evershield 0.2.0 → 0.3.0

package/README.md

@@ -42,6 +42,12 @@ npx evershield scan ./dist --format json --fail-on medium --min-confidence low
 
 # SARIF for code scanning, written to a file
 npx evershield scan ./dist --format sarif --output evershield.sarif
+
+# mobile and desktop app packages: everything inside ships to the device
+npx evershield scan app-release.apk   # Android (.apk, .aab), incl. Hermes bytecode and DEX strings
+npx evershield scan MyApp.ipa         # iOS: main.jsbundle and the app executable's strings
+npx evershield scan app.asar          # Electron
+npx evershield scan ./dist            # an Expo / React Native export (*.hbc, *.bundle)
 ```
 
 Exit code `0` means nothing blocking, `1` means findings at or above the
@@ -57,6 +63,37 @@ confidence, is in [docs/rules.md](docs/rules.md):
 - `artifact/sensitive-env-name`: `SERVICE_ROLE`, `*_SECRET`, `DATABASE_URL`, …
 - `artifact/internal-endpoint`: private IPs, `.internal` hosts, dev fallbacks
 
+## Leave reverse engineers empty-handed
+
+Tools like [REA](https://github.com/morluto/rea) cannot be blocked: they run
+in the attacker's own browser, on their own copy of your app. What you
+control is what they get. `recon` shows it from their side and fails the
+build while anything is worth taking:
+
+```bash
+npx evershield recon ./dist               # or an .apk, .ipa, .asar
+npx evershield recon ./dist --rea         # also run REA itself and check each finding against its output
+```
+
+```
+Worth taking: 2 blocking, 3 total
+✖ [critical/high] Stripe secret key shipped in assets/index.js  · REA: recovered
+✖ [high/high] Source map shipped: assets/index.js.map  · REA: not checked
+• [medium/medium] Private IP address in assets/index.js: 10.0.3.7  · REA: recovered
+
+Map (informational: any tool reconstructs this from shipped code; keep server-side checks on it)
+  hosts: api.example.com (12)
+  API paths: /api/report, /api/user
+  source maps: 1 file(s), 2 original source(s), 2 with full content
+
+Verdict: 2 item(s) worth taking. Anyone running a reverse-engineering tool on this target gets them.
+```
+
+The map is what no build can hide (routes, hosts, field names); recon lists
+it so you know which endpoints need server-side authorization. With `--rea`,
+values are compared in memory and never printed. Pair it with `audit` and
+`surface` for what each plan receives at runtime.
+
 ## Audit what each plan actually receives
 
 Layer 2 calls your own API as each identity you configure and compares the
@@ -195,6 +232,30 @@ evershield refuses a config whose ignores have no `reason`, and reports how
 many findings the config removed. Details in
 [docs/configuration.md](docs/configuration.md).
 
+## Measured on real code
+
+Every rule change runs against a [false-positive corpus](docs/corpus.md): 42
+pinned npm packages that ship to browsers (React, Vue, Firebase, Supabase,
+Auth0, Sentry, Stripe.js, PostHog, three.js, pdf.js and more) plus 10 default
+apps from Next.js, Vite, SvelteKit, Astro and Expo (Hermes bytecode)
+generators, built as deployed. **False positives at the default gate: 0**
+across 8,886 files and 175 MiB.
+The one blocking finding is a true positive (a development build with an
+inline source map). The first run found 8 false positives, all in
+auth0-spa-js; fixing them is how the rules got here.
+
+## Tested against REA
+
+[experiments/rea](experiments/rea/README.md) points
+[REA](https://github.com/morluto/rea) at a deliberately leaky app and at the
+same app fixed with evershield. REA recovered all five leaks from the leaky
+build (a secret key, an internal address, source via source maps, blurred
+Pro data in the DOM, Pro fields in a free response); evershield flagged all
+five; after the fix REA recovered none and evershield reported nothing.
+evershield does not hide your app from REA. It makes sure there is nothing
+in it worth taking, and `evershield recon --rea` checks that against REA
+itself on every build.
+
 ## Principles
 
 - **Defensive only.** It audits targets you own, listed in your config.

package/dist/cli.js

@@ -4,6 +4,8 @@ import { parseArgs } from "node:util";
 import { runAudit } from "./audit/run.js";
 import { applyIgnores, ConfigError, loadConfig } from "./config.js";
 import { runInit } from "./init.js";
+import { runRecon } from "./recon.js";
+import { renderReconJson, renderReconSarif, renderReconText } from "./report/recon.js";
 import { runSurface } from "./surface/run.js";
 import { VERSION } from "./index.js";
 import { CONFIDENCES, DEFAULT_GATE, isBlocking, renderJson, renderText, SEVERITIES } from "./report/index.js";
@@ -16,7 +18,14 @@ Shield everything, everywhere.
 Usage:
   evershield init [--force]         Detect your framework and write evershield.config.json
                                     and a GitHub workflow that scans every pull request
-  evershield scan <dir> [options]   Layer 1: scan a built web artifact directory
+  evershield scan <dir|app> [options]
+                                    Layer 1: scan a built web directory, or an app package
+                                    (.apk, .aab, .ipa, Electron .asar)
+  evershield recon <dir|app> [--rea] [--rea-bin <path>]
+                                    The attacker's view: what reverse-engineering tools such
+                                    as REA recover from a build or app package. Fails when
+                                    anything is worth taking; --rea checks each finding
+                                    against REA's own output
   evershield audit [options]        Layer 2: call configured endpoints as each identity
                                     and compare what they receive (needs config "audit")
   evershield surface [options]      Layer 3: open configured pages as each identity in a
@@ -148,6 +157,8 @@ export async function run(argv) {
             return failure("init", error);
         }
     }
+    if (command === "recon")
+        return reconCommand(rest);
     if (command !== "scan" && command !== "audit" && command !== "surface") {
         return usageError(`unknown command "${command}"`);
     }
@@ -211,3 +222,49 @@ export async function run(argv) {
         return failure("audit", error);
     }
 }
+async function reconCommand(rest) {
+    const args = [...rest];
+    let reaBin;
+    const reaAt = args.indexOf("--rea");
+    if (reaAt >= 0) {
+        args.splice(reaAt, 1);
+        reaBin = "rea";
+    }
+    const binAt = args.indexOf("--rea-bin");
+    if (binAt >= 0) {
+        const value = args[binAt + 1];
+        if (value === undefined || value.startsWith("--"))
+            return usageError("recon: --rea-bin needs a path");
+        args.splice(binAt, 2);
+        reaBin = value;
+    }
+    const options = parseCommonOptions(args);
+    if ("code" in options)
+        return options;
+    const target = options.positionals[0];
+    if (target === undefined)
+        return usageError("recon: missing <dir|app>");
+    try {
+        const { config } = await loadConfig(options.configPath);
+        const gate = gateFor(options, config);
+        const result = await runRecon(target, {
+            ...(options.adapter === undefined ? {} : { adapter: options.adapter }),
+            ...(reaBin === undefined ? {} : { reaBin }),
+        });
+        const { kept, ignored } = applyIgnores(result.findings, config.ignore);
+        const keptSet = new Set(kept);
+        const filtered = { ...result, findings: kept, items: result.items.filter((item) => keptSet.has(item.finding)), ignored: ignored.length };
+        const blocking = kept.filter((finding) => isBlocking(finding, gate)).length;
+        // A requested REA check that could not run is not a pass.
