kryptheon 0.1.24 → 0.1.26

package/bin/kryptheon.js

@@ -2037,15 +2037,65 @@ function codeRead() {
   }
   if (result.saveError) console.error('  (could not save this read: ' + result.saveError + ')');
 
-  const high = result.findings.filter((f) => f.severity === 'HIGH');
-  const medium = result.findings.filter((f) => f.severity !== 'HIGH');
+  // Secret keys first: one in the page outranks every other finding, because
+  // with it none of the database's rules apply.
+  const keyed = result.findings.filter((f) => f.kind === 'secret-in-code');
+  const redirects = result.findings.filter((f) => f.kind === 'open-redirect');
+  const html = result.findings.filter((f) => f.kind !== 'secret-in-code' && f.kind !== 'open-redirect');
+  const high = html.filter((f) => f.severity === 'HIGH');
+  const medium = html.filter((f) => f.severity !== 'HIGH');
   console.log('');
-  console.log('  I read ' + result.filesRead + ' file' + (result.filesRead === 1 ? '' : 's') + ' of your app\'s code.');
-  if (!result.findings.length) {
+  console.log('  I read ' + result.filesRead + ' file' + (result.filesRead === 1 ? '' : 's') + ' of your app\'s code,');
+  console.log('  for three things: secret keys written into it, redirects that go wherever');
+  console.log('  a link says, and text inserted as HTML.');
+  console.log('');
+  if (!keyed.length) {
+    console.log('  No secret key is written into your code (Supabase service_role or secret,');
+    console.log('  Stripe, OpenAI, Anthropic or GitHub keys).');
+  } else {
+    console.log('  ' + keyed.length + ' secret key' + (keyed.length === 1 ? ' is' : 's are') +
+      ' written into your code. Fix ' + (keyed.length === 1 ? 'it' : 'these') + ' first.');
+    console.log('  The keys themselves are never shown or saved - only how they start.');
+    for (const f of keyed) {
+      console.log('');
+      console.log('  ' + f.severity + '   ' + f.file + ':' + f.line + '   (verification required)');
+      console.log('    ' + f.headline);
+      console.log('    ' + f.sink + ':  ' + f.expression);
+    }
+    for (const f of keyed.filter((k) => k.severity !== 'MEDIUM')) {
+      console.log('');
+      console.log('  ' + '-'.repeat(68));
+      console.log('  Paste this into your AI tool:');
+      console.log('');
+      f.fixPrompt.split(String.fromCharCode(10)).forEach((l) => console.log('    ' + l));
+    }
+    console.log('');
+    console.log('  ' + '-'.repeat(68));
+  }
+  console.log('');
+  if (!redirects.length) {
+    console.log('  No redirect sends people to an address taken from the page\'s URL.');
+  } else {
+    console.log('  ' + redirects.length + ' redirect' + (redirects.length === 1 ? ' goes' : 's go') +
+      ' wherever the page\'s URL says (verification required):');
+    for (const f of redirects) {
+      console.log('');
+      console.log('  ' + f.severity + '   ' + f.file + ':' + f.line);
+      console.log('    ' + f.sink + ' = ' + f.expression);
+    }
+    console.log('');
+    console.log('  Paste this into your AI tool:');
+    console.log('');
+    redirects[0].fixPrompt.split(String.fromCharCode(10)).forEach((l) => console.log('    ' + l));
+    console.log('');
+    console.log('  ' + '-'.repeat(68));
+  }
+  console.log('');
+  if (!html.length) {
     console.log('  I found no place where text that could come from outside the page is');
-    console.log('  inserted as HTML. That is what this read looks for, and only that.');
+    console.log('  inserted as HTML.');
   } else {
-    console.log('  ' + result.findings.length + ' place' + (result.findings.length === 1 ? '' : 's') +
+    console.log('  ' + html.length + ' place' + (html.length === 1 ? '' : 's') +
       ' where text may be inserted as HTML (' + high.length + ' HIGH, ' + medium.length + ' MEDIUM).');
     console.log('  I did not run anything, so each one needs a look before it is called a bug.');
     for (const f of high.concat(medium)) {
@@ -2066,7 +2116,7 @@ function codeRead() {
         f.fixPrompt.split(String.fromCharCode(10)).forEach((l) => console.log('    ' + l));
       }
     }
-    if (result.findings.length > prompted.length) {
+    if (html.length > prompted.length) {
       console.log('');
       console.log('  The fix for every one is saved in:');
       console.log('    ' + opened.codeFindings);

package/kryptheon-code.js

@@ -26,6 +26,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const keys = require('./kryptheon-keys.js');
 
 const SKIP_DIRS = new Set([
   'node_modules', '.git', 'dist', 'build', 'out', '.next', '.nuxt', '.svelte-kit',
@@ -187,8 +188,10 @@ function classify(node, scope, code, depth, aliases) {
         const returns = returnsOf(local);
         if (returns.length) return worst(returns.map((r) => classify(r.node, r.scope, code, depth + 1, aliases)));
       }
-      // String methods pass through whatever they were called on.
-      if (/^(trim|toUpperCase|toLowerCase|slice|substring|substr|replace|replaceAll|padStart|padEnd|concat|toString|join)$/.test(name) &&
+      // String methods pass through whatever they were called on, and so do
+      // the array methods that only pick or reorder items: notes.filter(...)
+      // holds the same notes.
+      if (/^(trim|toUpperCase|toLowerCase|slice|substring|substr|replace|replaceAll|padStart|padEnd|concat|toString|join|filter|sort|reverse|flat|toSorted|toReversed)$/.test(name) &&
           node.callee.type === 'MemberExpression') {
         return again(node.callee.object);
       }
@@ -425,6 +428,10 @@ function isCatchParam(node, scope) {
   return !!(binding && binding.path && binding.path.type === 'CatchClause');
 }
 
