launchprep 0.0.1 → 0.1.0

package/src/checks-deploy.mjs

@@ -0,0 +1,272 @@
+// Deployment and transport. Mechanically detectable, high volume.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+
+export const DEPLOY_CHECKS = [
+
+// ---- a credential pasted into a CI workflow ------------------------------
+{ id: 'DEP-002', run(repo, profile) {
+    if (!profile.has_ci) return [];
+    const out = [];
+    const SECRET_VALUE = /(sk-ant-[\w-]{15,}|sk-[A-Za-z0-9]{24,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|xox[baprs]-[\w-]{10,}|postgres(?:ql)?:\/\/[^\s"']*:[^\s"'@]+@)/;
+    for (const f of repo.files) {
+      if (!f.text || !/\.(github|gitlab|circleci)|\.ya?ml$/.test(f.path)) continue;
+      if (!/workflows?\/|\.gitlab-ci|circleci/.test(f.path)) continue;
+      f.text.split('\n').forEach((line, i) => {
+        if (/\$\{\{\s*secrets\./.test(line)) return;           // the correct pattern
+        const m = line.match(SECRET_VALUE);
+        if (m) out.push(finding('DEP-002', 'Credential written into the CI config', 'critical',
+          f.path, i + 1,
+          'This value is committed to the repository and printed in build logs. Anyone with read access to either has it.',
+          'Move it to encrypted CI secrets, reference it as ${{ secrets.NAME }}, and rotate the current value.'));
+      });
+    }
+    return out;
+  }},
+
+// ---- verbose errors left on in production --------------------------------
+{ id: 'DEP-015', run(repo, profile) {
+    if (profile.stage !== 'production') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text) continue;
+      if (!/(next\.config|nuxt\.config|vite\.config|settings\.py|config\/environments?\/production|app\.py|main\.py)/.test(f.path)) continue;
+      const re = /\bDEBUG\s*[:=]\s*True\b|\bdebug\s*:\s*true\b|productionBrowserSourceMaps\s*:\s*true/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const isSourcemap = /SourceMaps/.test(m[0]);
+        out.push(finding(isSourcemap ? 'DEP-014' : 'DEP-015',
+          isSourcemap ? 'Source maps published in production' : 'Debug mode enabled in production',
+          'high', f.path, lineOf(f.text, m.index),
+          isSourcemap
+            ? 'Source maps let anyone reconstruct your original source from the deployed bundle, including comments and internal logic.'
+            : 'Debug mode returns stack traces, settings and query fragments to whoever triggers an error.',
+          isSourcemap ? 'Disable source maps for production builds.' : 'Set debug off in the production configuration.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- third-party script with no integrity check --------------------------
+{ id: 'DEP-013', run(repo, profile) {
+    if (!profile.is_public || !['web-app', 'web-site'].includes(profile.surface)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(html|tsx|jsx|vue|svelte|ejs|hbs)$/.test(f.path)) continue;
+      const re = /<script[^>]+src=["']https?:\/\/[^"']+["'][^>]*>/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (/integrity=/.test(m[0])) continue;
+        if (/(googletagmanager|google-analytics|gtag\/js)/.test(m[0])) continue;  // no stable hash published
+        out.push(finding('DEP-013', 'Third-party script loaded without an integrity check', 'medium',
+          f.path, lineOf(f.text, m.index),
+          'If that host is ever compromised, the replacement script runs with full access to your page and your users\' sessions.',
+          'Add an integrity="sha384-..." attribute, or self-host the file.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- CORS open to everyone -----------------------------------------------
+{ id: 'INF-007', run(repo, profile) {
+    if (!['web-app', 'api-only'].includes(profile.surface)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs|py)$/.test(f.path)) continue;
+      const re = /Access-Control-Allow-Origin["']?\s*[:,]\s*["']\*["']|cors\s*\(\s*\{[^}]{0,200}origin\s*:\s*["']\*["']|allow_origins\s*=\s*\[\s*["']\*["']/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 300), m.index + 300);
+        const credentialed = /credentials\s*:\s*true|allow_credentials\s*=\s*True|withCredentials/.test(around);
+        out.push(finding('INF-007',
+          credentialed ? 'CORS allows any origin with credentials' : 'CORS allows any origin',
+          credentialed ? 'critical' : 'medium',
+          f.path, lineOf(f.text, m.index),
+          credentialed
+            ? 'Any website can call your API with the visitor\'s cookies attached and read the response. That is a cross-site account takeover.'