+        const code = result.rea.status === "failed" ? 2 : blocking > 0 ? 1 : 0;
+        const rendered = options.format === "json" ? renderReconJson(filtered, gate) : options.format === "sarif" ? renderReconSarif(filtered, gate) : renderReconText(filtered, gate);
+        const stderr = result.rea.status === "failed" ? `evershield recon: ${result.rea.detail ?? "REA failed"}\n` : "";
+        if (options.outputPath === undefined)
+            return { code, stdout: rendered, stderr };
+        await writeFile(path.resolve(options.outputPath), rendered);
+        return { code, stdout: `evershield recon: ${filtered.items.length} item(s), ${blocking} blocking · ${options.format} report written to ${options.outputPath}\n`, stderr };
+    }
+    catch (error) {
+        return failure("recon", error);
+    }
+}

package/dist/index.d.ts

@@ -5,7 +5,7 @@
  * every layer reports in, so CLI, GitHub Action and MCP surfaces can share
  * one finding model from day one. See docs/design.md for the rationale.
  */
-export declare const VERSION = "0.2.0";
+export declare const VERSION = "0.3.0";
 /** How sure evershield is that a finding is real. Drives exit codes and CI gating. */
 export type Confidence = "high" | "medium" | "low";
 /** How bad it is if the finding is real. */

package/dist/index.js

@@ -5,4 +5,4 @@
  * every layer reports in, so CLI, GitHub Action and MCP surfaces can share
  * one finding model from day one. See docs/design.md for the rationale.
  */
-export const VERSION = "0.2.0";
+export const VERSION = "0.3.0";

package/dist/recon.d.ts

@@ -0,0 +1,53 @@
+import type { Finding } from "./index.ts";
+import { type CollectedTarget } from "./scan/artifact.ts";
+import type { ScannedFile } from "./scan/files.ts";
+export type ReconCategory = "credential" | "source" | "internal-address" | "other";
+export interface ReconItem {
+    category: ReconCategory;
+    finding: Finding;
+    /** true: REA's output contains the value; false: it does not; null: not checked. */
+    reaRecovered: boolean | null;
+}
+export interface ReconMap {
+    /** Hosts referenced by absolute URLs, most frequent first. */
+    hosts: Array<{
+        host: string;
+        count: number;
+    }>;
+    /** API-looking paths in string literals. */
+    apiPaths: string[];
+    sourceMaps: {
+        files: number;
+        originalSources: number;
+        withContent: number;
+    };
+    /** Framework-public env names still present in the output. */
+    publicEnvNames: string[];
+}
+export interface ReconRea {
+    status: "not-run" | "ran" | "skipped" | "failed";
+    detail?: string;
+}
+export interface ReconResult {
+    version: string;
+    layer: "recon";
+    target: string;
+    adapter: CollectedTarget["adapterName"];
+    filesScanned: number;
+    startedAt: string;
+    finishedAt: string;
+    items: ReconItem[];
+    /** The same findings, for the gate, ignores and SARIF. */
+    findings: Finding[];
+    ignored: number;
+    map: ReconMap;
+    rea: ReconRea;
+}
+export interface ReconOptions {
+    adapter?: "nextjs" | "plain";
+    /** Run REA's static analyzer; the executable name or path. */
+    reaBin?: string;
+    reaTimeoutMs?: number;
+}
+export declare function buildMap(files: ScannedFile[]): ReconMap;
+export declare function runRecon(target: string, options?: ReconOptions): Promise<ReconResult>;

package/dist/recon.js

@@ -0,0 +1,160 @@
+/**
+ * `evershield recon`: the attacker's view of a build or app package.
+ *
+ * Reverse-engineering tools such as REA cannot be blocked: they run in the
+ * attacker's own browser or on their own copy of the app. What can be
+ * controlled is what they get. recon lists it in two parts:
+ *
+ * - **Worth taking**: findings an attacker can use directly (credentials,
+ *   original source, internal addresses). The gate applies to these, so a
+ *   passing recon means the tools come back empty-handed.
+ * - **Map**: what any tool reconstructs from shipped code no matter what
+ *   (hosts, API paths, source map coverage, public env names). Informational:
+ *   it is the attack surface to keep server-side checks on.
+ *
+ * With `--rea`, REA's static JavaScript analyzer runs on the same target and
+ * each finding's unredacted value is looked up in REA's output, in memory
+ * only, to show whether the tool actually recovers it.
+ */
+import { execFile } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { VERSION } from "./index.js";
+import { collectTarget, runArtifactRules } from "./scan/artifact.js";
+function categorize(finding) {
+    if (finding.ruleId === "artifact/source-map-published")
+        return "source";
+    if (finding.ruleId === "artifact/internal-endpoint")
+        return "internal-address";
+    if (finding.ruleId === "artifact/secret-like-string" || finding.ruleId === "artifact/sensitive-env-name")
+        return "credential";
+    return "other";
+}
+const URL_HOST = /\bhttps?:\/\/((?:[a-z0-9-]+\.)+[a-z]{2,}|localhost|\d{1,3}(?:\.\d{1,3}){3})(?::\d{2,5})?/gi;
+const API_PATH = /["'`](\/(?:api|graphql|rest|rpc|trpc|admin|internal|v\d+)(?:\/[\w\-.:{}$]*)*)(?=["'`?])/g;
+const PUBLIC_ENV = /\b(?:NEXT_PUBLIC|VITE|PUBLIC|REACT_APP|NUXT_PUBLIC|EXPO_PUBLIC|GATSBY|VUE_APP)_[A-Z0-9_]{2,}\b/g;
+const INLINE_MAP = /sourceMappingURL=data:application\/json[^,]*;base64,([A-Za-z0-9+/=]+)/g;
+function countSources(json, into) {
+    try {
+        const map = JSON.parse(json);
+        into.files += 1;
+        into.originalSources += Array.isArray(map.sources) ? map.sources.length : 0;
+        into.withContent += Array.isArray(map.sourcesContent) ? map.sourcesContent.filter((content) => typeof content === "string").length : 0;
+    }
+    catch {
+        // Not a parseable map; the source-map rule still reports the file.