+// Bindings whose values are being followed right now, so a variable assigned
+// from itself (count = count + 1) is not followed round in a circle.
+const RESOLVING = new Set();
+
 /** What a name was set to, followed one step back when that says anything. */
 function fromBinding(id, scope, code, depth, aliases) {
   if (id && aliases && Object.prototype.hasOwnProperty.call(aliases, id.name)) return aliases[id.name];
@@ -434,10 +441,32 @@ function fromBinding(id, scope, code, depth, aliases) {
   if (binding.path && binding.path.type === 'CatchClause') return 'error';
   if (binding.kind === 'param') return fromCalls(binding, code, depth);
   const init = binding.path && binding.path.node && binding.path.node.init;
-  if (!init) return 'unknown';
-  if (readsResponseBody(init)) return 'network';
-  // Reassigned later: the first value says nothing reliable about the last.
-  if (binding.constantViolations && binding.constantViolations.length) return 'unknown';
+  const later = binding.constantViolations || [];
+  if (!init && !later.length) return 'unknown';
+  if (init && readsResponseBody(init)) return 'network';
+  // Reassigned later: as dangerous as the worst value it is ever given. Found
+  // on a blind test: `let notes = []`, then `notes = data` from the database,
+  // then rendered - read as "unknown" because the first value was an empty
+  // list. Only plain `=` and `+=` are followed; anything else - a destructure,
+  // a for-of - stays unknown, because what it assigns is not in one place.
+  if (later.length) {
+    if (RESOLVING.has(binding)) return 'safe'; // x = x + 1: itself adds nothing new
+    RESOLVING.add(binding);
+    try {
+      const origins = [];
+      if (init) origins.push(classify(init, binding.path.scope, code, depth + 1, aliases));
+      for (const v of later) {
+        const node = v.node;
+        if (node.type === 'UpdateExpression') continue; // x++ holds a number
+        if (node.type !== 'AssignmentExpression' || node.left.type !== 'Identifier' ||
+            (node.operator !== '=' && node.operator !== '+=')) return 'unknown';
+        origins.push(classify(node.right, v.scope, code, depth + 1, aliases));
+      }
+      return worst(origins);
+    } finally {
+      RESOLVING.delete(binding);
+    }
+  }
   // Destructured from a response body: const { name } = await res.json()
   // Aliases carry through: inside a map() callback, `const t = r.title` is as
   // dangerous as the item r it was read from.
@@ -494,6 +523,33 @@ function readsResponseBody(node) {
     const body = returnedBy(fn);
     return body && readsResponseBody(body);
   });
+  // Found on a blind test: const { data } = await supabase.from('notes')
+  // .select(...) is rows straight from the database, and was judged "unknown".
+  if (queriesSupabase(n)) return true;
+  // axios.get(url) - its .data is the server's body.
+  const callee = n.callee;
+  if (callee.type === 'Identifier' && callee.name === 'axios') return true;
+  if (callee.type === 'MemberExpression' && callee.object.type === 'Identifier' && callee.object.name === 'axios' &&
+      /^(get|post|put|patch|delete|head|request)$/.test(calleeName(callee))) return true;
+  return false;
+}
+
+// What a Supabase query chain does after .from('table'). Required, so that
+// Array.from(x) or somebody's own .from() is not read as the database.
+const QUERY_STEPS = /^(select|insert|update|upsert|delete|eq|neq|gt|gte|lt|lte|like|ilike|is|in|contains|containedBy|match|filter|or|not|order|limit|range|single|maybeSingle|textSearch|csv|throwOnError|returns|abortSignal)$/;
+
+/** supabase.from('notes').select(...)...  or  supabase.rpc('fn', ...). */
+function queriesSupabase(node) {
+  let c = node;
+  while (c && /CallExpression$/.test(c.type) && c.callee && /MemberExpression$/.test(c.callee.type)) {
+    const step = calleeName(c.callee);
+    const inner = c.callee.object;
+    if (step === 'rpc' && c.arguments[0] && /StringLiteral|TemplateLiteral/.test(c.arguments[0].type)) return true;
+    if (QUERY_STEPS.test(step) && inner && /CallExpression$/.test(inner.type) && calleeName(inner.callee) === 'from' &&
+        inner.callee.type === 'MemberExpression' && inner.arguments[0] &&
+        /StringLiteral|TemplateLiteral/.test(inner.arguments[0].type)) return true;
+    c = inner;
+  }
   return false;
 }
 
