launchprep 0.0.1 → 0.1.0

package/src/checks-authz.mjs

@@ -0,0 +1,179 @@
+// Authorization: "is THIS user allowed to touch THIS record?"
+// The corpus calls this the most common real-world vulnerability, and it is the
+// family most likely to find something true in a vibe-coded app.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+const lineOf = (text, index) => text.slice(0, index).split('\n').length;
+
+// Everything between a handler's opening brace and its matching close, so we can
+// ask "does this handler mention the logged-in user anywhere?"
+function functionBodies(text) {
+  const out = [];
+  const re = /(export\s+(?:default\s+)?(?:async\s+)?function\s+\w*|(?:export\s+)?const\s+\w+\s*=\s*(?:async\s*)?\([^)]*\)\s*=>|app\.(?:get|post|put|patch|delete)\s*\([^,]+,\s*(?:async\s*)?\([^)]*\)\s*=>)/g;
+  let m;
+  while ((m = re.exec(text))) {
+    const start = text.indexOf('{', m.index + m[0].length - 1);
+    if (start === -1) continue;
+    let depth = 0, i = start;
+    for (; i < text.length; i++) {
+      if (text[i] === '{') depth++;
+      else if (text[i] === '}') { depth--; if (!depth) break; }
+    }
+    out.push({ start: m.index, body: text.slice(start, i + 1) });
+  }
+  return out;
+}
+
+const SESSION_HINT =
+  /\b(session|getUser|currentUser|auth\(\)|getServerSession|req\.user|ctx\.user|userId|user_id|authUser|locals\.user|clerkId|auth\.uid)\b/;
+const TENANT_HINT =
+  /\b(orgId|org_id|tenantId|tenant_id|workspaceId|workspace_id|teamId|team_id)\b/;
+// no trailing \b: the alternation can end in '(' , where there is no word boundary
+const ID_FROM_REQUEST =
+  /\b(?:params\.(?:id|\w+Id)|searchParams\.get\(|req\.query\.\w*[iI]d|body\.\w*[iI]d)/;
+const DB_READ =
+  /\b(findUnique|findFirst|findById|findOne|\.select\s*\(|\.from\s*\(|db\.query\.|\.eq\s*\(\s*['"]id['"])/;
+
+export const AUTHZ_CHECKS = [
+
+// ---- Supabase: RLS left off ------------------------------------------------
+{ id: 'AUTHZ-001', run(repo, profile) {
+    if (profile.stack?.database !== 'supabase') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.sql$/.test(f.path)) continue;
+      const created = new Map();
+      const cre = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["`]?(?:public\.)?["`]?(\w+)/gi;
+      let m;
+      while ((m = cre.exec(f.text))) created.set(m[1].toLowerCase(), m.index);
+
+      const enabled = new Set();
+      const ena = /ALTER\s+TABLE\s+["`]?(?:public\.)?["`]?(\w+)["`]?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi;
+      while ((m = ena.exec(f.text))) enabled.add(m[1].toLowerCase());
+
+      for (const [table, idx] of created) {
+        if (enabled.has(table)) continue;
+        // whole-repo check: RLS may be enabled in a later migration
+        const elsewhere = repo.files.some(o => o.text && o !== f &&
+          new RegExp(`ALTER\\s+TABLE\\s+["\`]?(?:public\\.)?["\`]?${table}["\`]?\\s+ENABLE\\s+ROW`, 'i').test(o.text));
+        if (elsewhere) continue;
+        out.push(finding('AUTHZ-001', `Table "${table}" has row level security turned off`, 'critical',
+          f.path, lineOf(f.text, idx),
+          `Supabase leaves RLS off for tables created in raw SQL. Until it is on, any logged-in user can read and write every row in "${table}" through the public API — not just their own.`,
+          `ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;  then add a policy limiting rows to their owner.`));
+      }
+    }
+    return out;
+  }},
+
+// ---- Supabase: RLS on, but the policy lets everyone through ---------------
+{ id: 'AUTHZ-002', run(repo, profile) {
+    if (profile.stack?.database !== 'supabase') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.sql$/.test(f.path)) continue;
+      const re = /CREATE\s+POLICY\s+["`]?([^"`\s]+)["`]?[\s\S]{0,300}?(USING|WITH\s+CHECK)\s*\(\s*(true|1\s*=\s*1)\s*\)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('AUTHZ-002', `Policy "${m[1]}" allows every row`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The dashboard will show RLS as enabled, so this looks protected. USING (true) means every row matches for every user, which is the same as having no policy at all.',
+          "Replace true with an ownership test, e.g. USING (auth.uid() = user_id)."));
+      }
+    }
+    return out;
+  }},
+
+// ---- IDOR: fetch by id with nobody checking ownership ---------------------
+{ id: 'AUTHZ-003', run(repo, profile) {
+    if (!profile.has_accounts) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