+    }
+}
+export function buildMap(files) {
+    const hosts = new Map();
+    const apiPaths = new Set();
+    const publicEnvNames = new Set();
+    const sourceMaps = { files: 0, originalSources: 0, withContent: 0 };
+    for (const file of files) {
+        if (file.relativePath.endsWith(".map")) {
+            countSources(file.text, sourceMaps);
+            continue;
+        }
+        for (const match of file.text.matchAll(URL_HOST)) {
+            const host = match[1].toLowerCase();
+            hosts.set(host, (hosts.get(host) ?? 0) + 1);
+        }
+        for (const match of file.text.matchAll(API_PATH))
+            if (apiPaths.size < 200)
+                apiPaths.add(match[1]);
+        for (const match of file.text.matchAll(PUBLIC_ENV))
+            publicEnvNames.add(match[0]);
+        for (const match of file.text.matchAll(INLINE_MAP))
+            countSources(Buffer.from(match[1], "base64").toString("utf8"), sourceMaps);
+    }
+    return {
+        hosts: [...hosts.entries()].sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1)).slice(0, 50).map(([host, count]) => ({ host, count })),
+        apiPaths: [...apiPaths].sort(),
+        sourceMaps,
+        publicEnvNames: [...publicEnvNames].sort(),
+    };
+}
+/**
+ * npm installs `rea` on Windows as `rea.cmd`, which only a shell can run, so
+ * Windows goes through cmd.exe with every argument quoted.
+ */
+function reaInvocation(bin, args) {
+    if (process.platform !== "win32")
+        return { file: bin, args, shell: false };
+    const quote = (value) => `"${value.replace(/"/g, '""')}"`;
+    return { file: quote(bin), args: args.map(quote), shell: true };
+}
+function runRea(bin, target, timeoutMs) {
+    const notFound = `"${bin}" not found; install REA (npm install --global rea-agents) or pass --rea-bin <path>`;
+    // A path that does not exist is caught here, without relying on shell messages that are localized.
+    if (/[\\/]/.test(bin) && !existsSync(bin))
+        return Promise.resolve({ ok: false, detail: notFound });
+    const invocation = reaInvocation(bin, ["analyze-javascript-application", target, "--format", "json"]);
+    return new Promise((resolve) => {
+        execFile(invocation.file, invocation.args, { maxBuffer: 1024 * 1024 * 1024, timeout: timeoutMs, env: { ...process.env, NO_COLOR: "1" }, shell: invocation.shell }, (error, stdout, stderr) => {
+            // cmd.exe exits 9009 for a command it cannot find, in every locale; its message is localized.
+            // execFile puts the errno string or the exit code number in `code`.
+            const code = error?.code;
+            const missing = code === "ENOENT" || (invocation.shell && code === 9009);
+            if (error !== null && missing) {
+                resolve({ ok: false, detail: notFound });
+            }
+            else if (error !== null && stdout.length === 0) {
+                resolve({ ok: false, detail: `REA failed: ${(stderr || error.message).trim().split("\n")[0]}` });
+            }
+            else {
+                resolve({ ok: true, output: stdout });
+            }
+        });
+    });
+}
+export async function runRecon(target, options = {}) {
+    const startedAt = new Date().toISOString();
+    const collected = await collectTarget(target, options.adapter === undefined ? {} : { adapter: options.adapter });
+    // Unredacted values stay in this map and are only compared, never written.
+    const raw = new Map();
+    const findings = runArtifactRules(collected.files, collected.adapter, (finding, value) => raw.set(finding, value));
+    let rea = { status: "not-run" };
+    let reaOutput = null;
+    if (options.reaBin !== undefined) {
+        const isAsar = collected.adapterName === "electron";
+        if (collected.adapterName === "android" || collected.adapterName === "ios") {
+            rea = { status: "skipped", detail: "REA's JavaScript analyzer takes a directory or an .asar; scan the extracted bundle directory with --rea" };
+        }
+        else {
+            const result = await runRea(options.reaBin, isAsar ? collected.root : path.resolve(collected.root), options.reaTimeoutMs ?? 600_000);
+            if (result.ok) {
+                rea = { status: "ran" };
+                reaOutput = result.output;
+            }
+            else {
+                rea = { status: "failed", detail: result.detail };
+            }
+        }
+    }
+    const items = findings.map((finding) => {
+        const category = categorize(finding);
+        let reaRecovered = null;
+        if (reaOutput !== null && category !== "source") {
+            const first = finding.evidence[0];
+            const value = raw.get(finding) ?? (category === "internal-address" && first?.kind === "file" ? first.excerpt : undefined);
+            if (value !== undefined)
+                reaRecovered = reaOutput.includes(value) || reaOutput.includes(JSON.stringify(value).slice(1, -1));
+        }
+        return { category, finding, reaRecovered };
+    });
+    return {
+        version: VERSION,
+        layer: "recon",
+        target: collected.root,
+        adapter: collected.adapterName,
+        filesScanned: collected.files.length,
+        startedAt,
+        finishedAt: new Date().toISOString(),
+        items,
+        findings,
+        ignored: 0,
+        map: buildMap(collected.files),
+        rea,
+    };
+}

package/dist/report/recon.d.ts

@@ -0,0 +1,5 @@
+import type { ReconResult } from "../recon.ts";
+import { type Gate } from "./index.ts";
+export declare function renderReconText(result: ReconResult, gate: Gate): string;
+export declare function renderReconJson(result: ReconResult, gate: Gate): string;
+export declare function renderReconSarif(result: ReconResult, gate: Gate): string;

package/dist/report/recon.js

@@ -0,0 +1,71 @@
+import { isBlocking } from "./index.js";
+import { renderSarif } from "./sarif.js";
+const KIND = {
+    nextjs: "Next.js build",
+    plain: "build directory",
+    android: "Android package",
+    ios: "iOS package",
+    electron: "Electron archive",
+};
+function reaLabel(item, ran) {
+    if (!ran)
+        return "";
+    if (item.reaRecovered === true)
+        return "  · REA: recovered";
+    if (item.reaRecovered === false)
+        return "  · REA: not in its output";
+    return "  · REA: not checked";
+}
