fullcourtdefense-cli 1.14.2 → 1.14.3

package/dist/commands/discoverSecrets.js

@@ -124,6 +124,12 @@ function scoreFromFindings(findings) {
     return Math.max(0, Math.min(100, score));
 }
 function scanTextLines(filePath, content, category, out, seen) {
+    // Placeholder/template files (.env.example, *.sample, *.template) hold intentional
+    // dummy values — report as info so real findings aren't drowned out (Gitleaks
+    // ignores these entirely; we keep them visible but non-alarming).
+    const isExampleFile = /\.(example|sample|template|dist)(\.|$)/i.test(path.basename(filePath));
+    // Vars with client-bundle prefixes ship to the browser by design.
+    const clientExposedPrefix = /^\s*(?:VITE_|NEXT_PUBLIC_|REACT_APP_|EXPO_PUBLIC_|NUXT_PUBLIC_)/;
     const lines = content.split(/\r?\n/);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
@@ -144,22 +150,41 @@ function scanTextLines(filePath, content, category, out, seen) {
             if (seen.has(id))
                 continue;
             seen.add(id);
+            // Firebase/Google web API keys behind a client-bundle prefix are public by
+            // design — the risk is a missing restriction, not the exposure itself.
+            const isClientExposedWebKey = pattern.provider === 'google' && clientExposedPrefix.test(line);
+            let severity = pattern.severity;
+            let title = pattern.title;
+            let detail = pattern.impact
+                ? `Matched ${pattern.provider} pattern in ${path.basename(filePath)}. If leaked: ${pattern.impact}.`
+                : `Matched ${pattern.provider} pattern in ${path.basename(filePath)}`;
+            let remediation = pattern.provider === 'private_key'
+                ? 'Move keys to a secure store; never commit private keys. Use ssh-agent or encrypted keys.'
+                : PROVIDER_REMEDIATION[pattern.provider]
+                    || 'Rotate this credential immediately and store it in a secret manager or OS keychain — not in plain files.';
+            if (isExampleFile) {
+                severity = 'info';
+                title = `${pattern.title} (example/template file)`;
+                detail = `Matched ${pattern.provider} pattern in ${path.basename(filePath)} — looks like an intentional placeholder.`;
+                remediation = 'Confirm this is a dummy value. If a real credential was pasted into the example file, rotate it and replace with a placeholder.';
+            }
+            else if (isClientExposedWebKey) {
+                severity = 'medium';
+                title = 'Google/Firebase web API key (client-exposed)';
+                detail = `Matched google pattern in ${path.basename(filePath)} on a client-bundle variable — this key ships to the browser by design.`;
+                remediation = 'Not a secret in the classic sense, but add HTTP-referrer/API restrictions in Google Cloud console → Credentials so it only works from your domains.';
+            }
             out.push({
                 id,
                 category,
-                severity: pattern.severity,
+                severity,
                 provider: pattern.provider,
                 filePath,
                 lineNumber: i + 1,
-                title: pattern.title,
-                detail: pattern.impact
-                    ? `Matched ${pattern.provider} pattern in ${path.basename(filePath)}. If leaked: ${pattern.impact}.`
-                    : `Matched ${pattern.provider} pattern in ${path.basename(filePath)}`,
+                title,
+                detail,
                 redactedPreview: redact(raw),
-                remediation: pattern.provider === 'private_key'
-                    ? 'Move keys to a secure store; never commit private keys. Use ssh-agent or encrypted keys.'
-                    : PROVIDER_REMEDIATION[pattern.provider]
-                        || 'Rotate this credential immediately and store it in a secret manager or OS keychain — not in plain files.',
+                remediation,
             });
             if (out.length >= MAX_FINDINGS)
                 return;

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.14.2"
+  "version": "1.14.3"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.14.2",
+  "version": "1.14.3",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {