evershield 0.1.0 → 0.3.0

package/dist/init.js

@@ -0,0 +1,136 @@
+/**
+ * `evershield init`: turn a one-off scan into a check that runs on every
+ * pull request. Detects the framework and build directory, then writes
+ * `evershield.config.json` and `.github/workflows/evershield.yml`.
+ *
+ * Existing files are never overwritten unless `--force` is given; init
+ * reports what it skipped instead.
+ */
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function anyExists(root, names) {
+    for (const name of names)
+        if (await exists(path.join(root, name)))
+            return true;
+    return false;
+}
+export async function detectProject(root) {
+    let pkg = {};
+    try {
+        pkg = JSON.parse(await readFile(path.join(root, "package.json"), "utf8"));
+    }
+    catch {
+        // Not a Node project, or no package.json: fall through to defaults.
+    }
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    const has = (name) => deps[name] !== undefined;
+    let framework = "unknown";
+    let buildDir = "dist";
+    if (has("next") || (await anyExists(root, ["next.config.js", "next.config.mjs", "next.config.ts"]))) {
+        framework = "nextjs";
+        buildDir = ".next";
+    }
+    else if (has("nuxt")) {
+        framework = "nuxt";
+        buildDir = ".output/public";
+    }
+    else if (has("@sveltejs/kit")) {
+        framework = "sveltekit";
+        buildDir = "build";
+    }
+    else if (has("astro")) {
+        framework = "astro";
+        buildDir = "dist";
+    }
+    else if (has("react-scripts")) {
+        framework = "create-react-app";
+        buildDir = "build";
+    }
+    else if (has("vite")) {
+        framework = "vite";
+        buildDir = "dist";
+    }
+    let packageManager = "npm";
+    if (await exists(path.join(root, "pnpm-lock.yaml")))
+        packageManager = "pnpm";
+    else if (await exists(path.join(root, "yarn.lock")))
+        packageManager = "yarn";
+    else if (await anyExists(root, ["bun.lockb", "bun.lock"]))
+        packageManager = "bun";
+    const run = packageManager === "npm" ? "npm run" : packageManager;
+    const buildCommand = pkg.scripts?.build !== undefined ? `${run} build` : "echo 'set your build command here' && exit 1";
+    return { framework, buildDir, packageManager, buildCommand, packageManagerPinned: typeof pkg.packageManager === "string" };
+}
+const INSTALL = {
+    npm: "npm ci",
+    pnpm: "pnpm install --frozen-lockfile",
+    yarn: "yarn install --frozen-lockfile",
+    bun: "bun install --frozen-lockfile",
+};
+export function renderWorkflow(detection) {
+    const setup = detection.packageManager === "pnpm"
+        ? `      - uses: pnpm/action-setup@v4\n${detection.packageManagerPinned === true ? "" : "        with:\n          version: 10\n"}      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: pnpm\n`
+        : detection.packageManager === "bun"
+            ? "      - uses: oven-sh/setup-bun@v2\n"
+            : `      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n          cache: ${detection.packageManager}\n`;
+    return `name: evershield
+
+# Scans what your app ships to the browser on every pull request and
+# reports findings in the Security tab. Generated by \`evershield init\`.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+${setup}      - run: ${INSTALL[detection.packageManager]}
+      - run: ${detection.buildCommand}
+      - uses: inviy/evershield@v0
+        with:
+          path: ${detection.buildDir}
+`;
+}
+export function renderConfig() {
+    return `${JSON.stringify({
+        gate: { failOn: "high", minConfidence: "medium" },
+        ignore: [],
+    }, null, 2)}\n`;
+}
+export async function runInit(root, options = {}) {
+    const detection = await detectProject(root);
+    const files = [
+        ["evershield.config.json", renderConfig()],
+        [".github/workflows/evershield.yml", renderWorkflow(detection)],
+    ];
+    const written = [];
+    const skipped = [];
+    for (const [relative, content] of files) {
+        const target = path.join(root, relative);
+        if (!options.force && (await exists(target))) {
+            skipped.push(relative);
+            continue;
+        }
+        await mkdir(path.dirname(target), { recursive: true });
+        await writeFile(target, content);
+        written.push(relative);
+    }
+    return { detection, written, skipped };
+}

package/dist/recon.d.ts

@@ -0,0 +1,53 @@
+import type { Finding } from "./index.ts";
+import { type CollectedTarget } from "./scan/artifact.ts";
+import type { ScannedFile } from "./scan/files.ts";
+export type ReconCategory = "credential" | "source" | "internal-address" | "other";
+export interface ReconItem {
+    category: ReconCategory;
+    finding: Finding;
+    /** true: REA's output contains the value; false: it does not; null: not checked. */
+    reaRecovered: boolean | null;
+}
+export interface ReconMap {
+    /** Hosts referenced by absolute URLs, most frequent first. */
+    hosts: Array<{
+        host: string;
+        count: number;
+    }>;
+    /** API-looking paths in string literals. */
+    apiPaths: string[];
+    sourceMaps: {
+        files: number;
+        originalSources: number;
+        withContent: number;
+    };
+    /** Framework-public env names still present in the output. */
+    publicEnvNames: string[];
+}
+export interface ReconRea {
+    status: "not-run" | "ran" | "skipped" | "failed";
+    detail?: string;
+}
+export interface ReconResult {
+    version: string;
+    layer: "recon";
+    target: string;
+    adapter: CollectedTarget["adapterName"];
+    filesScanned: number;
+    startedAt: string;
+    finishedAt: string;
+    items: ReconItem[];
+    /** The same findings, for the gate, ignores and SARIF. */
+    findings: Finding[];
+    ignored: number;
+    map: ReconMap;
+    rea: ReconRea;
+}
+export interface ReconOptions {
+    adapter?: "nextjs" | "plain";
+    /** Run REA's static analyzer; the executable name or path. */
+    reaBin?: string;
+    reaTimeoutMs?: number;
+}
+export declare function buildMap(files: ScannedFile[]): ReconMap;
+export declare function runRecon(target: string, options?: ReconOptions): Promise<ReconResult>;