+      if (!/\/(api|routes?|server|controllers?|actions?)\//.test(f.path)) continue;
+      for (const { start, body } of functionBodies(f.text)) {
+        if (!ID_FROM_REQUEST.test(body)) continue;
+        if (!DB_READ.test(body)) continue;
+        if (SESSION_HINT.test(body) || TENANT_HINT.test(body)) continue;
+        out.push(finding('AUTHZ-003', 'Record fetched by id with no ownership check', 'critical',
+          f.path, lineOf(f.text, start),
+          'This handler takes an id straight from the request and looks it up, without checking the record belongs to the person logged in. Changing the id in the URL returns somebody else\'s data.',
+          'Add the signed-in user or organisation to the query itself, e.g. where: { id, orgId: session.orgId }.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- tenant scope missing on a multi-tenant query ------------------------
+{ id: 'AUTHZ-006', run(repo, profile) {
+    if (profile.tenancy !== 'multi-tenant-shared-db') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
+      if (!/\/(api|routes?|server|controllers?|actions?)\//.test(f.path)) continue;
+      for (const { start, body } of functionBodies(f.text)) {
+        if (!/\b(findMany|\.select\s*\(|db\.query\.\w+\.findMany)\b/.test(body)) continue;
+        if (TENANT_HINT.test(body)) continue;
+        if (!SESSION_HINT.test(body)) continue;   // unauthenticated routes are AUTHZ-003's job
+        out.push(finding('AUTHZ-006', 'List query is not limited to the user\'s organisation', 'critical',
+          f.path, lineOf(f.text, start),
+          'Your app stores several organisations in one database. This query knows who is logged in but never filters by their organisation, so it can return other customers\' rows.',
+          'Add the tenant key to the query, e.g. where: { orgId: session.orgId }.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- admin area with only a client-side guard -----------------------------
+{ id: 'AUTHZ-004', run(repo, profile) {
+    if (!profile.has_admin_panel) return [];
+    const out = [];
+    const server = repo.files.filter(f => f.text && /\/admin\//i.test(f.path) &&
+      /\.(ts|js|mjs)$/.test(f.path) && /\/(api|server|actions?)\//.test(f.path));
+    const guarded = server.some(f => /\b(role|isAdmin|is_admin|permission|hasRole)\b/.test(f.text) &&
+      SESSION_HINT.test(f.text));
+    if (server.length && !guarded) {
+      out.push(finding('AUTHZ-004', 'Admin endpoints have no server-side role check', 'critical',
+        server[0].path, 1,
+        'Hiding the admin UI does not protect the endpoints behind it. Anyone who knows the URL can call them directly.',
+        'Check the signed-in user\'s role on the server in every admin route, not only in the page that renders it.'));
+    }
+    return out;
+  }},
+
+// ---- mass assignment ------------------------------------------------------
+{ id: 'API-001', run(repo) {
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
+      const re = /(?:data|values)\s*:\s*(?:\{\s*\.\.\.\s*(?:req\.)?body\b|(?:req\.)?body\s*[,}])|\.(?:create|update|insert)\s*\(\s*(?:req\.)?body\s*\)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('API-001', 'Request body written straight to the database', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Every field the caller sends is saved, including ones your form never shows. That is how a user sets their own role to admin, or their own plan to unlimited.',
+          'Pick the fields explicitly, or validate the body against a schema before saving it.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- Supabase storage bucket left public ---------------------------------
+{ id: 'SUP-001', run(repo, profile) {
+    if (profile.stack?.database !== 'supabase' || !profile.has_file_uploads) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text) continue;
+      const re = /(?:INSERT\s+INTO\s+storage\.buckets[\s\S]{0,200}?\btrue\b)|createBucket\s*\([^)]*public\s*:\s*true/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('SUP-001', 'Storage bucket is public', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'A public bucket serves every file in it to anyone with the URL, with no login required.',
+          'Make the bucket private and serve files through signed URLs.'));
+      }
+    }
+    return out;
+  }},
+];

package/src/checks-batch2.mjs

@@ -0,0 +1,385 @@
+// The remaining critical and high tier-1 checks.