@@ -518,6 +574,116 @@ function paramOf(value, scope) {
 }
 
 /** Everything in one piece of code that turns a non-literal value into HTML. */
+/* -------------------------- open redirects -------------------------- */
+//
+// Found on a blind test: after signing in, the page sent the browser to
+// new URLSearchParams(location.search).get('next') - wherever a link said.
+// A phishing link then lands someone on the attacker's page straight from
+// the real login, and a javascript: value runs in the page. Reported only
+// when the address is taken from the page's own URL, and not when the code
+// checks it first: a redirect to a fixed page is the feature.
+
+/** location, window.location, document.location. */
+function isLocation(node) {
+  if (!node) return false;
+  if (node.type === 'Identifier') return node.name === 'location';
+  return node.type === 'MemberExpression' && !node.computed && node.property.name === 'location' &&
+    node.object.type === 'Identifier' && /^(window|document|self|top)$/.test(node.object.name);
+}
+
+/** Is this address taken from the page's own URL, from its start? */
+function readsUrl(node, scope, depth) {
+  if (!node || depth > 8) return false;
+  const again = (n) => readsUrl(n, scope, depth + 1);
+  switch (node.type) {
+    case 'MemberExpression':
+    case 'OptionalMemberExpression': {
+      const prop = !node.computed && node.property ? node.property.name : '';
+      if ((prop === 'search' || prop === 'hash') && isLocation(node.object)) return true;
+      if (prop === 'referrer' && node.object.type === 'Identifier' && node.object.name === 'document') return true;
+      // Next's pages router: router.query.next
+      let base = node.object;
+      while (base && /MemberExpression$/.test(base.type)) {
+        if (!base.computed && base.property.name === 'query' && base.object.type === 'Identifier' && base.object.name === 'router') return true;
+        base = base.object;
+      }
+      return false;
+    }
+    case 'CallExpression':
+    case 'OptionalCallExpression': {
+      const name = calleeName(node.callee);
+      if (name === 'get' && /MemberExpression$/.test(node.callee.type)) {
+        const params = node.callee.object;
+        if (params.type === 'NewExpression' && params.callee.name === 'URLSearchParams') return true;
+        if (/MemberExpression$/.test(params.type) && !params.computed && params.property.name === 'searchParams') return true;
+        if (params.type === 'Identifier' && scope) {
+          const b = scope.getBinding(params.name);
+          const init = b && b.path && b.path.node && b.path.node.init;
+          if (init && init.type === 'NewExpression' && init.callee.name === 'URLSearchParams') return true;
+          if (init && /MemberExpression$/.test(init.type) && !init.computed && init.property.name === 'searchParams') return true;
+          // Next and React Router: const params = useSearchParams(), or
+          // const [params] = useSearchParams().
+          if (init && /CallExpression$/.test(init.type) && calleeName(init.callee) === 'useSearchParams') return true;
+        }
+        return false;
+      }
+      if (/^(decodeURIComponent|decodeURI|String)$/.test(name) && node.callee.type === 'Identifier') return again(node.arguments[0]);
+      if (/^(trim|toString|slice|substring)$/.test(name) && /MemberExpression$/.test(node.callee.type)) return again(node.callee.object);
+      return false; // anything else - isSafeUrl(x), sanitize(x) - is somebody's check
+    }
+    case 'LogicalExpression':
+      return again(node.left) || again(node.right);
+    case 'ConditionalExpression':
+      return again(node.consequent) || again(node.alternate);
+    case 'TemplateLiteral':
+      // `login.html?next=${x}` starts somewhere fixed; `${x}` does not.
+      return node.quasis[0].value.cooked === '' && node.expressions.length > 0 && again(node.expressions[0]);
+    case 'BinaryExpression':
+      return node.operator === '+' && again(node.left);
+    case 'AwaitExpression':
+      return again(node.argument);
+    case 'Identifier': {
+      const b = scope && scope.getBinding(node.name);
+      if (!b || !b.path || b.kind === 'param') return false;
+      const values = [];
+      if (b.path.node && b.path.node.init) values.push(b.path.node.init);
+      for (const v of b.constantViolations || []) if (v.node.type === 'AssignmentExpression') values.push(v.node.right);
+      return values.some((v) => readsUrl(v, b.path.scope, depth + 1));
+    }
+    default:
+      return false;
+  }
+}
+
+/**
+ * Does the code check this name before sending the browser there? Any `if`
+ * or `? :` around the redirect, or an earlier `if` in the same block, whose
+ * test mentions it - an allow-list, a startsWith('/'), an origin compare.
+ */
+function checkedFirst(p, value, code) {
+  if (!value || value.type !== 'Identifier') return false;
+  const word = new RegExp('\\b' + value.name.replace(/\$/g, '\\$') + '\\b');
+  // A test that only asks whether there is a value - if (next) - checks
+  // nothing about where it goes. It has to compare or match something.
+  const VALIDATES = /startsWith|endsWith|\.test\(|includes|indexOf|match|origin|===|!==|allow|safe|valid|trusted/i;
+  const mentions = (n) => {
+    const text = n ? code.slice(n.start, n.end) : '';
+    return word.test(text) && VALIDATES.test(text);
+  };
+  let child = p;
+  for (let at = p.parentPath; at; child = at, at = at.parentPath) {
+    const n = at.node;
+    if ((n.type === 'IfStatement' || n.type === 'ConditionalExpression') && mentions(n.test)) return true;
+    if (n.type === 'LogicalExpression' && n.operator === '&&' && child.node === n.right && mentions(n.left)) return true;
+    if (n.type === 'BlockStatement' || n.type === 'Program') {
+      const index = n.body.indexOf(child.node);
+      if (n.body.slice(0, Math.max(0, index)).some((s) => s.type === 'IfStatement' && mentions(s.test))) return true;
+    }
+    if (/Function/.test(n.type)) break;
+  }
+  return false;
+}
+
 function sinksIn(parser, code, file, lineOffset) {
   const found = [];
   const ast = parser.babelParse(code, file, true);
@@ -556,17 +722,35 @@ function sinksIn(parser, code, file, lineOffset) {
       },
     },
   });
+  const redirect = (p, sink, value) => {
+    if (!value || !readsUrl(value, p.scope, 0) || checkedFirst(p, value, code)) return;
+    found.push({ kind: 'redirect', line: lineOf(p.node), sink: sink, expression: textOf(value), origin: 'url', parts: [] });
+  };
   parser.traverse(ast, {
     AssignmentExpression(p) {
       const left = p.node.left;
+      if (isLocation(left)) return redirect(p, 'location', p.node.right);
       if (left.type !== 'MemberExpression' || left.computed) return;
       const prop = left.property && left.property.name;
       if (prop === 'innerHTML' || prop === 'outerHTML') add(p.node, p.scope, prop, p.node.right);
+      else if (prop === 'href' && isLocation(left.object)) redirect(p, 'location.href', p.node.right);
     },
     CallExpression(p) {
       const callee = p.node.callee;
       const name = calleeName(callee);
       const args = p.node.arguments;
+      if ((name === 'assign' || name === 'replace') && callee.type === 'MemberExpression' && isLocation(callee.object)) {
+        return redirect(p, 'location.' + name + '()', args[0]);
+      }
+      if (name === 'open' && callee.type === 'MemberExpression' && callee.object.type === 'Identifier' && callee.object.name === 'window') {
+        return redirect(p, 'window.open()', args[0]);
+      }
+      // Next's router follows a full URL off the site. React Router's
+      // navigate() does not, so it is not a sink here.
+      if ((name === 'push' || name === 'replace') && callee.type === 'MemberExpression' &&
+          callee.object.type === 'Identifier' && callee.object.name === 'router') {
+        return redirect(p, 'router.' + name + '()', args[0]);
+      }
       if (name === 'insertAdjacentHTML' && args[1]) add(p.node, p.scope, 'insertAdjacentHTML', args[1]);
       else if ((name === 'write' || name === 'writeln') && callee.type === 'MemberExpression' &&
                callee.object && callee.object.name === 'document' && args[0]) {
@@ -632,8 +816,25 @@ function scanProject(root, options) {
   }
   const findings = [];
   const unreadable = [];
+  // Secret keys, read from the same files. Kept apart from the HTML findings:
+  // they are already in their final shape, and they go first.
+  const secrets = [];
   let filesRead = 0;
-  for (const full of listFiles(root)) {
+  const files = listFiles(root);
+  const relOf = (full) => path.relative(root, full).split(path.sep).join('/');
+  // Which pages load which scripts, so a key in config.js can be said to
+  // reach the browser because index.html loads it - not guessed at.
+  const pages = [];
+  for (const full of files) {
+    if (!/\.html?$/i.test(full)) continue;
+    try {
+      if (fs.statSync(full).size <= MAX_BYTES) pages.push({ rel: relOf(full), source: fs.readFileSync(full, 'utf8') });
+    } catch (err) {
+      /* unreadable pages are reported below */
+    }
+  }
+  const loadedBy = keys.scriptsLoadedBy(pages);
+  for (const full of files) {
     let size = 0;
     try {
       size = fs.statSync(full).size;
@@ -647,6 +848,7 @@ function scanProject(root, options) {
     }
     const source = fs.readFileSync(full, 'utf8');
     filesRead++;
+    for (const k of keys.secretsIn(rel, source, loadedBy)) secrets.push(k);
     const pieces = PAGE_EXT.test(full) ? scriptsIn(source) : [{ code: source, line: 1 }];
     for (const piece of pieces) {
       try {
@@ -661,7 +863,7 @@ function scanProject(root, options) {
       }
     }
   }
-  return { ran: true, filesRead: filesRead, findings: findings.map(describe), unreadable: unreadable };
+  return { ran: true, filesRead: filesRead, findings: secrets.concat(findings.map(describe)), unreadable: unreadable };
 }
 