+            : 'Any website can call this API from a browser. Fine for a genuinely public API, wrong for anything user-specific.',
+          'List the origins you actually serve instead of "*".'));
+      }
+    }
+    return out;
+  }},
+
+// ---- redirect target taken from the URL ----------------------------------
+{ id: 'API-013', run(repo, profile) {
+    if (!profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
+      const re = /redirect\s*\(\s*(?:req\.query\.\w+|searchParams\.get\(['"][^'"]+['"]\)|params\.\w*(?:url|next|return|redirect)\w*)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 300), m.index);
+        if (/startsWith\s*\(\s*['"]\//.test(around) || /allowlist|ALLOWED_|new URL\([^)]*,\s*origin/i.test(around)) continue;
+        out.push(finding('API-013', 'Redirect target comes from the request', 'high',
+          f.path, lineOf(f.text, m.index),
+          'An attacker can send a link that passes through your domain and lands on theirs. It reads as your site in the address bar, which is what makes phishing work.',
+          'Only redirect to paths on your own site, or check the destination against an allowlist.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- server fetches a URL the user supplied ------------------------------
+{ id: 'API-014', run(repo, profile) {
+    if (!profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs|py)$/.test(f.path)) continue;
+      if (!/\/(api|routes?|server|actions?)\//.test(f.path)) continue;
+      const re = /\b(?:fetch|axios\.get|axios\.post|requests\.get|httpx\.get)\s*\(\s*(?:req\.body\.\w+|body\.\w*url\w*|params\.\w*url\w*|searchParams\.get\([^)]*\)|\w*userUrl\w*)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index);
+        if (/allowlist|ALLOWED_HOST|isPrivateIp|new URL\([^)]*\)\.hostname\s*===/i.test(around)) continue;
+        out.push(finding('API-014', 'Server fetches a URL chosen by the caller', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Your server will fetch whatever address it is given, including internal ones. On a cloud host that reaches the metadata service, which hands out credentials.',
+          'Check the host against an allowlist and refuse private or link-local addresses.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- no ceiling on how much a caller can request -------------------------
+{ id: 'API-004', run(repo, profile) {
+    if (!profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
+      if (!/\/(api|routes?|server)\//.test(f.path)) continue;
+      const re = /\b(?:take|limit|pageSize|per_page|perPage)\s*:\s*(?:Number\()?(?:req\.query\.\w+|searchParams\.get\([^)]*\)|body\.\w+|params\.\w+)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 300);
+        if (/Math\.min|MAX_(PAGE|LIMIT)|\.max\(|z\.number\(\)[^;]*\.max\(/.test(around)) continue;
+        out.push(finding('API-004', 'Page size taken from the request with no maximum', 'medium',
+          f.path, lineOf(f.text, m.index),
+          'A caller can ask for every row in one request. That is a slow query, a large response and an easy way to knock the app over.',
+          'Clamp it, e.g. Math.min(requested ?? 20, 100).'));
+      }
+    }
+    return out;
+  }},
+
+// ---- no body size limit ---------------------------------------------------
+{ id: 'DATA-008', run(repo, profile) {
+    if (!profile.is_public) return [];
+    const express = repo.grep(/express\.json\s*\(|bodyParser\.json\s*\(/);
+    if (!express.length) return [];
+    const limited = express.some(f => /json\s*\(\s*\{[^}]*limit\s*:/.test(f.text));
+    if (limited) return [];
+    const f = express[0];
+    return [finding('DATA-008', 'No limit on request body size', 'medium',
+      f.path, lineOf(f.text, f.text.search(/express\.json|bodyParser\.json/)),
+      'A single request can send a body large enough to exhaust memory. No account needed.',
+      'Pass a limit, e.g. express.json({ limit: "1mb" }).')];
+  }},
+
+// ---- SQL built by string concatenation -----------------------------------
+{ id: 'DATA-007', run(repo) {
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs|py)$/.test(f.path)) continue;
+      const re = /(?:query|execute|raw|exec)\s*\(\s*(?:`[^`]*\$\{[^}]+\}[^`]*`|['"][^'"]*['"]\s*\+\s*\w+)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (!/\b(select|insert|update|delete|from|where|drop|alter)\b/i.test(m[0])) continue;