+// Lesson applied throughout: judge the line, read the value, never the name alone.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+const lineAt = (t, i) => {
+  const a = t.lastIndexOf('\n', i) + 1;
+  const b = t.indexOf('\n', i);
+  return t.slice(a, b === -1 ? t.length : b);
+};
+const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
+const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
+
+export const BATCH2_CHECKS = [
+
+// ---- payments ------------------------------------------------------------
+{ id: 'PAY-001', run(repo, profile) {
+    if (profile.handles_payments === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path) && !/\.py$/.test(f.path)) continue;
+      // a file whose PATH says webhook is a webhook. only files that merely mention
+      // one need corroborating that a payment provider is involved.
+      const pathSaysWebhook = /webhook/i.test(f.path);
+      const textSaysWebhook = /webhook/i.test(f.text.slice(0, 800));
+      if (!pathSaysWebhook && !textSaysWebhook) continue;
+      if (!pathSaysWebhook && !/(stripe|paddle|lemonsqueezy|payment|checkout)/i.test(f.text)) continue;
+      if (/constructEvent|construct_event|verify_header|Webhook\.verify|checkSignature|stripe-signature|verifyWebhook/i.test(f.text)) continue;
+      out.push(finding('PAY-001', 'Payment webhook does not verify its signature', 'critical',
+        f.path, 1,
+        'Without signature verification this endpoint accepts a payment notification from anyone who knows the URL. It is an unauthenticated "mark this order paid" API.',
+        'Verify with the provider SDK before trusting the body — stripe.webhooks.constructEvent(raw, sig, secret).'));
+    }
+    return out;
+  }},
+
+{ id: 'PAY-006', run(repo, profile) {
+    if (profile.handles_payments === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path)) continue;
+      const re = /(?:amount|unit_amount|price)\s*:\s*(?:Number\(|parseInt\(|parseFloat\()?\s*(?:req\.body|body|params|searchParams\.get\(|data)\.?/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 500), m.index + 200);
+        if (!/(paymentIntents|checkout\.sessions|charges|subscriptions)\.create|stripe\./i.test(around)) continue;
+        out.push(finding('PAY-006', 'Charge amount comes from the request', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The caller decides what they pay. Change the number in the request and the product costs whatever they like.',
+          'Look the price up on the server from your own catalogue, keyed by product id.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- api -----------------------------------------------------------------
+{ id: 'API-005', run(repo, profile) {
+    if (profile.stack?.database === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path)) continue;
+      const re = /(?:orderBy|order|sort|sortBy|groupBy)\s*:\s*(?:req\.query|searchParams\.get\(|body|params)\.?/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 300);
+        if (/ALLOWED_SORT|SORT_FIELDS|includes\(|z\.enum|Object\.keys|switch/i.test(around)) continue;
+        out.push(finding('API-005', 'Sort or grouping column taken from the request', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Column names cannot be parameterised the way values can, so this is pasted into the query. A caller can order by a column you never meant to expose, or worse.',
+          'Map the incoming value through a fixed allowlist of sortable columns.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'API-003', run(repo, profile) {
+    if (!profile.is_public || profile.stage !== 'production') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path) || !isServer(f.path)) continue;
+      const re = /(?:stack|e\.stack|err\.stack|error\.stack)\s*[,}\]]/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const line = lineAt(f.text, m.index);
+        if (!/(res\.|Response\.json|json\(|send\(|return\s*\{)/.test(line)) continue;
+        if (/console\.|logger\.|log\(/.test(line)) continue;   // logging a stack is correct
+        out.push(finding('API-003', 'Stack trace returned to the caller', 'high',
+          f.path, lineOf(f.text, m.index),
+          'A stack trace names your file paths, your dependencies and their versions — a map of your application handed to whoever can trigger an error.',
+          'Log the stack server-side, return a generic message and a reference id.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- next.js -------------------------------------------------------------