+function list(values, max) {
+    if (values.length === 0)
+        return "none";
+    const shown = values.slice(0, max).join(", ");
+    return values.length > max ? `${shown}, … (${values.length} total)` : shown;
+}
+export function renderReconText(result, gate) {
+    const ran = result.rea.status === "ran";
+    const blocking = result.items.filter((item) => isBlocking(item.finding, gate));
+    const lines = [
+        `evershield ${result.version} · recon · ${KIND[result.adapter]} · ${result.filesScanned} files`,
+        `target: ${result.target}`,
+        "What reverse-engineering tools recover from this target.",
+        "",
+        `Worth taking: ${blocking.length} blocking, ${result.items.length} total${result.ignored > 0 ? ` (${result.ignored} ignored by config)` : ""}`,
+    ];
+    for (const item of result.items) {
+        const first = item.finding.evidence[0];
+        lines.push(`${isBlocking(item.finding, gate) ? "✖" : "•"} [${item.finding.severity}/${item.finding.confidence}] ${item.finding.message}${reaLabel(item, ran)}`);
+        if (first?.kind === "file")
+            lines.push(`    at ${first.line === undefined ? first.path : `${first.path}:${first.line}:${first.column ?? 1}`}`);
+        if (item.finding.remediation !== undefined)
+            lines.push(`    fix: ${item.finding.remediation}`);
+    }
+    const { map } = result;
+    lines.push("", "Map (informational: any tool reconstructs this from shipped code; keep server-side checks on it)", `  hosts: ${list(map.hosts.map((h) => `${h.host} (${h.count})`), 8)}`, `  API paths: ${list(map.apiPaths, 12)}`, `  source maps: ${map.sourceMaps.files} file(s), ${map.sourceMaps.originalSources} original source(s), ${map.sourceMaps.withContent} with full content`, `  public env names: ${list(map.publicEnvNames, 8)}`, "", result.rea.status === "ran"
+        ? "REA: ran its static JavaScript analysis on the same target; each value above was looked up in its output (values are never printed)."
+        : result.rea.status === "not-run"
+            ? "REA: not run (add --rea to check each finding against REA's own output)."
+            : `REA: ${result.rea.status}: ${result.rea.detail ?? ""}`, "", blocking.length > 0
+        ? `Verdict: ${blocking.length} item(s) worth taking. Anyone running a reverse-engineering tool on this target gets them.`
+        : "Verdict: nothing worth taking at this gate. Tools still reconstruct the map above, and nothing more.");
+    return `${lines.join("\n")}\n`;
+}
+export function renderReconJson(result, gate) {
+    const blocking = result.findings.filter((finding) => isBlocking(finding, gate)).length;
+    const { findings: _findings, ...rest } = result;
+    return `${JSON.stringify({ ...rest, gate, blocking }, null, 2)}\n`;
+}
+export function renderReconSarif(result, gate) {
+    const artifact = {
+        version: result.version,
+        layer: "artifact",
+        target: result.target,
+        adapter: result.adapter,
+        filesScanned: result.filesScanned,
+        ignored: result.ignored,
+        startedAt: result.startedAt,
+        finishedAt: result.finishedAt,
+        findings: result.findings,
+    };
+    return renderSarif(artifact, gate);
+}

package/dist/rules/internal-endpoint.js

@@ -1,13 +1,24 @@
 import { lineColumn } from "../scan/text.js";
 import { helpUri, MAX_FINDINGS_PER_FILE } from "./types.js";
+const OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+const PRIVATE_IP = `(?:10\\.${OCTET}\\.${OCTET}\\.${OCTET}|192\\.168\\.${OCTET}\\.${OCTET}|172\\.(?:1[6-9]|2\\d|3[01])\\.${OCTET}\\.${OCTET})`;
 const PATTERNS = [
     {
+        // In a URL or with a port, a private IP is an address the code talks to.
         name: "Private IP address",
-        pattern: /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})\b/g,
+        pattern: new RegExp(`(?<=://|@)${PRIVATE_IP}(?![.\\d])|(?<![\\w.])${PRIVATE_IP}(?=:\\d{2,5}\\b)`, "g"),
         severity: "medium",
         confidence: "medium",
         remediation: "Replace with a public hostname resolved server-side, or remove the reference.",
     },
+    {
+        // A bare one is as often an example, a doc comment or a CIDR in a language grammar.
+        name: "Private IP literal",
+        pattern: new RegExp(`(?<![\\w.:@/])${PRIVATE_IP}(?![.\\d:])`, "g"),
+        severity: "low",
+        confidence: "low",
+        remediation: "If the client connects to this address, route it through a public endpoint instead.",
+    },
     {
         name: "Internal hostname",
         pattern: /\bhttps?:\/\/[a-z0-9.-]+\.(?:internal|local|corp|lan|intranet)(?::\d+)?\b/gi,

package/dist/rules/secret-like-string.js

@@ -9,7 +9,8 @@ const PROVIDERS = [
     { name: "Slack token", pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g, severity: "critical", confidence: "high", remediation: ROTATE },
     { name: "Anthropic API key", pattern: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g, severity: "critical", confidence: "high", remediation: ROTATE },
     { name: "OpenAI API key", pattern: /\bsk-(?!ant-)(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{32,}\b/g, severity: "critical", confidence: "high", remediation: ROTATE },
-    { name: "Private key block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g, severity: "critical", confidence: "high", remediation: "Remove the key from the build and rotate it." },
+    // The header alone is how PEM-parsing code (jose, auth0-spa-js) checks its input; a real key has a base64 body.
+    { name: "Private key block", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----(?:\\[rn]|\s)*[A-Za-z0-9+/=]{64,}/g, severity: "critical", confidence: "high", remediation: "Remove the key from the build and rotate it." },
     {
         name: "Google API key",
         pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
@@ -34,7 +35,9 @@ function isPublicName(name, context) {
 function looksLikeCredentialValue(value) {
     if (value.startsWith("--") || value.startsWith("./") || value.startsWith("/"))
         return false;
-    if (/^[a-z0-9]+(?:[.\-_/][a-z0-9]+)+$/i.test(value) && !/[0-9]/.test(value))
+    // Dotted or dashed identifiers made of words ("auth0.lock.getTokenSilently", "spacing.large.default")
+    // are keys and paths. Each segment is letters with at most trailing digits; tokens mix digits inside.