+        const interp = m[0].match(/\$\{([^}]+)\}/)?.[1] || '';
+        if (/^(sql|Prisma\.|schema|table)/i.test(interp.trim())) continue;
+        out.push(finding('DATA-007', 'SQL query built by joining strings', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'A value is being pasted into the query text. If any part of it comes from a user, they can change what the query does — that is SQL injection.',
+          'Use parameterised queries, e.g. db.query("... WHERE id = $1", [id]).'));
+      }
+    }
+    return out;
+  }},
+
+// ---- money stored as a float ---------------------------------------------
+{ id: 'RU-003', run(repo, profile) {
+    if (profile.handles_payments === 'none' && profile.data_sensitivity !== 'financial') return [];
+    const out = [];
+    const MONEY = /\b(price|amount|total|balance|cost|fee|subtotal|revenue|salary)\w*\b/i;
+    for (const f of repo.files) {
+      if (!f.text || !/\.(sql|prisma|ts)$/.test(f.path)) continue;
+      const re = /(?:^|[(,])\s*["`]?(\w*(?:price|amount|total|balance|cost|fee|subtotal)\w*)["`]?\s+(float|double precision|real|Float)\b|(\w*(?:price|amount|total|balance|cost|fee)\w*)\s*:\s*(?:doublePrecision|real)\s*\(/gim;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const col = m[1] || m[3];
+        if (!MONEY.test(col)) continue;
+        out.push(finding('RU-003', `Money column "${col}" stored as a floating point number`, 'high',
+          f.path, lineOf(f.text, m.index),
+          'Floats cannot represent decimal money exactly. 0.1 + 0.2 is not 0.3, and those fractions of a cent accumulate into totals that do not reconcile.',
+          'Store money as integer minor units (cents) or as a decimal/numeric type.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- timestamps with no timezone -----------------------------------------
+{ id: 'RU-001', run(repo, profile) {
+    if (profile.stack?.database === 'none') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(sql|ts)$/.test(f.path)) continue;
+      if (!/CREATE TABLE|pgTable\s*\(/i.test(f.text)) continue;
+      const re = /\btimestamp\s+without\s+time\s+zone\b|\btimestamp\s*\(\s*["'`]\w+["'`]\s*\)(?!\s*\.?\s*\{?[^)]*withTimezone)/gi;
+      let m, count = 0;
+      while ((m = re.exec(f.text)) && count < 1) {
+        count++;
+        out.push(finding('RU-001', 'Timestamps stored without a timezone', 'high',
+          f.path, lineOf(f.text, m.index),
+          'The app works perfectly until a user is in a different timezone from the server. Then times drift, "today" is wrong, and scheduled things fire at the wrong hour.',
+          'Use timestamptz (timestamp with time zone), and store UTC.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- 3-byte utf8 that emoji will break -----------------------------------
+{ id: 'DATA-009', run(repo, profile) {
+    if (!['mysql', 'planetscale'].includes(profile.stack?.database)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.sql$/.test(f.path)) continue;
+      const re = /CHARACTER SET\s+utf8\b(?!mb4)|CHARSET\s*=\s*utf8\b(?!mb4)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('DATA-009', 'Text columns cannot hold 4-byte characters', 'medium',
+          f.path, lineOf(f.text, m.index),
+          'MySQL\'s "utf8" only stores 3-byte characters. An emoji is 4 bytes, so the insert fails and the request errors — which is exactly the crash in your research.',
+          'Use utf8mb4 for the charset and collation.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- upload path built from the caller's filename ------------------------
+{ id: 'UP-003', run(repo, profile) {
+    if (!profile.has_file_uploads) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(ts|js|mjs|py)$/.test(f.path)) continue;
+      // only a path handed to a filesystem write - a filename inside a log
+      // message or a URL is not path traversal
+      const re = /(?:path\.)?(?:join|resolve)\s*\([^)]*\b(?:file\.originalname|file\.filename|originalname)\b[^)]*\)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 500), m.index + 500);
+        if (/basename\s*\(|sanitize|randomUUID|nanoid|crypto\.random|uuidv4/.test(around)) continue;
+        if (!/(writeFile|createWriteStream|rename|copyFile|mkdir|\.save\(|fs\.promises)/.test(around)) continue;