+{ id: 'NEXT-006', run(repo, profile) {
+    if (profile.stack?.framework !== 'next') return [];
+    const out = [];
+    const SECRETISH = /(SECRET|PRIVATE|SERVICE_ROLE|_KEY|TOKEN|PASSWORD|DATABASE_URL)/;
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path)) continue;
+      if (!/^\s*['"]use client['"]/m.test(f.text.slice(0, 400))) continue;
+      const re = /process\.env\.([A-Z0-9_]+)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (m[1].startsWith('NEXT_PUBLIC_')) continue;
+        if (!SECRETISH.test(m[1])) continue;
+        out.push(finding('NEXT-006', `${m[1]} read inside a client component`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          "This file is marked 'use client', so it is compiled into the browser bundle. A server-only variable read here is either undefined at runtime or, if it builds, shipped to every visitor.",
+          'Read it in a server component or route handler and pass down only what the browser needs.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'NEXT-014', run(repo, profile) {
+    if (profile.stack?.framework !== 'next' || !profile.has_accounts) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path)) continue;
+      const re = /redirect\s*\(\s*(?:searchParams\.get\(\s*['"](?:next|redirect|returnTo|callbackUrl)['"]\s*\)|(?:req\.)?query\.(?:next|redirect|returnTo|callbackUrl))/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index);
+        if (/startsWith\s*\(\s*['"]\/|ALLOWED|new URL\([^)]*origin/.test(around)) continue;
+        out.push(finding('NEXT-014', 'Post-login redirect target comes from the URL', 'high',
+          f.path, lineOf(f.text, m.index),
+          'An attacker sends a login link that bounces through your domain and lands on theirs. The address bar says your site right up until the credentials are typed.',
+          "Accept only paths beginning with a single '/', or check against an allowlist."));
+      }
+    }
+    return out;
+  }},
+
+// ---- storage & uploads ---------------------------------------------------
+{ id: 'DATA-014', run(repo, profile) {
+    if (!profile.has_file_uploads) return [];
+    const EPHEMERAL = ['vercel', 'netlify', 'cloudflare', 'railway', 'fly', 'render'];
+    if (!EPHEMERAL.includes(profile.stack?.host)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path) && !/\.py$/.test(f.path)) continue;
+      const re = /(?:writeFile|writeFileSync|createWriteStream|copyFile)\s*\(\s*([^,)]+)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const target = m[1];
+        if (/tmpdir\(|['"]\/tmp|os\.tmp/.test(target)) continue;         // /tmp is expected
+        if (!/(upload|public|static|storage|media|files|assets)/i.test(target)) continue;
+        out.push(finding('DATA-014', `Uploads written to the ${profile.stack.host} filesystem`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          `${profile.stack.host} gives each deployment a fresh, temporary filesystem. Everything written here disappears the next time you deploy — and users' files disappear with it.`,
+          'Write to object storage — S3, R2, or Supabase Storage — and keep only the key in your database.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'UP-001', run(repo, profile) {
+    if (!profile.has_file_uploads) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isJS(f.path) && !/\.py$/.test(f.path)) continue;
+      const re = /\.(?:endsWith|match)\s*\(\s*['"/][^)]*\.(?:jpg|jpeg|png|gif|pdf|svg|webp)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 600), m.index + 400);
+        if (!/(file|upload|attachment|mimetype|originalname|filename)/i.test(around)) continue;
+        if (/file-type|magic|sharp\(|imghdr|fileTypeFrom/i.test(around)) continue;  // real content check
+        out.push(finding('UP-001', 'File type judged by its name', 'high',
+          f.path, lineOf(f.text, m.index),
+          'The caller chooses the filename, so the extension proves nothing. evil.php.jpg passes this check and is still a PHP file.',
+          'Inspect the actual bytes — file-type, sharp, or python-magic — and reject anything that does not match what it claims.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'UP-005', run(repo, profile) {
+    if (!profile.has_file_uploads) return [];
+    // Only an SVG the app ACCEPTS matters. Every project references its own icons,
+    // so a bare '.svg' proves nothing at all.