 const ORIGIN_WORDS = {
@@ -688,8 +890,45 @@ function wrap(text, width) {
   return out.join('\n');
 }
 
+/** An open redirect, in the same shape as every other finding. */
+function describeRedirect(f) {
+  const fixPrompt = [
+    'My app may have an open redirect - please check it rather than assume it.',
+    '',
+    'In ' + f.file + ' at line ' + f.line + ', the page sends the browser to an address taken from its own URL:',
+    '',
+    '    ' + f.expression,
+    '',
+    'Anyone can send a link to this page with that part of the URL set to their own site - for example ' +
+      '?next=https://attacker.example. The person uses your real page, then lands on the attacker\'s, which ' +
+      'can ask for their password again. A value starting with javascript: can run script in your page.',
+    '',
+    'Fix it so only your own pages are allowed: accept the value only if it starts with a single "/" (not ' +
+      '"//" and not "/\\"), or check that new URL(value, location.origin).origin equals location.origin, and ' +
+      'go to your home page otherwise. Then check every other place that reads a next, redirect or returnTo ' +
+      'value the same way.',
+  ].map((p) => (p.startsWith('    ') ? p : wrap(p, 72))).join('\n');
+  return {
+    kind: 'open-redirect',
+    status: 'verification required',
+    evidence: 'code analysis',
+    severity: 'HIGH',
+    confidence: 'medium',
+    file: f.file,
+    line: f.line,
+    sink: f.sink,
+    expression: f.expression,
+    origin: 'url',
+    parts: [],
+    via: null,
+    headline: 'A redirect in ' + f.file + ':' + f.line + ' goes wherever the page\'s URL says.',
+    fixPrompt: fixPrompt,
+  };
+}
+
 /** One finding, in the shape every Kryptheon report uses. */
 function describe(f) {
+  if (f.kind === 'redirect') return describeRedirect(f);
   const severity = f.origin === 'unknown' ? 'MEDIUM' : 'HIGH';
   const how = f.sink === 'v-html' ? 'v-html' : f.sink;
   const where = f.via

package/kryptheon-dashboard-page.js

@@ -459,6 +459,7 @@
       meta.appendChild(sevTag(f.severity));
       meta.appendChild(statusTag(f));
       meta.appendChild(el('span', 'tag ' + (CHECK_TONE[f.check] || ''), CHECK_NAME[f.check] || f.check));
+      if (f.from === 'nightly' || f.from === 'both') meta.appendChild(el('span', 'tag', f.from === 'both' ? 'also nightly' : 'nightly'));
       meta.appendChild(el('span', 'f-where', f.where));
       left.appendChild(meta);
       head.appendChild(left);
@@ -564,6 +565,9 @@
       st.appendChild(el('span', 'tag ' + (STATE_TONE[c.state] || ''), c.state));
       card.appendChild(st);
       if (c.what) card.appendChild(el('div', 'c-what', c.what));
+      // What the nightly run inside the database last said - its own answer,
+      // not this terminal's, so it gets its own line.
+      if (c.nightly) card.appendChild(el('div', 'c-what', c.nightly));
       if (c.runnable && c.enabled) {
         var run = button('sm', 'play', 'Run now', function () { runChecks([c.id], run); });
         run.setAttribute('data-action', 'run');
@@ -600,6 +604,7 @@
     ['test-results/', 'screenshots and traces from runs that broke'],
     ['code-findings.json', 'the last read of your frontend code'],
     ['night-last.json', 'the last database check'],
+    ['night-nightly.json', 'what the nightly run inside your database last said'],
     ['snapshot.json', 'what your files looked like at the last look'],
     ['changes.jsonl', 'every look: what changed, what broke, what got fixed'],
     ['fixes.jsonl', 'every re-check and its verdict'],

package/kryptheon-dashboard.js

@@ -251,6 +251,28 @@ function nextAction(findings, steps) {
   return { kind: 'quiet', title: 'Nothing open' };
 }
 
