guardvibe 2.9.9 → 3.0.0

package/build/tools/scan-secrets.d.ts

@@ -1,10 +1,11 @@
 export interface SecretFinding {
     provider: string;
-    severity: "critical" | "high" | "medium";
+    severity: "critical" | "high" | "medium" | "low";
     file: string;
     line: number;
     match: string;
     fix: string;
+    gitStatus?: "ignored" | "tracked" | "unknown";
 }
 export declare function scanContent(content: string, filename: string): SecretFinding[];
 export declare function scanSecrets(path: string, recursive?: boolean, format?: "markdown" | "json"): string;

package/build/tools/scan-secrets.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { basename, dirname, extname, join, relative, resolve } from "path";
+import { execFileSync } from "child_process";
 import { secretPatterns, calculateEntropy } from "../data/secret-patterns.js";
 import { loadConfig } from "../utils/config.js";
 const DEFAULT_SECRET_EXCLUDES = new Set(["node_modules", ".git", "build", "dist"]);
@@ -125,6 +126,29 @@ function isEnvCoveredByGitignore(envFile, gitignoreEntries) {
             content.includes(".env"));
     });
 }
+/**
+ * Check if a file is ignored by git (in .gitignore) and not tracked.
+ * Returns: "ignored" (safe), "tracked" (dangerous - committed secret), "unknown" (no git)
+ */
+function getGitProtectionStatus(filePath, gitRoot) {
+    if (!gitRoot)
+        return "unknown";
+    try {
+        // git check-ignore returns 0 if ignored, 1 if not ignored
+        execFileSync("git", ["check-ignore", "-q", filePath], { cwd: gitRoot, stdio: "pipe" });
+        return "ignored";
+    }
+    catch {
+        // Not ignored — check if it's actually tracked (committed)
+        try {
+            const result = execFileSync("git", ["ls-files", filePath], { cwd: gitRoot, encoding: "utf-8" });
+            return result.trim().length > 0 ? "tracked" : "ignored"; // untracked + not ignored = safe-ish
+        }
+        catch {
+            return "unknown";
+        }
+    }
+}
 export function scanSecrets(path, recursive = true, format = "markdown") {
     const targetPath = resolve(path);
     const filePaths = [];
@@ -158,6 +182,25 @@ export function scanSecrets(path, recursive = true, format = "markdown") {
             // Skip unreadable files.
         }
     }
+    // Enrich findings with git protection status
+    const gitRoot = findGitRoot(scanRoot);
+    const gitStatusCache = new Map();
+    for (const finding of allFindings) {
+        let status = gitStatusCache.get(finding.file);
+        if (status === undefined) {
+            status = getGitProtectionStatus(finding.file, gitRoot);
+            gitStatusCache.set(finding.file, status);
+        }
+        finding.gitStatus = status;
+        if (status === "ignored") {
+            // File is in .gitignore — secrets are local-only, not exposed
+            if (finding.severity === "critical")
+                finding.severity = "low";
+            else if (finding.severity === "high")
+                finding.severity = "low";
+            finding.fix = `✅ Protected: this file is in .gitignore and not committed to git. ${finding.fix.replace(/Rotate.*?\.|acilen.*?\./i, "").trim()}`;
+        }
+    }
     const envFiles = uniquePaths.filter((filePath) => basename(filePath).startsWith(".env"));
     for (const envFile of envFiles) {
         const gitignoreEntries = collectGitignoreEntries(dirname(envFile));
@@ -171,6 +214,7 @@ export function scanSecrets(path, recursive = true, format = "markdown") {
             line: 0,
             match: `${envName} is not listed in .gitignore`,
             fix: `Add '${envName}' or '.env*' to .gitignore immediately.`,
+            gitStatus: "tracked",
         });
     }
     if (format === "json") {
@@ -179,7 +223,7 @@ export function scanSecrets(path, recursive = true, format = "markdown") {
         const medCount = allFindings.length - critCount - highCount;
         return JSON.stringify({
             summary: { total: allFindings.length, critical: critCount, high: highCount, medium: medCount, blocked: critCount > 0 || highCount > 0 },
-            findings: allFindings.map(f => ({ provider: f.provider, severity: f.severity, file: f.file, line: f.line, match: f.match, fix: f.fix })),
+            findings: allFindings.map(f => ({ provider: f.provider, severity: f.severity, file: f.file, line: f.line, match: f.match, fix: f.fix, gitStatus: f.gitStatus })),
         });
     }
     const lines = [
@@ -195,7 +239,37 @@ export function scanSecrets(path, recursive = true, format = "markdown") {
         lines.push("", "---", "", "## Findings", "");
         const order = { critical: 0, high: 1, medium: 2 };
         allFindings.sort((left, right) => order[left.severity] - order[right.severity]);
-        for (const finding of allFindings) {
+        // Group findings by git status for clearer output
+        const tracked = allFindings.filter(f => f.gitStatus === "tracked");
+        const ignored = allFindings.filter(f => f.gitStatus === "ignored");
+        const unknown = allFindings.filter(f => f.gitStatus === "unknown");
+        if (tracked.length > 0) {
+            lines.push("## ⚠️ Exposed Secrets (committed to git)", "");
+            for (const finding of tracked) {
+                lines.push(`### [${finding.severity.toUpperCase()}] ${finding.provider}`, `**File:** ${finding.file}${finding.line > 0 ? `:${finding.line}` : ""}`, `**Match:** \`${finding.match}\``, `**Fix:** ${finding.fix}`, "");
+            }
+        }
+        if (ignored.length > 0) {
+            lines.push(`## ✅ Protected Secrets (${ignored.length} in .gitignore — local only)`, "");
+            lines.push("These files are in .gitignore and not committed. Secrets are safe.", "");
+            // Group by file for compact display
+            const byFile = new Map();
+            for (const f of ignored) {
+                const group = byFile.get(f.file) ?? [];
+                group.push(f);
+                byFile.set(f.file, group);
+            }
+            for (const [file, findings] of byFile) {
+                lines.push(`- **${basename(file)}**: ${findings.map(f => f.provider).join(", ")}`);
+            }
+            lines.push("");
+        }
+        // Show unknown-status findings same as exposed (no git protection confirmed)
+        const exposed = [...tracked, ...unknown];
+        if (exposed.length === 0 && tracked.length === 0) {
+            // Re-render exposed section header if only unknown findings
+        }
+        for (const finding of unknown) {
             lines.push(`### [${finding.severity.toUpperCase()}] ${finding.provider}`, `**File:** ${finding.file}${finding.line > 0 ? `:${finding.line}` : ""}`, `**Match:** \`${finding.match}\``, `**Fix:** ${finding.fix}`, "");
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "2.9.9",
+  "version": "3.0.0",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 334 rules, 31 tools, CLI + doctor. Host security: CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit, AI host hardening. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",