+    const ACCEPTS_SVG = [
+      /(?:allowed|accepted|valid|permitted|supported)[_A-Za-z]*(?:types?|mimes?|mime_?types?|formats?|extensions?)[^;\n]{0,220}svg/i,
+      /accept\s*=\s*["'][^"']*svg/i,
+      /fileFilter[\s\S]{0,300}svg/i,
+      /image\/svg\+xml[^;\n]{0,120}(?:allow|accept|upload)/i,
+      /(?:upload|attachment)[_A-Za-z]*(?:types?|formats?)[^;\n]{0,200}svg/i,
+    ];
+    let site = null;
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|tsx|js|jsx|mjs|py|rb|php|json|ya?ml)$/.test(f.path)) continue;
+      const hit = ACCEPTS_SVG.find(re => re.test(f.text));
+      if (hit) { site = { f, m: f.text.search(hit) }; break; }
+    }
+    if (!site) return [];
+    if (repo.grep(/DOMPurify|sanitize-svg|svgo|sanitizeSvg|bleach|scrubber/i).length) return [];
+    return [finding('UP-005', 'SVG uploads accepted without sanitisation', 'high',
+      site.f.path, lineOf(site.f.text, Math.max(site.m, 0)),
+      'An SVG is a document, not a picture. It can carry a <script> tag, and served from your own domain that script runs with your users\' sessions.',
+      'Sanitise with DOMPurify before storing, or serve user-supplied SVGs from a separate origin.')];
+  }},
+
+// ---- supabase ------------------------------------------------------------
+{ id: 'SUP-006', run(repo, profile) {
+    if (!['supabase', 'postgres'].includes(profile.stack?.database)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.sql$/.test(f.path)) continue;
+      const re = /CREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION[\s\S]{0,900}?SECURITY\s+DEFINER/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const block = m[0];
+        if (/SET\s+search_path/i.test(block) ||
+            /SET\s+search_path/i.test(f.text.slice(m.index, m.index + block.length + 300))) continue;
+        out.push(finding('SUP-006', 'SECURITY DEFINER function with no fixed search_path', 'high',
+          f.path, lineOf(f.text, m.index),
+          'The function runs with its owner\'s privileges. Without a pinned search_path, a caller who can create objects can shadow a table name and have their version run as the owner.',
+          "Add: SET search_path = public, pg_temp;"));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'SUP-011', run(repo, profile) {
+    if (profile.stack?.database !== 'supabase') return [];
+    if (!['vercel', 'netlify', 'cloudflare'].includes(profile.stack?.host)) return [];
+    const hits = repo.grep(/db\.[a-z0-9]+\.supabase\.co:5432|:5432\/postgres/i,
+                           /\.(ts|js|mjs|env|ya?ml|json)$/);
+    if (!hits.length) return [];
+    const f = hits[0];
+    return [finding('SUP-011', 'Direct database port used from a serverless host', 'high',
+      f.path, lineOf(f.text, f.text.search(/5432/)),
+      'Every serverless invocation opens its own connection. Against port 5432 you exhaust the connection limit under quite ordinary traffic, and the database starts refusing everyone.',
+      'Use the pooler connection string on port 6543 instead.')];
+  }},
+
+// ---- tenancy -------------------------------------------------------------
+{ id: 'TEN-003', run(repo, profile) {
+    if (profile.tenancy !== 'multi-tenant-shared-db') return [];
+    const inv = repo.grep(/invit(e|ation)/i, /\.(sql|prisma|ts|js|rb|py)$/);
+    if (!inv.length) return [];
+    const hasExpiry = inv.some(f => /expires?_?at|expiry|valid_?until|expires_in/i.test(f.text));
+    if (hasExpiry) return [];
+    return [finding('TEN-003', 'Invitation tokens never expire', 'high',
+      inv[0].path, 1,
+      'An invite link that works forever is a permanent key to your organisation. Forwarded emails, old inboxes and leaked screenshots all stay valid.',
+      'Add expires_at, default it to a few days, and check it on acceptance.')];
+  }},