package/dist/recon.js

@@ -0,0 +1,160 @@
+/**
+ * `evershield recon`: the attacker's view of a build or app package.
+ *
+ * Reverse-engineering tools such as REA cannot be blocked: they run in the
+ * attacker's own browser or on their own copy of the app. What can be
+ * controlled is what they get. recon lists it in two parts:
+ *
+ * - **Worth taking**: findings an attacker can use directly (credentials,
+ *   original source, internal addresses). The gate applies to these, so a
+ *   passing recon means the tools come back empty-handed.
+ * - **Map**: what any tool reconstructs from shipped code no matter what
+ *   (hosts, API paths, source map coverage, public env names). Informational:
+ *   it is the attack surface to keep server-side checks on.
+ *
+ * With `--rea`, REA's static JavaScript analyzer runs on the same target and
+ * each finding's unredacted value is looked up in REA's output, in memory
+ * only, to show whether the tool actually recovers it.
+ */
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { VERSION } from "./index.js";
+import { collectTarget, runArtifactRules } from "./scan/artifact.js";
+function categorize(finding) {
+    if (finding.ruleId === "artifact/source-map-published")
+        return "source";
+    if (finding.ruleId === "artifact/internal-endpoint")
+        return "internal-address";
+    if (finding.ruleId === "artifact/secret-like-string" || finding.ruleId === "artifact/sensitive-env-name")
+        return "credential";
+    return "other";
+}
+const URL_HOST = /\bhttps?:\/\/((?:[a-z0-9-]+\.)+[a-z]{2,}|localhost|\d{1,3}(?:\.\d{1,3}){3})(?::\d{2,5})?/gi;
+const API_PATH = /["'`](\/(?:api|graphql|rest|rpc|trpc|admin|internal|v\d+)(?:\/[\w\-.:{}$]*)*)(?=["'`?])/g;
+const PUBLIC_ENV = /\b(?:NEXT_PUBLIC|VITE|PUBLIC|REACT_APP|NUXT_PUBLIC|EXPO_PUBLIC|GATSBY|VUE_APP)_[A-Z0-9_]{2,}\b/g;
+const INLINE_MAP = /sourceMappingURL=data:application\/json[^,]*;base64,([A-Za-z0-9+/=]+)/g;
+function countSources(json, into) {
+    try {
+        const map = JSON.parse(json);
+        into.files += 1;
+        into.originalSources += Array.isArray(map.sources) ? map.sources.length : 0;
+        into.withContent += Array.isArray(map.sourcesContent) ? map.sourcesContent.filter((content) => typeof content === "string").length : 0;
+    }
+    catch {
+        // Not a parseable map; the source-map rule still reports the file.
+    }
+}
+export function buildMap(files) {
+    const hosts = new Map();
+    const apiPaths = new Set();
+    const publicEnvNames = new Set();
+    const sourceMaps = { files: 0, originalSources: 0, withContent: 0 };
+    for (const file of files) {
+        if (file.relativePath.endsWith(".map")) {
+            countSources(file.text, sourceMaps);
+            continue;
+        }
+        for (const match of file.text.matchAll(URL_HOST)) {
+            const host = match[1].toLowerCase();
+            hosts.set(host, (hosts.get(host) ?? 0) + 1);
+        }
+        for (const match of file.text.matchAll(API_PATH))
+            if (apiPaths.size < 200)
+                apiPaths.add(match[1]);
+        for (const match of file.text.matchAll(PUBLIC_ENV))
+            publicEnvNames.add(match[0]);
+        for (const match of file.text.matchAll(INLINE_MAP))
+            countSources(Buffer.from(match[1], "base64").toString("utf8"), sourceMaps);
+    }
+    return {
+        hosts: [...hosts.entries()].sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)).slice(0, 50).map(([host, count]) => ({ host, count })),
+        apiPaths: [...apiPaths].sort(),
+        sourceMaps,
+        publicEnvNames: [...publicEnvNames].sort(),
+    };
+}
+/**
+ * npm installs `rea` on Windows as `rea.cmd`, which only a shell can run, so
+ * Windows goes through cmd.exe with every argument quoted.
+ */
+function reaInvocation(bin, args) {
+    if (process.platform !== "win32")
+        return { file: bin, args, shell: false };
+    const quote = (value) => `"${value.replace(/"/g, '""')}"`;
+    return { file: quote(bin), args: args.map(quote), shell: true };
+}
+function runRea(bin, target, timeoutMs) {
+    const notFound = `"${bin}" not found; install REA (npm install --global rea-agents) or pass --rea-bin <path>`;
+    // A path that does not exist is caught here, without relying on shell messages that are localized.
+    if (/[\\/]/.test(bin) && !existsSync(bin))
+        return Promise.resolve({ ok: false, detail: notFound });
+    const invocation = reaInvocation(bin, ["analyze-javascript-application", target, "--format", "json"]);
+    return new Promise((resolve) => {
+        execFile(invocation.file, invocation.args, { maxBuffer: 1024 * 1024 * 1024, timeout: timeoutMs, env: { ...process.env, NO_COLOR: "1" }, shell: invocation.shell }, (error, stdout, stderr) => {
+            // cmd.exe exits 9009 for a command it cannot find, in every locale; its message is localized.
+            // execFile puts the errno string or the exit code number in `code`.
+            const code = error?.code;
+            const missing = code === "ENOENT" || (invocation.shell && code === 9009);
+            if (error !== null && missing) {
+                resolve({ ok: false, detail: notFound });
+            }
+            else if (error !== null && stdout.length === 0) {
+                resolve({ ok: false, detail: `REA failed: ${(stderr || error.message).trim().split("\n")[0]}` });
+            }
+            else {
+                resolve({ ok: true, output: stdout });
+            }
+        });
+    });
+}
+export async function runRecon(target, options = {}) {
+    const startedAt = new Date().toISOString();
+    const collected = await collectTarget(target, options.adapter === undefined ? {} : { adapter: options.adapter });
+    // Unredacted values stay in this map and are only compared, never written.
+    const raw = new Map();
+    const findings = runArtifactRules(collected.files, collected.adapter, (finding, value) => raw.set(finding, value));
+    let rea = { status: "not-run" };
+    let reaOutput = null;
+    if (options.reaBin !== undefined) {
+        const isAsar = collected.adapterName === "electron";
+        if (collected.adapterName === "android" || collected.adapterName === "ios") {
+            rea = { status: "skipped", detail: "REA's JavaScript analyzer takes a directory or an .asar; scan the extracted bundle directory with --rea" };
+        }
+        else {
+            const result = await runRea(options.reaBin, isAsar ? collected.root : path.resolve(collected.root), options.reaTimeoutMs ?? 600_000);
+            if (result.ok) {
+                rea = { status: "ran" };
+                reaOutput = result.output;
+            }
+            else {
+                rea = { status: "failed", detail: result.detail };
+            }
+        }
+    }
+    const items = findings.map((finding) => {
+        const category = categorize(finding);
+        let reaRecovered = null;
+        if (reaOutput !== null && category !== "source") {
+            const first = finding.evidence[0];
+            const value = raw.get(finding) ?? (category === "internal-address" && first?.kind === "file" ? first.excerpt : undefined);
+            if (value !== undefined)
+                reaRecovered = reaOutput.includes(value) || reaOutput.includes(JSON.stringify(value).slice(1, -1));
+        }
+        return { category, finding, reaRecovered };
+    });
+    return {
+        version: VERSION,
+        layer: "recon",
+        target: collected.root,
+        adapter: collected.adapterName,
+        filesScanned: collected.files.length,
+        startedAt,
+        finishedAt: new Date().toISOString(),
+        items,
+        findings,
+        ignored: 0,
+        map: buildMap(collected.files),
+        rea,
+    };
+}