+        out.push(finding('UP-003', 'Storage path built from the uploaded filename', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'A filename like ../../.env writes outside the upload folder. The caller chooses that name.',
+          'Generate your own filename (a UUID) and keep the original only as a display label.'));
+      }
+    }
+    return out;
+  }},
+];

package/src/checks-frameworks.mjs

@@ -0,0 +1,337 @@
+// Django and Rails. Both ship deliberately permissive defaults for local
+// development, and both document exactly which ones must change before deploying.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+
+// a settings file that is meant for production, not somebody's laptop
+const isProdSettings = (p) =>
+  /settings/i.test(p) && !/local|dev|development|test|example|template/i.test(p);
+const prodEnvRb = (p) => /config\/environments\/production\.rb$/.test(p);
+
+export const FRAMEWORK_CHECKS = [
+
+// ============================ DJANGO ============================
+
+{ id: 'DJ-001', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    if (!['pre-launch', 'production'].includes(profile.stage)) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path) || !isProdSettings(f.path)) continue;
+      const m = /^\s*DEBUG\s*=\s*True\b/m.exec(f.text);
+      if (!m) continue;
+      out.push(finding('DJ-001', 'Django DEBUG is on', 'critical',
+        f.path, lineOf(f.text, m.index),
+        'With DEBUG on, any error returns a page listing your settings, your installed apps, the SQL that ran and a full traceback — to whoever triggered it. Django\'s own documentation calls deploying this way a security problem.',
+        'Set DEBUG = False for production and populate ALLOWED_HOSTS.'));
+    }
+    return out;
+  }},
+
+{ id: 'DJ-002', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path) || !/settings/i.test(f.path)) continue;
+      const re = /^\s*SECRET_KEY\s*=\s*(['"])([^'"]{16,})\1/gm;
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (/^(django-insecure-)?(changeme|your|xxx|placeholder|secret)/i.test(m[2])) continue;
+        out.push(finding('DJ-002', 'Django SECRET_KEY is written into the source', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'SECRET_KEY signs session cookies, password-reset links and CSRF tokens. Anyone holding it can forge a session for any account, including staff.',
+          'Read it from an environment variable, and rotate the key that is currently committed.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'DJ-003', run(repo, profile) {
+    if (profile.stack?.framework !== 'django' || !profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path) || !isProdSettings(f.path)) continue;
+      const m = /^\s*ALLOWED_HOSTS\s*=\s*\[[^\]]*['"]\*['"]/m.exec(f.text);
+      if (!m) continue;
+      out.push(finding('DJ-003', 'ALLOWED_HOSTS accepts any host', 'high',
+        f.path, lineOf(f.text, m.index),
+        'Accepting any Host header lets an attacker poison the links Django generates. Password-reset emails then arrive pointing at their domain instead of yours.',
+        'List your real domains.'));
+    }
+    return out;
+  }},
+
+{ id: 'DJ-004', run(repo, profile) {
+    if (profile.stack?.framework !== 'django' || !profile.has_accounts) return [];
+    const settings = repo.files.filter(f => f.text && /\.py$/.test(f.path) &&
+      isProdSettings(f.path) && /MIDDLEWARE\s*=/.test(f.text));
+    if (!settings.length) return [];
+    const missing = settings.filter(f => !/CsrfViewMiddleware/.test(f.text));
+    if (!missing.length) return [];
+    const f = missing[0];
+    return [finding('DJ-004', 'CSRF middleware has been removed', 'critical',
+      f.path, lineOf(f.text, f.text.search(/MIDDLEWARE\s*=/)),
+      'Django enables CSRF protection by default, so its absence means it was deliberately taken out. Without it, another site can make state-changing requests using your users\' logged-in sessions.',
+      'Restore django.middleware.csrf.CsrfViewMiddleware to MIDDLEWARE.')];
+  }},
+
+{ id: 'DJ-006', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path)) continue;
+      const re = /\.(raw|extra)\s*\(\s*(f?['"])/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const call = f.text.slice(m.index, m.index + 400);
+        const interpolated = m[2].startsWith('f') || /%\s*\(|\.format\s*\(|['"]\s*\+\s*\w/.test(call);