+
+// ---- real users ----------------------------------------------------------
+{ id: 'RU-013', run(repo, profile) {
+    if (!profile.sends_email || !profile.is_public) return [];
+    const templates = repo.grep(/<html|<body|MIMEText|render_to_string/i, /\.(html|erb|tsx|jsx|ts|js|py|rb)$/)
+      .filter(f => /(email|mail|newsletter|campaign|template)/i.test(f.path));
+    if (!templates.length) return [];
+    if (templates.some(f => /unsubscribe|opt[-_]?out|List-Unsubscribe/i.test(f.text))) return [];
+    return [finding('RU-013', 'Bulk email with no unsubscribe path', 'high',
+      templates[0].path, 1,
+      'Marketing email without a working opt-out is a per-message violation under CAN-SPAM and the GDPR, and it is also how a domain gets blacklisted by mailbox providers.',
+      'Add an unsubscribe link to every non-transactional template and a List-Unsubscribe header.')];
+  }},
+
+{ id: 'RU-007', run(repo, profile) {
+    if (!profile.is_public) return [];
+    if (!['web-app', 'web-site'].includes(profile.surface)) return [];
+    const html = repo.files.filter(f => f.text &&
+      /\.(html|tsx|jsx|erb|vue|svelte)$/.test(f.path) &&
+      /<head|export default function RootLayout|<!DOCTYPE/i.test(f.text));
+    if (!html.length) return [];
+    const all = html.map(f => f.text).join('\n') +
+                (repo.grep(/viewport/i, /\.(ts|tsx|js|jsx)$/).map(f => f.text).join('\n'));
+    if (/viewport/i.test(all)) return [];
+    return [finding('RU-007', 'No viewport meta tag', 'high',
+      html[0].path, 1,
+      'Without it, phones render the page at desktop width and scale it down. Most of your visitors will arrive on a phone and see something they have to pinch to read.',
+      '<meta name="viewport" content="width=device-width, initial-scale=1">')];
+  }},
+
+// ---- observability & legal ----------------------------------------------
+{ id: 'OBS-001', run(repo, profile) {
+    if (profile.stage !== 'production') return [];
+    if (profile.surface === 'library') return [];
+    const has = repo.grep(/@sentry|bugsnag|rollbar|honeybadger|datadog|new relic|appsignal|@opentelemetry/i,
+                          /\.(ts|tsx|js|jsx|mjs|py|rb|json|ya?ml)$/).length;
+    if (has) return [];
+    const anchor = repo.files.find(f => f.text && /package\.json|requirements.*\.txt|Gemfile$/.test(f.path));
+    if (!anchor) return [];
+    return [finding('OBS-001', 'Nothing reports errors from production', 'high',
+      anchor.path, 1,
+      'When this breaks for a user, you find out when they tell you — if they bother. Most people just leave.',
+      'Add an error reporter. Sentry\'s free tier covers a small product entirely.')];
+  }},
+
+{ id: 'LEG-001', run(repo, profile) {
+    if (profile.data_sensitivity === 'none' || !profile.is_public) return [];
+    if (!profile.has_accounts) return [];   // a real product with users, not a template
+    const has = repo.has(/privacy[-_]?policy|privacy\.(html|tsx|jsx|md|erb|vue)|\/privacy\//i) ||
+                repo.grep(/privacy policy/i, /\.(tsx|jsx|html|erb|md|vue|svelte)$/).length > 0;
+    if (has) return [];
+    return [finding('LEG-001', 'No privacy policy, but you collect personal data', 'high',
+      'privacy policy', 1,
+      'The scan found personal fields in your schema and no privacy policy anywhere in the project. In the EU, UK, California and elsewhere the policy is required from the first email address you store — and app stores reject submissions without one.',
+      'Publish one and link it in your footer. It has to name what you collect, why, who else receives it, and how someone deletes it.')];
+  }},
+
+// ---- mobile --------------------------------------------------------------
+{ id: 'MOB-001', run(repo, profile) {