+    if (/^[A-Za-z]+\d*(?:[.\-_/:][A-Za-z]+\d*)+$/.test(value))
         return false;
     const classes = [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(value)).length;
     return classes >= 2 && shannonEntropy(value) >= MIN_NAMED_ENTROPY;
@@ -46,11 +49,12 @@ export const secretLikeString = {
     check(file, context) {
         const findings = [];
         const seen = new Set();
-        const push = (finding, key) => {
+        const push = (finding, key, raw) => {
             if (seen.has(key) || findings.length >= MAX_FINDINGS_PER_FILE)
                 return;
             seen.add(key);
             findings.push(finding);
+            context.onMatch?.(finding, raw);
         };
         for (const provider of PROVIDERS) {
             for (const match of file.text.matchAll(provider.pattern)) {
@@ -65,7 +69,7 @@ export const secretLikeString = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: redact(value) }],
                     remediation: provider.remediation,
                     helpUri: helpUri(secretLikeString.id),
-                }, `${provider.name}:${value}`);
+                }, `${provider.name}:${value}`, value);
             }
         }
         for (const match of file.text.matchAll(JWT)) {
@@ -85,7 +89,7 @@ export const secretLikeString = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: redact(token) }],
                     remediation: "Rotate the service role key in Supabase and use the anon key in the browser.",
                     helpUri: helpUri(secretLikeString.id),
-                }, `jwt:${token}`);
+                }, `jwt:${token}`, token);
             }
             else if (role === null) {
                 // Not a Supabase anon/authenticated token; unknown JWTs in a bundle
@@ -99,7 +103,7 @@ export const secretLikeString = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: redact(token) }],
                     remediation: "Confirm the token is not a live credential. Tokens belong in responses, not bundles.",
                     helpUri: helpUri(secretLikeString.id),
-                }, `jwt:${token}`);
+                }, `jwt:${token}`, token);
             }
         }
         for (const match of file.text.matchAll(NAMED_VALUE)) {
@@ -121,7 +125,7 @@ export const secretLikeString = {
                 evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: `${name} = ${redact(value)}` }],
                 remediation: "If this is a real credential, rotate it and move the call server-side. If it is public by design, rename it with your framework's public prefix.",
                 helpUri: helpUri(secretLikeString.id),
-            }, `named:${name}:${value}`);
+            }, `named:${name}:${value}`, value);
         }
         return findings;
     },

package/dist/rules/sensitive-env-name.js

@@ -18,6 +18,9 @@ export function looksLikeSecretValue(value) {
         return false;
     if (/^[A-Z0-9_]+$/.test(value))
         return false;
+    // Protocol identifiers and URLs (urn:ietf:params:oauth:grant-type:…), and anything with spaces, are constants or prose.
+    if (/^(?:urn|https?|wss?|mailto|data):/i.test(value) || /\s/.test(value))
+        return false;
     const classes = [/[a-z]/, /[A-Z]/, /[0-9]/].filter((re) => re.test(value)).length;
     return classes >= 2;
 }
@@ -42,7 +45,7 @@ export const sensitiveEnvName = {
                 if (seen.has(key))
                     continue;
                 seen.add(key);
-                findings.push({
+                const finding = {
                     ruleId: sensitiveEnvName.id,
                     layer: "artifact",
                     severity: "high",
@@ -51,7 +54,9 @@ export const sensitiveEnvName = {
                     evidence: [{ kind: "file", path: file.relativePath, line, column, excerpt: `${name} = ${redact(value)}` }],
                     remediation: "Server-only configuration must not be bundled. Read it on the server and expose only what the client needs.",
                     helpUri: helpUri(sensitiveEnvName.id),
-                });
+                };
+                findings.push(finding);
+                context.onMatch?.(finding, value);
                 continue;
             }
             if (!BARE_NAME_KEYWORDS.has(keyword))

package/dist/rules/types.d.ts

@@ -5,6 +5,12 @@ export interface RuleContext {
     adapter: Adapter;
     /** Every shipped file's relative path, for cross-file checks such as source map references. */
     shippedPaths: ReadonlySet<string>;
+    /**
+     * Called with the unredacted value behind a finding, for in-process
+     * cross-checks such as `evershield recon --rea`. The value must never be
+     * stored on the finding or written anywhere.
+     */
+    onMatch?: (finding: Finding, raw: string) => void;
 }
 /**
  * A rule inspects one file and returns findings with evidence. The doc

package/dist/scan/archive.d.ts

@@ -0,0 +1,22 @@
+import type { ScannedFile } from "./files.ts";
+export type ArchiveKind = "android" | "ios" | "electron";
+export declare function archiveKind(file: string, head: Buffer): ArchiveKind | null;
+/** Printable runs of at least `min` characters, ASCII/UTF-8 and UTF-16LE (Android string pools). */
+export declare function extractStrings(buffer: Buffer, min?: number): string[];
+/**
+ * Hermes keeps every string literal and identifier in one storage blob with
+ * no separators, so a plain strings pass glues neighbours together and a key
+ * loses its word boundaries. Read the string table instead. The header is
+ * 128 bytes; the counts sit at fixed offsets; the sections that follow are
+ * 4-byte aligned. Function headers are 12 bytes in current versions (99,
+ * Expo SDK 58) and 16 in older ones, so both layouts are tried and the one
+ * whose every entry fits inside the storage wins. Returns null when neither
+ * does, and the caller falls back to a plain strings pass.
+ */
+export declare function hermesStrings(buffer: Buffer): string[] | null;
+/** Turn one archive entry, or a loose file from an extracted app, into what rules read. */
+export declare function toScanned(name: string, data: Buffer, location: string): ScannedFile | null;
+export declare function collectArchive(file: string): Promise<{
+    kind: ArchiveKind;
+    files: ScannedFile[];
+}>;

package/dist/scan/archive.js

@@ -0,0 +1,247 @@
+/**
+ * Packaged apps as artifacts: Android (.apk, .aab), iOS (.ipa) and Electron
+ * (.asar). Everything inside ships to the user's device, so everything a
+ * rule can read is scanned. No dependencies: zip is parsed here and inflated
+ * with node:zlib; ASAR is a JSON header followed by file bytes.