+        if (!interpolated) continue;
+        out.push(finding('DJ-006', `SQL built by interpolation in .${m[1]}()`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          'A value is being pasted into the query text rather than passed as a parameter. If any part of it comes from a request, the caller can rewrite the query.',
+          "Use the params argument: .raw('SELECT … WHERE id = %s', [id])"));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'DJ-008', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    if (!profile.has_accounts || profile.stage !== 'production') return [];
+    const settings = repo.files.filter(f => f.text && /\.py$/.test(f.path) && isProdSettings(f.path));
+    if (!settings.length) return [];
+    const all = settings.map(f => f.text).join('\n');
+    const missing = [];
+    if (!/SESSION_COOKIE_SECURE\s*=\s*True/.test(all)) missing.push('SESSION_COOKIE_SECURE');
+    if (!/CSRF_COOKIE_SECURE\s*=\s*True/.test(all))    missing.push('CSRF_COOKIE_SECURE');
+    if (!missing.length) return [];
+    return [finding('DJ-008', `${missing.join(' and ')} not enabled`, 'high',
+      settings[0].path, 1,
+      'Without these, the session and CSRF cookies are sent over plain HTTP as well as HTTPS — readable by anyone sharing the network on the first request.',
+      'Set both to True in production settings.')];
+  }},
+
+{ id: 'DJ-010', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path)) continue;
+      const re = /^\s*fields\s*=\s*['"]__all__['"]/gm;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 900), m.index);
+        if (!/class\s+\w+\s*\((?:[^)]*\b(ModelForm|ModelSerializer|HyperlinkedModelSerializer)\b[^)]*)\)/.test(around)) continue;
+        out.push(finding('DJ-010', "Form or serializer accepts every field", 'critical',
+          f.path, lineOf(f.text, m.index),
+          "fields = '__all__' makes every column on the model writable from the request — including is_staff, is_superuser, and any credit or plan field you keep there.",
+          'List the fields you actually intend to accept.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'DJ-014', run(repo, profile) {
+    if (profile.stack?.framework !== 'django') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path)) continue;
+      const m = /SESSION_SERIALIZER\s*=\s*['"][^'"]*PickleSerializer/.exec(f.text);
+      if (!m) continue;
+      out.push(finding('DJ-014', 'Sessions are serialised with pickle', 'critical',
+        f.path, lineOf(f.text, m.index),
+        'Pickle reconstructs arbitrary Python objects. Combined with a leaked SECRET_KEY this is remote code execution, not merely session forgery.',
+        'Use the default JSONSerializer.'));
+    }
+    return out;
+  }},
+
+{ id: 'DJ-016', run(repo, profile) {
+    if (profile.stack?.framework !== 'django' || profile.stage !== 'production') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.py$/.test(f.path) || !isProdSettings(f.path)) continue;
+      const m = /['"](debug_toolbar|django_extensions|silk)['"]/.exec(f.text);
+      if (!m) continue;
+      out.push(finding('DJ-016', `${m[1]} is installed in production settings`, 'high',
+        f.path, lineOf(f.text, m.index),
+        'These development tools expose SQL, settings, and in the case of django_extensions a Python shell. They are not meant to be reachable in production.',
+        'Move it into your development settings only.'));
+    }
+    return out;
+  }},
+
+// ============================ RAILS ============================
+
+{ id: 'RB-001', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(rb|ya?ml)$/.test(f.path)) continue;
+      const re = /secret_key_base\s*[:=]\s*['"]?([a-f0-9]{40,})/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('RB-001', 'secret_key_base is committed', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'This key signs every session cookie. Anyone who has it can mint a valid session for any user, including an administrator.',
+          'Move it to encrypted credentials or the environment, and rotate it — treat the committed value as public.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-002', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    if (profile.stage !== 'production' || !profile.is_public) return [];