package/dist/report/index.d.ts

@@ -1,9 +1,10 @@
 import type { AuditResult } from "../audit/run.ts";
 import type { Confidence, Finding, Severity } from "../index.ts";
 import type { ArtifactScanResult } from "../scan/artifact.ts";
+import type { SurfaceResult } from "../surface/run.ts";
 export type Format = "text" | "json" | "sarif";
 /** Any layer's result. Renderers switch on `layer` for the header only. */
-export type Report = ArtifactScanResult | AuditResult;
+export type Report = ArtifactScanResult | AuditResult | SurfaceResult;
 export declare const SEVERITIES: readonly Severity[];
 export declare const CONFIDENCES: readonly Confidence[];
 export interface Gate {

package/dist/report/index.js

@@ -17,7 +17,7 @@ function location(finding) {
     }
     if (first.kind === "response")
         return `${first.endpoint} as ${first.identity} → ${first.jsonPath}`;
-    return `${first.url} ${first.selector}`;
+    return `${first.url}${first.identity === undefined ? "" : ` as ${first.identity}`} → ${first.selector}`;
 }
 function header(result) {
     if (result.layer === "artifact") {
@@ -26,6 +26,12 @@ function header(result) {
             `target: ${result.target}`,
         ];
     }
+    if (result.layer === "surface") {
+        return [
+            `evershield ${result.version} · surface audit · ${result.pagesAudited} page(s) × ${result.identities.length} identities (${result.identities.join(" < ")}) · ${result.snapshotsEvaluated} page loads evaluated`,
+            `target: ${result.target}`,
+        ];
+    }
     return [
         `evershield ${result.version} · response audit · ${result.endpointsAudited} endpoint(s) × ${result.identities.length} identities (${result.identities.join(" < ")}) · ${result.responsesEvaluated} responses evaluated`,
         `target: ${result.target}`,
@@ -33,14 +39,18 @@ function header(result) {
 }
 export function renderText(result, gate) {
     const lines = [...header(result), ""];
-    if (result.layer === "response" && result.warnings.length > 0) {
+    if (result.layer !== "artifact" && result.warnings.length > 0) {
         for (const warning of result.warnings)
             lines.push(`! ${warning}`);
         lines.push("");
     }
     const ignoredNote = result.ignored > 0 ? ` ${result.ignored} finding(s) ignored by config.` : "";
     if (result.findings.length === 0) {
-        const what = result.layer === "artifact" ? "Nothing in the shipped files matched a rule." : "Every identity received only what it should.";
+        const what = result.layer === "artifact"
+            ? "Nothing in the shipped files matched a rule."
+            : result.layer === "surface"
+                ? "No identity's page held content it could not see."
+                : "Every identity received only what it should.";
         lines.push(`No findings. ${what}${ignoredNote}`);
         return `${lines.join("\n")}\n`;
     }

package/dist/report/recon.d.ts

@@ -0,0 +1,5 @@
+import type { ReconResult } from "../recon.ts";
+import { type Gate } from "./index.ts";
+export declare function renderReconText(result: ReconResult, gate: Gate): string;
+export declare function renderReconJson(result: ReconResult, gate: Gate): string;
+export declare function renderReconSarif(result: ReconResult, gate: Gate): string;

