committed — "rotate immediately" is warranted
+                // for a real incident and needless (if harmless) urgency otherwise,
+                // and rotating a production service_role key across every
+                // environment that holds it is not a free action to ask for blindly.
+                const committedBefore = proven && !!raw ? wasCommitted(raw) : null;
+                const base = ex === 'ignored'
+                    ? `${out.detail} The file is gitignored, so this cannot leak through git — but it is a credential pasted into a config/source file, not an env var. Move it to .env (also gitignored) so one \`git add -A\` or a shared zip never carries it.`
+                    : `${out.detail} The file is not committed yet — it is one \`git add -A\` away from being. Add it to .gitignore or move the value to an env var.`;
+                out = {
+                    ...out,
+                    severity: atMost(out.severity, 'warning'),
+                    detail: committedBefore === false
+                        ? `${base} Checked this file's git history for this exact value and did not find it — it does not look like it was ever actually committed, so this reads as a hygiene fix, not a confirmed leak.`
+                        : base,
+                    fix: committedBefore === false ? `${out.fix} (No evidence this exact value was ever committed, so rotation is precautionary here, not a confirmed-leak emergency.)` : out.fix,
+                };
             }
             else if (ex === 'no-git') {
                 out = { ...out, severity: atMost(out.severity, 'warning'), detail: `${out.detail} This folder is not a git repository, so nothing leaks through git; the risk is copying or zipping the folder. Move the value to an env var before this becomes a repo.` };
@@ -459,21 +472,30 @@ function scanInlineEnv(content, rel, push) {
         }, false, value);
     }
 }
+const NAME_BASED = new Set(['env_secret', 'generic_secret']);
 /**
  * De-duplicate only true repeats: the same secret, same place, same rule.
  * (Keying on file:line alone hid every extra key on a minified line.)
+ *
+ * env_secret and generic_secret are bucketed together (not by their own id):
+ * a config-ish file's single assignment runs through BOTH the line-anchored
+ * ASSIGN rule and the mid-line GENERIC rule, and when they independently
+ * derive the same value from the same line (an `auth_token = "env(NAME)"` in
+ * a Supabase config.toml matched both, each producing its own id) that is one
+ * fact reported twice, not two facts. Still keyed on evidence, not line alone
+ * — two DIFFERENT secrets on one line stay two findings either way.
  */
 function dedupeFindings(findings) {
     const seen = new Map();
     for (const f of findings) {
-        const key = `${f.file ?? ''}:${f.line ?? 0}:${f.id}:${f.evidence ?? ''}`;
+        const bucket = NAME_BASED.has(f.id) ? 'name-based' : f.id;
+        const key = `${f.file ?? ''}:${f.line ?? 0}:${bucket}:${f.evidence ?? ''}`;
         const cur = seen.get(key);
         if (!cur || SEVERITY_RANK[f.severity] < SEVERITY_RANK[cur.severity])
             seen.set(key, f);
     }
     return [...seen.values()];
 }
-const NAME_BASED = new Set(['env_secret', 'generic_secret']);
 /**
  * A vendor pattern or a decoded JWT already identifies a VALUE on a line; the
  * name-based env_secret / generic_secret finding for that SAME value is the
@@ -539,6 +561,7 @@ export const secretsChecker = {
     run(ctx) {
         const findings = [];
         const exposure = createExposure(ctx.root);
+        const history = createHistoryChecker(ctx.root);
         const realEnvValues = collectRealEnvValues(ctx.files);
         for (const file of ctx.files) {
             const { rel } = file;
@@ -546,11 +569,16 @@ export const secretsChecker = {
             const env = isEnvFile(rel);
             const example = looksLikeTestOrDocPath(rel);
             const ex = exposure(rel);
-            const push = makePush({ rel, env, example, ex, realEnvValues, findings });
+            const wasCommitted = (raw) => history(rel, raw);
+            const push = makePush({ rel, env, example, ex, realEnvValues, findings, wasCommitted });
             scanVendorPatterns(content, rel, env, push);
             scanServiceRoleJwt(content, rel, env, push);
-            scanGenericAssignments(content, rel, push);
+            // scanConfigAssignments before scanGenericAssignments/scanInlineEnv: on
+            // a config-ish file, all three can match the same line, and this one's
+            // title/fix is the most specific (it knows the file IS config/env) —
+            // dedupeFindings keeps the first-pushed on a tie, so it should win.
             scanConfigAssignments(content, rel, env, push);
+            scanGenericAssignments(content, rel, push);
             scanInlineEnv(content, rel, push);
         }
         const kept = dropRedundantNameBased(dedupeFindings(findings));