+/**
+ * One sentence about the nightly run inside the database, or null when
+ * kryptheon-night has never been asked. Its four states are four different
+ * answers, and none of the other three may read as "nothing found": not set
+ * up, set up and never run, set up with nothing scheduled, and stopped.
+ */
+function nightlyLine(nightly) {
+  if (!nightly) return null;
+  const day = (iso) => String(iso || '').slice(0, 16).replace('T', ' ');
+  const read = ' (as of ' + day(nightly.readAt) + ')';
+  if (!nightly.installed) return 'Nightly run in your database: not set up. npx kryptheon-night install sets it up.' + read;
+  const idle = nightly.active ? '' : ' Nothing is scheduled, so it is not running - npx kryptheon-night install sets it up again.';
+  if (!nightly.ranAt) return 'Nightly run in your database: set up, and it has not run yet.' + idle + read;
+  const when = 'Nightly run in your database, ' + day(nightly.ranAt) + ': ';
+  if (nightly.stopped) return when + 'it could not check - ' + nightly.stopped + idle + read;
+  const n = (nightly.findings || []).length;
+  const skipped = (nightly.notChecked || []).length;
+  return when + (n ? n + (n === 1 ? ' problem found.' : ' problems found.')
+    : 'nothing got through ' + (nightly.attacksRun || 0) + ' attacks.') +
+    (skipped ? ' ' + skipped + ' ' + (skipped === 1 ? 'part was' : 'parts were') + ' not tested.' : '') + idle + read;
+}
+
 /**
  * Everything the page shows, from the store alone. Findings from every check
  * are put into one list, each carrying the same fields - severity, status,
@@ -264,6 +286,10 @@ function buildState(root, env) {
   const baselines = readJson(paths.baselines) || {};
   const code = readJson(paths.codeFindings);
   const night = readJson(paths.nightLast);
+  // What the nightly run inside the database last said, kept by
+  // kryptheon-night whenever it connects. Not the same answer as night:
+  // that one is the scan last run from this terminal.
+  const nightly = readJson(paths.nightNightly);
 
   const findings = [];
 
@@ -331,6 +357,33 @@ function buildState(root, env) {
     }
   }
 
+  // The nightly run's findings, said as coming from it. One both answers
+  // share is shown once, with the newer date - the same problem found twice
+  // is still one problem to fix.
+  if (nightly && nightly.ranAt && config.enabled.data) {
+    for (const f of nightly.findings || []) {
+      const item = {
+        check: 'data',
+        from: 'nightly',
+        severity: f.severity,
+        status: f.status || 'confirmed',
+        evidence: (f.status || 'confirmed') === 'confirmed' ? 'runtime confirmed' : 'code analysis',
+        confidence: (f.status || 'confirmed') === 'confirmed' ? 'high' : 'medium',
+        where: f.table + (f.column ? '.' + f.column : ''),
+        headline: f.headline,
+        detail: f.body || '',
+        fixPrompt: f.fixPrompt || '',
+        when: nightly.ranAt,
+      };
+      const same = findings.find((o) => o.check === 'data' && changes.findingKey(o) === changes.findingKey(item));
+      if (!same) findings.push(item);
+      else {
+        same.from = 'both';
+        if (!same.when || item.when > same.when) same.when = item.when;
+      }
+    }
+  }
+
   const rank = { 'HIGH CRITICAL': 0, CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3 };
   findings.sort((a, b) => (rank[a.severity] ?? 9) - (rank[b.severity] ?? 9) ||
     (a.status === 'confirmed' ? 0 : 1) - (b.status === 'confirmed' ? 0 : 1));
@@ -359,9 +412,14 @@ function buildState(root, env) {
     else if (!config.enabled[c.id]) state = 'switched off';
     else if (c.id === 'regression') state = !recordings ? 'no recordings yet' : !lastRun ? 'never run' : lastRun.failed ? 'problems found' : 'last run held';
     else if (c.id === 'frontend') state = !code ? 'never run' : (code.findings || []).length ? 'things to check' : 'nothing found';
-    else if (c.id === 'data') state = !night ? 'never run here' : (night.findings || []).length ? 'problems found' : 'last run held';
+    else if (c.id === 'data') {
+      const ranNightly = nightly && nightly.ranAt && !nightly.stopped;
+      state = !night && !ranNightly ? 'never run here'
+        : findings.some((f) => f.check === 'data') ? 'problems found' : 'last run held';
+    }
     return {
       id: c.id, label: c.label, available: c.available, enabled: config.enabled[c.id], state: state, what: c.what || '',
+      nightly: c.id === 'data' ? nightlyLine(nightly) : null,
       // Runnable from the page: what needs nothing the page cannot supply. The
       // database check needs a connection string, which stays in the terminal.
       runnable: c.available && (c.id === 'frontend' || (c.id === 'regression' && recordings > 0)),
@@ -372,7 +430,7 @@ function buildState(root, env) {
     codeAt: code ? code.checkedAt : null,
     recordings: recordings,
     lastRunAt: lastRun ? lastRun.runAt : null,
-    nightAt: night ? nightWhen : null,
+    nightAt: [night ? nightWhen : null, nightly && nightly.ranAt].filter(Boolean).sort().pop() || null,
   });
 