package/dist/report/recon.js

@@ -0,0 +1,71 @@
+import { isBlocking } from "./index.js";
+import { renderSarif } from "./sarif.js";
+const KIND = {
+    nextjs: "Next.js build",
+    plain: "build directory",
+    android: "Android package",
+    ios: "iOS package",
+    electron: "Electron archive",
+};
+function reaLabel(item, ran) {
+    if (!ran)
+        return "";
+    if (item.reaRecovered === true)
+        return "  · REA: recovered";
+    if (item.reaRecovered === false)
+        return "  · REA: not in its output";
+    return "  · REA: not checked";
+}
+function list(values, max) {
+    if (values.length === 0)
+        return "none";
+    const shown = values.slice(0, max).join(", ");
+    return values.length > max ? `${shown}, … (${values.length} total)` : shown;
+}
+export function renderReconText(result, gate) {
+    const ran = result.rea.status === "ran";
+    const blocking = result.items.filter((item) => isBlocking(item.finding, gate));
+    const lines = [
+        `evershield ${result.version} · recon · ${KIND[result.adapter]} · ${result.filesScanned} files`,
+        `target: ${result.target}`,
+        "What reverse-engineering tools recover from this target.",
+        "",
+        `Worth taking: ${blocking.length} blocking, ${result.items.length} total${result.ignored > 0 ? ` (${result.ignored} ignored by config)` : ""}`,
+    ];
+    for (const item of result.items) {
+        const first = item.finding.evidence[0];
+        lines.push(`${isBlocking(item.finding, gate) ? "✖" : "•"} [${item.finding.severity}/${item.finding.confidence}] ${item.finding.message}${reaLabel(item, ran)}`);
+        if (first?.kind === "file")
+            lines.push(`    at ${first.line === undefined ? first.path : `${first.path}:${first.line}:${first.column ?? 1}`}`);
+        if (item.finding.remediation !== undefined)
+            lines.push(`    fix: ${item.finding.remediation}`);
+    }
+    const { map } = result;
+    lines.push("", "Map (informational: any tool reconstructs this from shipped code; keep server-side checks on it)", `  hosts: ${list(map.hosts.map((h) => `${h.host} (${h.count})`), 8)}`, `  API paths: ${list(map.apiPaths, 12)}`, `  source maps: ${map.sourceMaps.files} file(s), ${map.sourceMaps.originalSources} original source(s), ${map.sourceMaps.withContent} with full content`, `  public env names: ${list(map.publicEnvNames, 8)}`, "", result.rea.status === "ran"
+        ? "REA: ran its static JavaScript analysis on the same target; each value above was looked up in its output (values are never printed)."
+        : result.rea.status === "not-run"
+            ? "REA: not run (add --rea to check each finding against REA's own output)."
+            : `REA: ${result.rea.status}: ${result.rea.detail ?? ""}`, "", blocking.length > 0
+        ? `Verdict: ${blocking.length} item(s) worth taking. Anyone running a reverse-engineering tool on this target gets them.`
+        : "Verdict: nothing worth taking at this gate. Tools still reconstruct the map above, and nothing more.");
+    return `${lines.join("\n")}\n`;
+}
+export function renderReconJson(result, gate) {
+    const blocking = result.findings.filter((finding) => isBlocking(finding, gate)).length;
+    const { findings: _findings, ...rest } = result;
+    return `${JSON.stringify({ ...rest, gate, blocking }, null, 2)}\n`;
+}
+export function renderReconSarif(result, gate) {
+    const artifact = {
+        version: result.version,
+        layer: "artifact",
+        target: result.target,
+        adapter: result.adapter,
+        filesScanned: result.filesScanned,
+        ignored: result.ignored,
+        startedAt: result.startedAt,
+        finishedAt: result.finishedAt,
+        findings: result.findings,
+    };
+    return renderSarif(artifact, gate);
+}