+ *
+ * Text entries are decoded as UTF-8. Binary entries that carry the strings an
+ * attacker would read (Hermes bytecode, DEX, compiled Android XML and
+ * resources, binary plists, Mach-O executables) are reduced to their
+ * printable strings, one per line, so the same rules apply; a finding's
+ * line is then the string's index, and its path ends in " (strings)".
+ */
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { inflateRawSync } from "node:zlib";
+const MAX_ARCHIVE_BYTES = 1024 * 1024 * 1024;
+const MAX_ENTRY_BYTES = 100 * 1024 * 1024;
+const TEXT_ENTRY = /\.(?:m?js|cjs|jsx|ts|tsx|json|html?|css|xml|plist|txt|svg|map|bundle|jsbundle|webmanifest|properties|strings)$/i;
+/** Binary formats whose string tables hold what developers embed: keys, URLs, config. */
+const STRINGS_ENTRY = /(?:\.(?:dex|hbc|arsc|bundle|jsbundle|plist)$|(?:^|\/)AndroidManifest\.xml$)/i;
+const SKIP_ENTRY = /\.(?:png|jpe?g|gif|webp|ico|ttf|otf|woff2?|mp3|mp4|ogg|wav|so|dylib|car|nib|storyboardc|RSA|DSA|EC|SF|MF)$|(?:^|\/)(?:META-INF\/|_CodeSignature\/)/i;
+/** Hermes bytecode magic, little-endian 0x1F1903C103BC1FC6. */
+const HERMES_MAGIC = Buffer.from([0xc6, 0x1f, 0xbc, 0x03, 0xc1, 0x03, 0x19, 0x1f]);
+export function archiveKind(file, head) {
+    const ext = path.extname(file).toLowerCase();
+    if (ext === ".asar")
+        return "electron";
+    if (head.length < 4 || head.readUInt32LE(0) !== 0x04034b50)
+        return null;
+    if (ext === ".ipa")
+        return "ios";
+    if (ext === ".apk" || ext === ".aab" || ext === ".xapk")
+        return "android";
+    return null;
+}
+function zipEntries(buffer) {
+    // End of central directory: last 22..65557 bytes.
+    let eocd = -1;
+    for (let i = buffer.length - 22; i >= Math.max(0, buffer.length - 65557); i -= 1) {
+        if (buffer.readUInt32LE(i) === 0x06054b50) {
+            eocd = i;
+            break;
+        }
+    }
+    if (eocd < 0)
+        throw new Error("not a zip archive (no end of central directory)");
+    const count = buffer.readUInt16LE(eocd + 10);
+    let offset = buffer.readUInt32LE(eocd + 16);
+    const entries = [];
+    for (let i = 0; i < count; i += 1) {
+        if (buffer.readUInt32LE(offset) !== 0x02014b50)
+            throw new Error("corrupt zip central directory");
+        const method = buffer.readUInt16LE(offset + 10);
+        const compressed = buffer.readUInt32LE(offset + 20);
+        const size = buffer.readUInt32LE(offset + 24);
+        const nameLength = buffer.readUInt16LE(offset + 28);
+        const extraLength = buffer.readUInt16LE(offset + 30);
+        const commentLength = buffer.readUInt16LE(offset + 32);
+        const local = buffer.readUInt32LE(offset + 42);
+        const name = buffer.toString("utf8", offset + 46, offset + 46 + nameLength);
+        offset += 46 + nameLength + extraLength + commentLength;
+        if (name.endsWith("/") || size > MAX_ENTRY_BYTES || compressed === 0xffffffff)
+            continue;
+        entries.push({
+            name,
+            read() {
+                const start = local + 30 + buffer.readUInt16LE(local + 26) + buffer.readUInt16LE(local + 28);
+                const data = buffer.subarray(start, start + compressed);
+                if (method === 0)
+                    return data;
+                if (method === 8)
+                    return inflateRawSync(data, { maxOutputLength: MAX_ENTRY_BYTES });
+                throw new Error(`unsupported zip compression method ${method} for ${name}`);
+            },
+        });
+    }
+    return entries;
+}
+function asarEntries(buffer) {
+    // Pickle: [u32 4][u32 headerPickleSize] then [u32 payload][u32 jsonLength][json…].
+    const headerSize = buffer.readUInt32LE(4);
+    const jsonLength = buffer.readUInt32LE(12);
+    const header = JSON.parse(buffer.toString("utf8", 16, 16 + jsonLength));
+    const base = 8 + headerSize;
+    const entries = [];
+    const walk = (node, prefix) => {
+        for (const [name, child] of Object.entries(node.files ?? {})) {
+            const full = prefix === "" ? name : `${prefix}/${name}`;
+            if (child.files !== undefined)
+                walk(child, full);
+            else if (child.offset !== undefined && child.size !== undefined && child.unpacked !== true && child.size <= MAX_ENTRY_BYTES) {
+                const start = base + Number(child.offset);
+                const size = child.size;
+                entries.push({ name: full, read: () => buffer.subarray(start, start + size) });
+            }
+        }
+    };
+    walk(header, "");
+    return entries;
+}
+/** Printable runs of at least `min` characters, ASCII/UTF-8 and UTF-16LE (Android string pools). */
+export function extractStrings(buffer, min = 6) {
+    const out = [];
+    const seen = new Set();
+    const add = (value) => {
+        if (value.length >= min && !seen.has(value)) {
+            seen.add(value);
+            out.push(value);
+        }
+    };
+    let start = -1;
+    for (let i = 0; i <= buffer.length; i += 1) {
+        const byte = i < buffer.length ? buffer[i] : 0;
+        const printable = (byte >= 0x20 && byte < 0x7f) || byte === 0x09;
+        if (printable && start < 0)
+            start = i;
+        if (!printable && start >= 0) {
+            add(buffer.toString("latin1", start, i));
+            start = -1;
+        }
+    }
+    // UTF-16LE: printable ASCII byte followed by 0x00, at either byte alignment.
+    for (const alignment of [0, 1]) {
+        let run = "";
+        for (let i = alignment; i + 1 < buffer.length; i += 2) {
+            const lo = buffer[i];
+            if (buffer[i + 1] === 0 && lo >= 0x20 && lo < 0x7f)
+                run += String.fromCharCode(lo);
+            else {
+                add(run);
+                run = "";
+            }
+        }
+        add(run);
+    }
+    return out;
+}
+/**
+ * Hermes keeps every string literal and identifier in one storage blob with
+ * no separators, so a plain strings pass glues neighbours together and a key
+ * loses its word boundaries. Read the string table instead. The header is
+ * 128 bytes; the counts sit at fixed offsets; the sections that follow are
+ * 4-byte aligned. Function headers are 12 bytes in current versions (99,
+ * Expo SDK 58) and 16 in older ones, so both layouts are tried and the one
+ * whose every entry fits inside the storage wins. Returns null when neither
+ * does, and the caller falls back to a plain strings pass.