   // Every look Kryptheon took - by `verify`, or by the dashboard's own watch -

package/kryptheon-keys.js

@@ -0,0 +1,320 @@
+// Reads a project's code for keys that must never be in it.
+//
+// One key does more damage than any other mistake in an app built on
+// Supabase: the service_role key. It skips every row level security rule, so
+// whoever holds it can read, change and delete every row in every table. Put
+// in code that the browser downloads, it belongs to anyone who opens the
+// developer tools. Found on a blind test: a config.js fallback held one, and
+// every rule the database attack checked was beside the point - with that key
+// in the page, none of them apply.
+//
+// This is a read of the files, never a use of what is found: nothing is sent
+// anywhere and no key is tried. The key itself is never printed, saved or put
+// in a prompt - only its first characters and its length, enough for a person
+// to find it and too little for anyone to use it.
+//
+// Narrow on purpose, as the HTML read is. Only formats that are secret by
+// construction are reported as certain. Keys that are public by design - the
+// Supabase anon or publishable key, a Firebase web key - are never reported.
+
+const path = require('path');
+
+// A variable the build copies into the browser bundle, named as a secret.
+// Next, Vite, Create React App, Expo, Nuxt, SvelteKit and Gatsby all inline
+// anything with these prefixes, so the value ships whatever the file is.
+const PUBLIC_SECRET_NAME = /\b(NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC|NUXT_PUBLIC|GATSBY|PUBLIC)_[A-Z0-9_]*(?:SERVICE_ROLE|SECRET)[A-Z0-9_]*\b/g;
+
+const SUPABASE_ROTATE = 'in the Supabase dashboard, open Project Settings, then API Keys, and roll the ' +
+  'service_role (secret) key';
+const SUPABASE_OPENS = 'It skips every row level security rule: anyone who has it can read, change ' +
+  'and delete every row in every table, and act as any user.';
+const SUPABASE_INSTEAD = 'the anon (publishable) key, with row level security doing the protecting';
+
+// Formats that are a secret whatever they are called. Each needs a real
+// length after its prefix, so a placeholder like "sb_secret_..." is not one.
+const FORMATS = [
+  {
+    re: /\bsb_secret_[A-Za-z0-9_-]{20,}/g,
+    label: 'Supabase secret key',
+    opens: SUPABASE_OPENS,
+    rotate: SUPABASE_ROTATE,
+    instead: SUPABASE_INSTEAD,
+  },
+  {
+    re: /\b[sr]k_live_[A-Za-z0-9]{20,}/g,
+    label: 'Stripe live secret key',
+    opens: 'It can charge cards, issue refunds and read every customer and payment in your Stripe account.',
+    rotate: 'in the Stripe dashboard, open Developers, then API keys, and roll it',
+    instead: 'the publishable key (pk_live_...), with every charge made from your server',
+  },
+  {
+    re: /\b[sr]k_test_[A-Za-z0-9]{20,}/g,
+    label: 'Stripe test secret key',
+    opens: 'It controls your Stripe test account. It moves no real money, but a live key in the same place would.',
+    rotate: 'in the Stripe dashboard, open Developers, then API keys, and roll it',
+    instead: 'the publishable key (pk_test_...), with every charge made from your server',
+  },
+  {
+    re: /\bsk-ant-[A-Za-z0-9_-]{32,}/g,
+    label: 'Anthropic API key',
+    opens: 'Anyone who has it can run requests on your account and your bill.',
+    rotate: 'in the Anthropic Console, open API Keys, and delete it',
+    instead: 'a call to your own server, which holds the key',
+  },
+  {
+    re: /\bsk-(?!ant-)(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,}/g,
+    label: 'OpenAI API key',
+    opens: 'Anyone who has it can run requests on your account and your bill.',
+    rotate: 'in the OpenAI dashboard, open API keys, and revoke it',
+    instead: 'a call to your own server, which holds the key',
+  },
+  {
+    re: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{40,})/g,
+    label: 'GitHub token',
+    opens: 'It acts as you on GitHub, with whatever access it was given - often every repository you have.',
+    rotate: 'on GitHub, open Settings, then Developer settings, then Personal access tokens, and delete it',
+    instead: 'nothing - a GitHub token has no business in app code at all',
+  },
+];
+
+const JWT = /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g;
+
+/** The claims of a JWT, or null when it is not one this can read. */
+function claimsOf(token) {
+  try {
+    const part = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+    const claims = JSON.parse(Buffer.from(part, 'base64').toString('utf8'));
+    return claims && typeof claims === 'object' ? claims : null;
+  } catch (err) {
+    return null;
+  }
+}
+
+// A quoted value that is shaped like a key and says it is a service-role one,
+// in a format this does not know. Digits are required: "YOUR_SERVICE_ROLE_KEY"
+// is somebody's placeholder, not a key. Reported as unconfirmed, because the
+// format cannot say whether it is real.
+const QUOTED = /(["'`])([A-Za-z0-9_.-]{24,})\1/g;
+function looksLikeServiceRoleKey(value) {
+  if (!/service[_-]?role/i.test(value)) return false;
+  if (/your|example|placeholder|changeme|x{4,}|here/i.test(value)) return false;
+  return (value.match(/[0-9]/g) || []).length >= 4;
+}
+
+/** First characters and length - enough to find it, too little to use it. */
+function masked(value) {
+  return value.slice(0, 6) + '... (' + value.length + ' characters, not shown)';
+}
+
+// Wrapped here, as the HTML read's prompts are: pasted into a chat box as
+// often as read in a terminal, and a long line is a wall in both.
+function wrap(text, width) {
+  const out = [];
+  let current = '';
+  for (const word of String(text).split(' ')) {
+    if (current && (current + ' ' + word).length > width) {
+      out.push(current);
+      current = word;
+    } else {
+      current = current ? current + ' ' + word : word;
+    }
+  }
+  out.push(current);
+  return out.join('\n');
+}
+
+function lineAt(source, index) {
+  let line = 1;
+  for (let i = 0; i < index; i++) if (source.charCodeAt(i) === 10) line++;
+  return line;
+}
+
+// Where a file runs. A page, a file a page loads, or code that touches the
+// document is browser code; a file under api/, server/ or functions/, or one
+// that starts a server, is not. Anything else is said as it is: unknown.
+const SERVER_PATH = /(^|\/)(api|server|backend|functions|scripts|cron|workers?)\//i;
+const SERVER_CODE = /['"]use server['"]|require\(\s*['"](express|fastify|koa|http)['"]\s*\)|from\s+['"](express|fastify|koa)['"]|Deno\.serve\s*\(/;
+const BROWSER_CODE = /\b(?:document|window|localStorage|sessionStorage)\s*\.|['"]use client['"]|\buse(?:State|Effect)\s*\(/;
+
+function whereItRuns(rel, source, loadedBy) {
+  if (/\.(html?|vue|svelte)$/i.test(rel)) return { browser: true, why: rel + ' is a page, so every visitor downloads it' };
+  if (loadedBy && loadedBy.get(rel)) {
+    return { browser: true, why: loadedBy.get(rel) + ' loads ' + rel + ', so every visitor downloads it' };
+  }
+  if (SERVER_PATH.test(rel) || SERVER_CODE.test(source)) return { browser: false, why: null };
+  if (BROWSER_CODE.test(source)) return { browser: true, why: rel + ' runs in the browser' };
+  return { browser: null, why: null };
+}
+
+/**
+ * Which pages load which scripts: <script src="..."> read out of every page,