package/dist/report/sarif.js

@@ -6,11 +6,12 @@
  * File paths are relative to the scanned directory, not the repository
  * root, because build output is usually not committed. Response evidence
  * has no file, so it is reported as a logical location (endpoint, identity
- * and JSON path).
+ * and JSON path); DOM evidence likewise (page, identity and selector).
  */
 import { RESPONSE_RULES } from "../audit/rules.js";
 import { VERSION } from "../index.js";
 import { ARTIFACT_RULES } from "../rules/index.js";
+import { SURFACE_RULES } from "../surface/rules.js";
 import { helpUri } from "../rules/types.js";
 import { isBlocking } from "./index.js";
 function levelFor(severity) {
@@ -41,16 +42,29 @@ function locations(finding) {
             },
         ];
     }
-    return [{ logicalLocations: [{ name: first.selector, fullyQualifiedName: `${first.url} ${first.selector}`, kind: "element" }] }];
+    const as = first.identity === undefined ? "" : ` as ${first.identity}`;
+    return [{ logicalLocations: [{ name: first.selector, fullyQualifiedName: `${first.url}${as} → ${first.selector}`, kind: "element" }] }];
 }
 const KNOWN_RULES = new Map([
     ...ARTIFACT_RULES.map((rule) => [rule.id, rule]),
     ...RESPONSE_RULES.map((rule) => [rule.id, rule]),
+    ...SURFACE_RULES.map((rule) => [rule.id, rule]),
 ]);
 function invocationProperties(result, gate) {
     if (result.layer === "artifact") {
         return { layer: result.layer, adapter: result.adapter, filesScanned: result.filesScanned, ignored: result.ignored, gate };
     }
+    if (result.layer === "surface") {
+        return {
+            layer: result.layer,
+            identities: result.identities,
+            pagesAudited: result.pagesAudited,
+            snapshotsEvaluated: result.snapshotsEvaluated,
+            warnings: result.warnings,
+            ignored: result.ignored,
+            gate,
+        };
+    }
     return {
         layer: result.layer,
         identities: result.identities,

package/dist/rules/internal-endpoint.js

@@ -1,13 +1,24 @@
 import { lineColumn } from "../scan/text.js";
 import { helpUri, MAX_FINDINGS_PER_FILE } from "./types.js";
+const OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+const PRIVATE_IP = `(?:10\\.${OCTET}\\.${OCTET}\\.${OCTET}|192\\.168\\.${OCTET}\\.${OCTET}|172\\.(?:1[6-9]|2\\d|3[01])\\.${OCTET}\\.${OCTET})`;
 const PATTERNS = [
     {
+        // In a URL or with a port, a private IP is an address the code talks to.
         name: "Private IP address",
-        pattern: /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\b/g,
+        pattern: new RegExp(`(?<=://|@)${PRIVATE_IP}(?![.\\d])|(?<![\\w.])${PRIVATE_IP}(?=:\\d{2,5}\\b)`, "g"),
         severity: "medium",
         confidence: "medium",
         remediation: "Replace with a public hostname resolved server-side, or remove the reference.",
     },
+    {
+        // A bare one is as often an example, a doc comment or a CIDR in a language grammar.
+        name: "Private IP literal",
+        pattern: new RegExp(`(?<![\\w.:@/])${PRIVATE_IP}(?![.\\d:])`, "g"),
+        severity: "low",
+        confidence: "low",
+        remediation: "If the client connects to this address, route it through a public endpoint instead.",
+    },
     {
         name: "Internal hostname",
         pattern: /\bhttps?:\/\/[a-z0-9.-]+\.(?:internal|local|corp|lan|intranet)(?::\d+)?\b/gi,