+    if (!['mobile-ios', 'mobile-android'].includes(profile.surface)) return [];
+    const out = [];
+    const PATTERNS = [
+      [/\bsk-ant-[A-Za-z0-9_-]{20,}/g, 'an Anthropic key'],
+      [/\bsk-[A-Za-z0-9]{32,}/g, 'an OpenAI key'],
+      [/\bAKIA[0-9A-Z]{16}\b/g, 'an AWS access key'],
+      [/\bAIza[0-9A-Za-z_-]{35}\b/g, 'a Google API key'],
+    ];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(swift|kt|java|m|h|xml|plist|dart)$/.test(f.path)) continue;
+      for (const [re, label] of PATTERNS) {
+        let m; re.lastIndex = 0;
+        while ((m = re.exec(f.text))) {
+          out.push(finding('MOB-001', `${label} compiled into the app`, 'critical',
+            f.path, lineOf(f.text, m.index),
+            'A shipped binary is a public file. Anyone can download the app and read the strings out of it in about a minute — obfuscation only slows that down.',
+            'Move the call behind your own server and rotate the key. Treat it as already public.'));
+        }
+      }
+    }
+    return out;
+  }},
+
+{ id: 'MOB-002', run(repo, profile) {
+    if (!['mobile-ios', 'mobile-android'].includes(profile.surface)) return [];
+    if (!profile.has_accounts) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(swift|kt|java|dart)$/.test(f.path)) continue;
+      const re = /(UserDefaults\.standard\.set|SharedPreferences[\s\S]{0,120}?\.putString|prefs\.setString)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const line = lineAt(f.text, m.index);
+        if (!/token|jwt|session|password|secret|credential|refresh/i.test(line)) continue;
+        out.push(finding('MOB-002', 'Credential stored outside the secure store', 'high',
+          f.path, lineOf(f.text, m.index),
+          'UserDefaults and SharedPreferences are plain files. On a rooted or jailbroken device, and in some backups, they are readable by other software.',
+          'Use Keychain on iOS or EncryptedSharedPreferences / Keystore on Android.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- deployment ----------------------------------------------------------
+{ id: 'DEP-001', run(repo, profile) {
+    if (!['pre-launch', 'production'].includes(profile.stage)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/(next\.config|vite\.config|nuxt\.config|webpack\.config)/.test(f.path)) continue;
+      const re = /(?:define|env)\s*:\s*\{[\s\S]{0,400}?process\.env\.([A-Z0-9_]*(?:SECRET|KEY|TOKEN|PASSWORD)[A-Z0-9_]*)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (m[1].startsWith('NEXT_PUBLIC_') || m[1].startsWith('VITE_')) continue;
+        out.push(finding('DEP-001', `${m[1]} baked into the build`, 'high',
+          f.path, lineOf(f.text, m.index),
+          'Build-time substitution writes the literal value into the compiled output. It ends up in your bundle, and rotating the key means rebuilding rather than restarting.',
+          'Read it at runtime on the server instead of injecting it at build time.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'DEP-008', run(repo, profile) {
+    if (profile.stage !== 'production') return [];
+    if (!['web-app', 'api-only'].includes(profile.surface)) return [];
+    const has = repo.has(/\/(health|healthz|_health|ping|status)\b/) ||
+                repo.grep(/['"]\/(health|healthz|ping|status)['"]/).length > 0;
+    if (has) return [];
+    const anchor = repo.files.find(f => f.text && isServer(f.path) && isJS(f.path));
+    if (!anchor) return [];
+    return [finding('DEP-008', 'No health endpoint', 'medium',
+      anchor.path, 1,
+      'Your host, your load balancer and any uptime monitor all need one path that answers "am I alive". Without it, a hung process keeps receiving traffic.',
+      'Add GET /health returning 200 once the app can actually serve — including its database connection.')];
+  }},
+];