+ * resolved against the page's folder. A full URL is skipped - it is not ours.
+ */
+function scriptsLoadedBy(pages) {
+  const loaded = new Map();
+  for (const page of pages) {
+    const re = /<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["']/gi;
+    let m;
+    while ((m = re.exec(page.source))) {
+      const src = m[1].split('?')[0].split('#')[0];
+      if (/^[a-z]+:|^\/\//i.test(src)) continue;
+      const rel = src.startsWith('/')
+        ? path.posix.normalize(src.slice(1))
+        : path.posix.normalize(path.posix.join(path.posix.dirname(page.rel), src));
+      if (!loaded.has(rel)) loaded.set(rel, page.rel);
+    }
+  }
+  return loaded;
+}
+
+function keyFinding(rel, source, index, value, kind, confidence, runs) {
+  const line = lineAt(source, index);
+  const severity = kind.severity || (runs.browser === false ? 'HIGH' : runs.browser ? 'CRITICAL' : 'HIGH');
+  const shown = masked(value);
+  const a = confidence === 'high' ? 'A ' : 'What looks like a ';
+  const f = {
+    kind: 'secret-in-code',
+    status: 'verification required',
+    evidence: 'code analysis',
+    severity: severity,
+    confidence: confidence,
+    file: rel,
+    line: line,
+    sink: 'secret key',
+    expression: shown,
+    origin: 'code',
+    parts: [],
+    via: null,
+    headline: a + kind.label + ' is written into ' + rel + ':' + line +
+      (runs.browser ? ', and it reaches the browser.'
+        : runs.browser === false ? ' (server code - still in every copy of the repository).' : '.'),
+  };
+  f.fixPrompt = [
+    'My app has a secret key written into its code. Please fix it - and do not paste the key back to me.',
+    '',
+    'In ' + rel + ' at line ' + line + ' there is ' + a.toLowerCase() + kind.label +
+      ' (it starts with "' + value.slice(0, 6) + '").' + (runs.why ? ' ' + runs.why + '.' : ''),
+    kind.opens,
+    '',
+    '1. Rotate it first: ' + kind.rotate + '. Taking it out of the code is not enough - it is already in ' +
+      'the deployed site and in the git history.',
+    '2. Remove it from this file and from anything that reads it. Code that runs in the browser should only ' +
+      'ever use ' + kind.instead + '.',
+    '3. Anything that truly needs the secret moves to server code - an API route or a Supabase Edge Function - ' +
+      'reading it from an environment variable with no public prefix (not NEXT_PUBLIC_, VITE_ or REACT_APP_).',
+    '4. Search the whole project, config files and HTML included, for any other copy of it.',
+  ].map((l) => wrap(l, 72)).join('\n');
+  return f;
+}
+
+function publicNameFinding(rel, source, index, name, prefix) {
+  const line = lineAt(source, index);
+  const supabase = /SUPABASE|SERVICE_ROLE/.test(name);
+  return {
+    kind: 'secret-in-code',
+    status: 'verification required',
+    evidence: 'code analysis',
+    severity: 'CRITICAL',
+    confidence: 'high',
+    file: rel,
+    line: line,
+    sink: 'secret in a public variable',
+    expression: name,
+    origin: 'code',
+    parts: [],
+    via: null,
+    headline: rel + ':' + line + ' reads ' + name + ' - every variable starting ' + prefix +
+      ' is copied into the browser, so the secret ships with the site.',
+    fixPrompt: [
+      'My app puts a secret into the browser through an environment variable. Please fix it - and do not ' +
+        'paste the value back to me.',
+      '',
+      'In ' + rel + ' at line ' + line + ' the code reads ' + name + '. The build copies every variable ' +
+        'starting ' + prefix + ' into the JavaScript each visitor downloads, whatever file reads it.',
+      supabase ? SUPABASE_OPENS : 'Whoever opens the browser tools has the secret.',
+      '',
+      '1. Rotate the secret first' + (supabase ? ': ' + SUPABASE_ROTATE : '') + '. The built site already contains it.',
+      '2. Rename the variable without the public prefix and read it only in server code - an API route or a ' +
+        'Supabase Edge Function.',
+      '3. Code that runs in the browser should only ever use ' +
+        (supabase ? SUPABASE_INSTEAD : 'values that are safe to publish') + '.',
+      '4. Search the whole project for every other place that reads it.',
+    ].map((l) => wrap(l, 72)).join('\n'),
+  };
+}
+
+/** Every secret in one file. `loadedBy` maps a script to a page that loads it. */
+function secretsIn(rel, source, loadedBy) {
+  const out = [];
+  const seen = new Set();
+  const runs = whereItRuns(rel, source, loadedBy);
+  const add = (index, value, kind, confidence) => {
+    if (seen.has(value)) return;
+    seen.add(value);
+    out.push(keyFinding(rel, source, index, value, kind, confidence, runs));
+  };
+
+  for (const format of FORMATS) {
+    format.re.lastIndex = 0;
+    let m;
+    while ((m = format.re.exec(source))) add(m.index, m[0], format, 'high');
+  }
+
+  JWT.lastIndex = 0;
+  let j;
+  while ((j = JWT.exec(source))) {
+    const claims = claimsOf(j[0]);
+    if (!claims || claims.role !== 'service_role') continue; // anon and user tokens are public by design
+    // Supabase's local development key is the same published value on every
+    // machine: harmless against a laptop, but a sign of where a real one goes.
+    const demo = claims.iss === 'supabase-demo';
+    add(j.index, j[0], demo
+      ? {
+        label: 'Supabase service_role key (the published local-development one)',
+        opens: 'Against a laptop it does no harm. But this is the place a real project\'s service_role key ' +
+          'would go, and there it would open every table to anyone.',
+        rotate: 'nothing to rotate for the local key itself - check that no real key is used the same way',
+        instead: SUPABASE_INSTEAD,
+        severity: 'MEDIUM',
+      }
+      : { label: 'Supabase service_role key', opens: SUPABASE_OPENS, rotate: SUPABASE_ROTATE, instead: SUPABASE_INSTEAD },
+    'high');
+  }
+
+  QUOTED.lastIndex = 0;
+  let q;
+  while ((q = QUOTED.exec(source))) {
+    if (!looksLikeServiceRoleKey(q[2])) continue;
+    add(q.index + 1, q[2], {
+      label: 'Supabase service_role key',
+      opens: SUPABASE_OPENS + ' Its format is not one I know, so check whether it is a real key.',
+      rotate: SUPABASE_ROTATE,
+      instead: SUPABASE_INSTEAD,
+    }, 'medium');
+  }
+
+  // Only where it is read from the environment, and never in a test: found on
+  // Kryptheon's own code, a constant called PUBLIC_SECRET_NAME is a name in a
+  // program, not a variable the build ships - and a test file ships nothing.
+  const isTest = /(^|\/)__tests__\/|\.(test|spec|check)\.[cm]?[jt]sx?$/i.test(rel);
+  const svelteEnv = /from\s+['"]\$env\/(static|dynamic)\/public['"]/.test(source);
+  PUBLIC_SECRET_NAME.lastIndex = 0;
+  let n;
+  while (!isTest && (n = PUBLIC_SECRET_NAME.exec(source))) {
+    const before = source.slice(Math.max(0, n.index - 40), n.index);
+    const read = /(process\.env|import\.meta\.env|\benv)\s*(\.|\[\s*['"])$/.test(before) || svelteEnv;
+    if (!read || seen.has(n[0])) continue;
+    seen.add(n[0]);
+    out.push(publicNameFinding(rel, source, n.index, n[0], n[1] + '_'));
+  }
+
+  return out;
+}
+
+module.exports = {
+  secretsIn: secretsIn,
+  scriptsLoadedBy: scriptsLoadedBy,
+  whereItRuns: whereItRuns,
+  masked: masked,
+  claimsOf: claimsOf,
+};