package/dist/rules/secret-like-string.js

@@ -9,7 +9,8 @@ const PROVIDERS = [
     { name: "Slack token", pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g, severity: "critical", confidence: "high", remediation: ROTATE },
     { name: "Anthropic API key", pattern: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g, severity: "critical", confidence: "high", remediation: ROTATE },
     { name: "OpenAI API key", pattern: /\bsk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{32,}\b/g, severity: "critical", confidence: "high", remediation: ROTATE },
-    { name: "Private key block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g, severity: "critical", confidence: "high", remediation: "Remove the key from the build and rotate it." },
+    // The header alone is how PEM-parsing code (jose, auth0-spa-js) checks its input; a real key has a base64 body.
+    { name: "Private key block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----(?:\\[rn]|\s)*[A-Za-z0-9+/=]{64,}/g, severity: "critical", confidence: "high", remediation: "Remove the key from the build and rotate it." },
     {
         name: "Google API key",
         pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
@@ -34,7 +35,9 @@ function isPublicName(name, context) {
 function looksLikeCredentialValue(value) {
     if (value.startsWith("--") || value.startsWith("./") || value.startsWith("/"))
         return false;
-    if (/^[a-z0-9]+(?:[.\-_/][a-z0-9]+)+$/i.test(value) && !/[0-9]/.test(value))
+    // Dotted or dashed identifiers made of words ("auth0.lock.getTokenSilently", "spacing.large.default")
+    // are keys and paths. Each segment is letters with at most trailing digits; tokens mix digits inside.
+    if (/^[A-Za-z]+\d*(?:[.\-_/:][A-Za-z]+\d*)+$/.test(value))
         return false;
     const classes = [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(value)).length;
     return classes >= 2 && shannonEntropy(value) >= MIN_NAMED_ENTROPY;
@@ -46,11 +49,12 @@ export const secretLikeString = {
     check(file, context) {
         const findings = [];
         const seen = new Set();
-        const push = (finding, key) => {
+        const push = (finding, key, raw) => {
             if (seen.has(key) || findings.length >= MAX_FINDINGS_PER_FILE)
                 return;
             seen.add(key);
             findings.push(finding);
+            context.onMatch?.(finding, raw);
         };
         for (const provider of PROVIDERS) {
             for (const match of file.text.matchAll(provider.pattern)) {
@@ -65,7 +69,7 @@ export const secretLikeString = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: redact(value) }],
                     remediation: provider.remediation,
                     helpUri: helpUri(secretLikeString.id),
-                }, `${provider.name}:${value}`);
+                }, `${provider.name}:${value}`, value);
             }
         }
         for (const match of file.text.matchAll(JWT)) {
@@ -85,7 +89,7 @@ export const secretLikeString = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: redact(token) }],
                     remediation: "Rotate the service role key in Supabase and use the anon key in the browser.",
                     helpUri: helpUri(secretLikeString.id),
-                }, `jwt:${token}`);
+                }, `jwt:${token}`, token);
             }
             else if (role === null) {
                 // Not a Supabase anon/authenticated token; unknown JWTs in a bundle
@@ -99,7 +103,7 @@ export const secretLikeString = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: redact(token) }],
                     remediation: "Confirm the token is not a live credential. Tokens belong in responses, not bundles.",
                     helpUri: helpUri(secretLikeString.id),
-                }, `jwt:${token}`);
+                }, `jwt:${token}`, token);
             }
         }
         for (const match of file.text.matchAll(NAMED_VALUE)) {
@@ -121,7 +125,7 @@ export const secretLikeString = {
                 evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: `${name} = ${redact(value)}` }],
                 remediation: "If this is a real credential, rotate it and move the call server-side. If it is public by design, rename it with your framework's public prefix.",
                 helpUri: helpUri(secretLikeString.id),
-            }, `named:${name}:${value}`);
+            }, `named:${name}:${value}`, value);
         }
         return findings;
     },

package/dist/rules/sensitive-env-name.js

@@ -18,6 +18,9 @@ export function looksLikeSecretValue(value) {
         return false;
     if (/^[A-Z0-9_]+$/.test(value))
         return false;
+    // Protocol identifiers and URLs (urn:ietf:params:oauth:grant-type:…), and anything with spaces, are constants or prose.
+    if (/^(?:urn|https?|wss?|mailto|data):/i.test(value) || /\s/.test(value))
+        return false;
     const classes = [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(value)).length;
     return classes >= 2;
 }
@@ -42,7 +45,7 @@ export const sensitiveEnvName = {
                 if (seen.has(key))
                     continue;
                 seen.add(key);
-                findings.push({
+                const finding = {
                     ruleId: sensitiveEnvName.id,
                     layer: "artifact",
                     severity: "high",
@@ -51,7 +54,9 @@ export const sensitiveEnvName = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: `${name} = ${redact(value)}` }],
                     remediation: "Server-only configuration must not be bundled. Read it on the server and expose only what the client needs.",
                     helpUri: helpUri(sensitiveEnvName.id),
-                });
+                };
+                findings.push(finding);
+                context.onMatch?.(finding, value);
                 continue;
             }
             if (!BARE_NAME_KEYWORDS.has(keyword))