+ */
+export function hermesStrings(buffer) {
+    if (buffer.length < 128)
+        return null;
+    const u32 = (offset) => buffer.readUInt32LE(offset);
+    const align = (value) => Math.ceil(value / 4) * 4;
+    const functionCount = u32(40);
+    const stringKindCount = u32(44);
+    const identifierCount = u32(48);
+    const stringCount = u32(52);
+    const overflowCount = u32(56);
+    const storageSize = u32(60);
+    for (const functionHeaderSize of [12, 16]) {
+        let offset = 128;
+        offset = align(offset + functionCount * functionHeaderSize);
+        offset = align(offset + stringKindCount * 4);
+        offset = align(offset + identifierCount * 4);
+        const small = offset;
+        offset = align(offset + stringCount * 4);
+        const overflow = offset;
+        offset = align(offset + overflowCount * 8);
+        const storage = offset;
+        if (storage + storageSize > buffer.length)
+            continue;
+        const strings = [];
+        let valid = true;
+        for (let i = 0; i < stringCount && valid; i += 1) {
+            const entry = u32(small + i * 4);
+            const utf16 = (entry & 1) === 1;
+            let start = (entry >>> 1) & 0x7fffff;
+            let length = entry >>> 24;
+            if (length === 255) {
+                if (start >= overflowCount) {
+                    valid = false;
+                    break;
+                }
+                const at = overflow + start * 8;
+                start = u32(at);
+                length = u32(at + 4);
+            }
+            const bytes = utf16 ? length * 2 : length;
+            if (start + bytes > storageSize)
+                valid = false;
+            else if (length > 0)
+                strings.push(buffer.toString(utf16 ? "utf16le" : "latin1", storage + start, storage + start + bytes));
+        }
+        if (valid)
+            return strings;
+    }
+    return null;
+}
+function looksBinary(buffer) {
+    const end = Math.min(buffer.length, 8192);
+    for (let i = 0; i < end; i += 1)
+        if (buffer[i] === 0)
+            return true;
+    return false;
+}
+/** Turn one archive entry, or a loose file from an extracted app, into what rules read. */
+export function toScanned(name, data, location) {
+    if (data.length === 0 || SKIP_ENTRY.test(name))
+        return null;
+    const isHermes = data.length >= 8 && data.subarray(0, 8).equals(HERMES_MAGIC);
+    if (!isHermes && TEXT_ENTRY.test(name) && !looksBinary(data)) {
+        return { absolutePath: location, relativePath: name, text: data.toString("utf8") };
+    }
+    if (isHermes || STRINGS_ENTRY.test(name) || isMainExecutable(name, data)) {
+        const strings = (isHermes ? hermesStrings(data) : null) ?? extractStrings(data);
+        // One string per line; a multi-line literal stays readable but cannot merge with its neighbour.
+        return { absolutePath: location, relativePath: `${name} (strings)`, text: strings.map((s) => s.replace(/\n/g, " ")).join("\n") };
+    }
+    return null;
+}
+/** The iOS app executable: Payload/Name.app/Name, a Mach-O file. */
+function isMainExecutable(name, data) {
+    const match = /^Payload\/([^/]+)\.app\/([^/]+)$/.exec(name);
+    if (match === null || match[1] !== match[2] || data.length < 4)
+        return false;
+    const magic = data.readUInt32LE(0);
+    return magic === 0xfeedfacf || magic === 0xfeedface || magic === 0xcafebabe || magic === 0xbebafeca;
+}
+export async function collectArchive(file) {
+    const info = await stat(file);
+    if (info.size > MAX_ARCHIVE_BYTES)
+        throw new Error(`${file} is larger than ${MAX_ARCHIVE_BYTES / 1024 / 1024} MiB`);
+    const buffer = await readFile(file);
+    const kind = archiveKind(file, buffer);
+    if (kind === null)
+        throw new Error(`not a supported app package (.apk, .aab, .ipa, .asar): ${file}`);
+    const entries = kind === "electron" ? asarEntries(buffer) : zipEntries(buffer);
+    const files = [];
+    for (const entry of entries) {
+        if (entry.name.split("/").includes("node_modules") && kind !== "electron")
+            continue;
+        const scanned = toScanned(entry.name, entry.read(), `${file}!/${entry.name}`);
+        if (scanned !== null)
+            files.push(scanned);
+    }
+    files.sort((a, b) => (a.relativePath < b.relativePath ? -1 : 1));
+    return { kind, files };
+}

package/dist/scan/artifact.d.ts

@@ -1,18 +1,34 @@
 import { type Finding, type ScanSummary } from "../index.ts";
+import type { RuleContext } from "../rules/types.ts";
 import { type Adapter } from "./adapters.ts";
+import { type ArchiveKind } from "./archive.ts";
+import { type ScannedFile } from "./files.ts";
 export interface ArtifactScanOptions {
     /** Force an adapter instead of detecting one from the directory. */
     adapter?: Adapter["name"];
+    /** See RuleContext.onMatch. */
+    onMatch?: RuleContext["onMatch"];
 }
 export interface ArtifactScanResult extends ScanSummary {
     layer: "artifact";
     target: string;
-    adapter: Adapter["name"];
+    /** Directory adapter, or the kind of app package scanned. */
+    adapter: Adapter["name"] | ArchiveKind;
     filesScanned: number;
     /** Findings removed by config ignore rules; they are not in `findings`. */
     ignored: number;
 }
 /** Worst first, then surest first, then by location so output is stable. */
 export declare function sortFindings(findings: Finding[]): Finding[];
-/** Layer 1: scan a directory of built files for what should not ship. */
+export interface CollectedTarget {
+    root: string;
+    adapter: Adapter;
+    /** Directory adapter, or the kind of app package. */
+    adapterName: ArtifactScanResult["adapter"];
+    files: ScannedFile[];
+}
+/** Read what a target ships: a build directory through its adapter, or an app package in memory. */
+export declare function collectTarget(target: string, options?: Pick<ArtifactScanOptions, "adapter">): Promise<CollectedTarget>;
+export declare function runArtifactRules(files: ScannedFile[], adapter: Adapter, onMatch?: RuleContext["onMatch"]): Finding[];
+/** Layer 1: scan a directory of built files, or an app package, for what should not ship. */
 export declare function scanArtifact(target: string, options?: ArtifactScanOptions): Promise<ArtifactScanResult>;

package/dist/scan/artifact.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { VERSION } from "../index.js";
 import { ARTIFACT_RULES } from "../rules/index.js";
 import { ADAPTERS, detectAdapter } from "./adapters.js";
+import { collectArchive } from "./archive.js";
 import { collectFiles } from "./files.js";
 const SEVERITY_RANK = {
     critical: 0,
@@ -34,35 +35,47 @@ export function sortFindings(findings) {
         return aLine - bLine;
     });
 }
-/** Layer 1: scan a directory of built files for what should not ship. */
-export async function scanArtifact(target, options = {}) {
-    const startedAt = new Date().toISOString();
+/** Read what a target ships: a build directory through its adapter, or an app package in memory. */
+export async function collectTarget(target, options = {}) {
     const root = path.resolve(target);
     const info = await stat(root).catch(() => null);
-    if (info === null || !info.isDirectory()) {
-        throw new Error(`not a directory: ${target}`);
+    if (info === null || (!info.isDirectory() && !info.isFile())) {
+        throw new Error(`not a directory or app package: ${target}`);
+    }
+    if (info.isFile()) {
+        // An app package ships everything inside it; there is nothing for a web adapter to filter.