package/kryptheon-project.js

@@ -142,18 +142,25 @@ function inspectProject(dir, env) {
  * on a blind test: exactly such an app was refused, and nothing was read. The
  * refusal exists so that a check does not run somebody else's recordings;
  * reading the files in front of you cannot do that. A page at the top of the
- * folder is what says it is a site. A home or system folder stays refused.
+ * folder, or in one of the folders a site's pages usually live in, is what
+ * says it is a site - found on the next blind test, where the pages were in
+ * src/ and the read refused at the project's root. A home or system folder
+ * stays refused.
  */
+const PAGE_FOLDERS = ['', 'src', 'public', 'www', 'site', 'static', 'web', 'client', 'frontend'];
+
 function inspectCodeFolder(dir, env) {
   const here = inspectProject(dir, env);
   if (here.ok || here.reason !== 'no-package') return here;
-  let pages = [];
-  try {
-    pages = fs.readdirSync(dir).filter((name) => /\.html?$/i.test(name) && fs.statSync(path.join(dir, name)).isFile());
-  } catch (e) {
-    pages = [];
-  }
-  return pages.length ? Object.assign({}, here, { ok: true, reason: null, plainSite: true }) : here;
+  const hasPage = PAGE_FOLDERS.some((sub) => {
+    try {
+      const at = path.join(dir, sub);
+      return fs.readdirSync(at).some((name) => /\.html?$/i.test(name) && fs.statSync(path.join(at, name)).isFile());
+    } catch (e) {
+      return false;
+    }
+  });
+  return hasPage ? Object.assign({}, here, { ok: true, reason: null, plainSite: true }) : here;
 }
 
 /**

package/kryptheon-store.js

@@ -45,6 +45,7 @@ const FILES = {
   history: 'history.jsonl',
   testResults: 'test-results',
   nightLast: 'night-last.json',
+  nightNightly: 'night-nightly.json',
   codeFindings: 'code-findings.json',
   config: 'config.json',
   snapshot: 'snapshot.json',
@@ -132,6 +133,7 @@ function pathsIn(dir) {
     history: path.join(dir, FILES.history),
     testResults: path.join(dir, FILES.testResults),
     nightLast: path.join(dir, FILES.nightLast),
+    nightNightly: path.join(dir, FILES.nightNightly),
     codeFindings: path.join(dir, FILES.codeFindings),
     config: path.join(dir, FILES.config),
     snapshot: path.join(dir, FILES.snapshot),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Record what you do in your app and get plain-language reports when it breaks.",
   "license": "MIT",
   "type": "commonjs",
@@ -33,6 +33,7 @@
     "kryptheon-project.js",
     "kryptheon-store.js",
     "kryptheon-code.js",
+    "kryptheon-keys.js",
     "kryptheon-dashboard.js",
     "kryptheon-dashboard.html",
     "kryptheon-dashboard-page.js",
@@ -50,7 +51,7 @@
     "@playwright/test": "^1.62.1"
   },
   "scripts": {
-    "check": "node kryptheon-store.check.js && node kryptheon-code.check.js && node kryptheon-dashboard.check.js && node kryptheon-changes.check.js && node kryptheon-look.check.js && node kryptheon-verify.check.js && node kryptheon-recheck.check.js && node kryptheon-reporter.check.js && node kryptheon-signature.check.js && node kryptheon-signature.stream.check.js && node kryptheon-signature.baseline.check.js && node kryptheon-signature.settle.check.js && node kryptheon-signature.number.check.js && node kryptheon-env.check.js && node kryptheon-watchdog.check.js && node kryptheon-record.check.js && node kryptheon-selectors.check.js && node kryptheon-recordings.check.js && node kryptheon-cleanup.check.js && node kryptheon-orphan.check.js && node kryptheon-project.check.js && node kryptheon-setup.check.js && node kryptheon-browser.check.js && node kryptheon-heal.check.js && node kryptheon-load.check.js && node kryptheon-package.check.js",
+    "check": "node kryptheon-store.check.js && node kryptheon-code.check.js && node kryptheon-keys.check.js && node kryptheon-dashboard.check.js && node kryptheon-changes.check.js && node kryptheon-look.check.js && node kryptheon-verify.check.js && node kryptheon-recheck.check.js && node kryptheon-reporter.check.js && node kryptheon-signature.check.js && node kryptheon-signature.stream.check.js && node kryptheon-signature.baseline.check.js && node kryptheon-signature.settle.check.js && node kryptheon-signature.number.check.js && node kryptheon-env.check.js && node kryptheon-watchdog.check.js && node kryptheon-record.check.js && node kryptheon-selectors.check.js && node kryptheon-recordings.check.js && node kryptheon-cleanup.check.js && node kryptheon-orphan.check.js && node kryptheon-project.check.js && node kryptheon-setup.check.js && node kryptheon-browser.check.js && node kryptheon-heal.check.js && node kryptheon-load.check.js && node kryptheon-package.check.js",
     "check:store": "node kryptheon-store.check.js",
     "check:code": "node kryptheon-code.check.js",
     "check:dashboard": "node kryptheon-dashboard.check.js",