package/dist/engine/util/git-exposure.js

@@ -31,3 +31,44 @@ export function createExposure(root) {
         return ex;
     };
 }
+/**
+ * For a file that is NOT committed now (ignored or untracked): was THIS
+ * value ever in a version of it that WAS committed? Tells apart "moved to
+ * .gitignore before the real value was ever written here — never leaked"
+ * from "was committed with this exact credential, then removed — a real
+ * incident, still in history forever." Advice like "rotate it" is sound for
+ * the second and needless noise for the first, especially for a production
+ * key whose rotation itself carries real operational risk.
+ *
+ * Bounded to the file's last `maxCommits` commits touching it (a `git log`,
+ * then up to that many `git show` blob reads) — deliberate for a file with
+ * unusually long history; the answer degrades to "unknown", never "safe".
+ *
+ * Returns `true` (found it committed), `false` (checked history, never
+ * found), or `null` (no history to check, or git failed) — `null` must be
+ * treated as "no evidence either way", never as "confirmed safe".
+ */
+export function createHistoryChecker(root) {
+    const commitsCache = new Map();
+    const commitsFor = (rel, maxCommits) => {
+        const key = `${rel}\u0000${maxCommits}`;
+        const hit = commitsCache.get(key);
+        if (hit !== undefined)
+            return hit;
+        const log = git(root, ['log', '--all', '-n', String(maxCommits), '--format=%H', '--', rel]);
+        const commits = log === null ? null : log.split('\n').filter(Boolean);
+        commitsCache.set(key, commits);
+        return commits;
+    };
+    return (rel, value, maxCommits = 20) => {
+        const commits = commitsFor(rel, maxCommits);
+        if (commits === null || commits.length === 0)
+            return null; // never tracked at all, or git failed
+        for (const sha of commits) {
+            const blob = git(root, ['show', `${sha}:${rel}`]);
+            if (blob !== null && blob.includes(value))
+                return true;
+        }
+        return false;
+    };
+}

package/dist/engine/util/text.js

@@ -29,7 +29,17 @@ export function lineAt(content, index) {
     }
     return line;
 }
-const PLACEHOLDER = /(x{3,}|your[_-]?|<[^>]+>|\$\{|process\.env|import\.meta\.env|example|placeholder|changeme|dummy|test[_-]?key|xxxxx|\.\.\.)/i;
+/**
+ * A value that IS a reference to a secret, not the secret itself: `${NAME}`
+ * (shell/JS template), `env(NAME)` (Supabase CLI's config.toml substitution —
+ * the exact shape `supabase init` writes into every generated config, so this
+ * fired on every Supabase project's default file, not one repo's mistake),
+ * `{{ NAME }}` (Jinja/Helm/GitHub Actions expression), or a bare `$NAME`
+ * shell variable with nothing else in the value. The last one is anchored to
+ * the WHOLE value (`^...$`) — a real secret that merely contains a `$`
+ * somewhere must not be excluded, only a value that IS just a var reference.
+ */
+const PLACEHOLDER = /(x{3,}|your[_-]?|<[^>]+>|\$\{|process\.env|import\.meta\.env|example|placeholder|changeme|dummy|test[_-]?key|xxxxx|\.\.\.|env\(\s*[A-Z][A-Z0-9_]*\s*\)|\{\{\s*[\w.]+\s*\}\}|^\$[A-Z][A-Z0-9_]*$)/i;
 /** True if a captured value looks like a template/placeholder, not a real secret. */
 export function looksLikePlaceholder(value) {
     return PLACEHOLDER.test(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "easyvibegate",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "description": "Interactive security scanner for vibe-coded apps (focus: Next.js + Supabase). Checks common risks and shows evidence where it can.",
   "type": "module",
   "bin": {