+        const archive = await collectArchive(root);
+        return { root, adapter: ADAPTERS.plain, adapterName: archive.kind, files: archive.files };
     }
     const adapter = options.adapter ? ADAPTERS[options.adapter] : await detectAdapter(root);
-    const files = await collectFiles(root, adapter);
+    return { root, adapter, adapterName: adapter.name, files: await collectFiles(root, adapter) };
+}
+export function runArtifactRules(files, adapter, onMatch) {
     const context = {
         adapter,
         shippedPaths: new Set(files.map((file) => file.relativePath)),
+        ...(onMatch === undefined ? {} : { onMatch }),
     };
     const findings = [];
     for (const file of files) {
-        for (const rule of ARTIFACT_RULES) {
+        for (const rule of ARTIFACT_RULES)
             findings.push(...rule.check(file, context));
-        }
     }
+    return sortFindings(findings);
+}
+/** Layer 1: scan a directory of built files, or an app package, for what should not ship. */
+export async function scanArtifact(target, options = {}) {
+    const startedAt = new Date().toISOString();
+    const collected = await collectTarget(target, options);
     return {
         version: VERSION,
         layer: "artifact",
-        target: root,
-        adapter: adapter.name,
-        filesScanned: files.length,
+        target: collected.root,
+        adapter: collected.adapterName,
+        filesScanned: collected.files.length,
         ignored: 0,
         startedAt,
         finishedAt: new Date().toISOString(),
-        findings: sortFindings(findings),
+        findings: runArtifactRules(collected.files, collected.adapter, options.onMatch),
     };
 }

package/dist/scan/files.d.ts

@@ -11,6 +11,7 @@ export interface CollectOptions {
     /** Files larger than this are skipped; bundles rarely exceed it and maps can be huge. */
     maxBytes?: number;
 }
+export declare const PACKAGED: RegExp;
 export declare function toPosix(relative: string): string;
 /** Walk the root, keep what the adapter says the browser receives, read as UTF-8. */
 export declare function collectFiles(root: string, adapter: Adapter, options?: CollectOptions): Promise<ScannedFile[]>;

package/dist/scan/files.js

@@ -1,7 +1,9 @@
 import { readdir, readFile, stat } from "node:fs/promises";
 import path from "node:path";
+import { toScanned } from "./archive.js";
 const DEFAULT_MAX_BYTES = 25 * 1024 * 1024;
 const ALWAYS_SKIP_DIRS = new Set(["node_modules", ".git"]);
+export const PACKAGED = /\.(?:bundle|jsbundle|hbc|dex)$/i;
 /** Cheap binary check: a NUL byte in the first 8 KiB means not text. */
 function isProbablyBinary(buffer) {
     const end = Math.min(buffer.length, 8192);
@@ -26,6 +28,16 @@ export async function collectFiles(root, adapter, options = {}) {
         const relativePath = toPosix(path.relative(root, absolutePath));
         if (relativePath.split("/").some((segment) => ALWAYS_SKIP_DIRS.has(segment)))
             continue;
+        // React Native bundles and Android bytecode in an extracted app or a native build directory.
+        if (PACKAGED.test(relativePath)) {
+            const info = await stat(absolutePath);
+            if (info.size === 0 || info.size > maxBytes)
+                continue;
+            const scanned = toScanned(relativePath, await readFile(absolutePath), absolutePath);
+            if (scanned !== null)
+                files.push(scanned);
+            continue;
+        }
         if (!adapter.includes(relativePath))
             continue;
         const info = await stat(absolutePath);

package/dist/surface/rules.js

@@ -115,8 +115,12 @@ export const hiddenHigherTierContent = {
         return findings;
     },
 };
-/** Text that is obviously a decoy: masks, lorem ipsum, a single repeated character. */
-const PLACEHOLDER = /^(?:[\sxX*•●▒█#?·._,\-–—0]+|lorem ipsum.*|(.)\1+)$/i;
+/**
+ * Text that is obviously a decoy: masks, lorem ipsum, a single repeated
+ * character, or a label next to a mask ("Burstiness score ●●●●"), which is
+ * the fix this rule recommends.
+ */
+const PLACEHOLDER = /^(?:[\sxX*•●▒█#?·._,\-–—0]+|lorem ipsum.*|(.)\1+)$|[•●▒█*#]{3,}|\b[xX]{4,}\b/i;
 export const obscuredContent = {
     id: "surface/obscured-content",
     defaultSeverity: "high",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "evershield",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shield everything, everywhere: find what your web app exposes to the browser, in bundles, API responses and the rendered page",
   "license": "MIT",
   "author": "Lee Dongwook (@inviy)",
@@ -49,10 +49,11 @@
   "packageManager": "pnpm@10.28.0",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.scripts.json",
     "test": "node --experimental-strip-types --test \"src/**/*.test.ts\"",
     "check": "pnpm typecheck && pnpm test && pnpm build",
-    "prepublishOnly": "pnpm check"
+    "prepublishOnly": "pnpm check",
+    "corpus": "node --experimental-strip-types scripts/corpus.ts"
   },
   "devDependencies": {
     "@types/node": "^22.15.0",