+    const f = repo.files.find(x => x.text && prodEnvRb(x.path));
+    if (!f) return [];
+    if (/^\s*config\.force_ssl\s*=\s*true/m.test(f.text)) return [];
+    return [finding('RB-002', 'config.force_ssl is not enabled', 'high',
+      f.path, 1,
+      'One line turns on the HTTPS redirect, secure cookies and HSTS together. Without it, a first request over plain HTTP carries the session cookie in clear text.',
+      'config.force_ssl = true')];
+  }},
+
+{ id: 'RB-003', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails' || !profile.has_accounts) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/app\/controllers\/.*\.rb$/.test(f.path)) continue;
+      const re = /skip_before_action\s+:verify_authenticity_token|protect_from_forgery\s+with:\s*:null_session/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('RB-003', 'CSRF protection switched off', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Any site your users visit can now make state-changing requests to this controller using their logged-in session.',
+          'Remove the skip. If this is a machine-to-machine endpoint, authenticate it with a token and keep it out of the session-based controllers.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-004', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(rb|erb|haml|slim)$/.test(f.path)) continue;
+      const re = /(?:raw\s*\(|\.html_safe|<%==)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        // judge the line itself, not a 200-character neighbourhood - in Rails an
+        // instance variable appears on every other line and proves nothing
+        const from = f.text.lastIndexOf('\n', m.index) + 1;
+        const to = f.text.indexOf('\n', m.index);
+        const line = f.text.slice(from, to === -1 ? f.text.length : to);
+
+        // `.to_json.html_safe` is the documented, safe way to embed JSON in a script tag
+        if (/\.to_json\s*\.html_safe/.test(line)) continue;
+        // app-controlled values, not user content
+        if (/\bflash\b|_config|locale|_urls?\b|asset|csrf|javascript_tag|stylesheet|image_tag|\bt\(|I18n|sanitize\s*\(|\.svg|icon/i.test(line)) continue;
+        // require something that actually looks like it came from a person
+        if (!/params\[|\b(comment|post|review|bio|about|description|body|content|message|note|answer|signature|profile)\b/i.test(line)) continue;
+        out.push(finding('RB-004', 'HTML escaping turned off on dynamic content', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'ERB escapes output by default. This switches that off for a value that appears to come from your data, so anything a user stored can execute as script in another user\'s browser.',
+          'Render it normally, or pass it through sanitize() with an allowlist.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-005', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.rb$/.test(f.path)) continue;
+      const re = /\.(where|find_by_sql|order|group|having|pluck)\s*\(\s*"[^"]*#\{/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('RB-005', `SQL interpolation in .${m[1]}()`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The value is being pasted into the SQL text. If it derives from a request, the caller controls the query.',
+          "Use a placeholder: where('email = ?', email)"));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-006', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.rb$/.test(f.path)) continue;
+      const re = /params(?:\.require\([^)]*\))?\.permit!/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('RB-006', 'Strong parameters bypassed with permit!', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'permit! accepts every attribute the caller sent, not the ones your form shows. That is how a user sets their own role, plan, or account balance.',
+          'List the attributes explicitly: params.require(:user).permit(:name, :email)'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-008', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.rb$/.test(f.path)) continue;
+      const re = /(Marshal\.load|YAML\.load(?!_file|_safe)|Oj\.load)\s*\(/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 260), m.index + 160);
+        if (!/params|request|body|payload|cookie|@\w+/.test(around)) continue;
+        out.push(finding('RB-008', `Unsafe deserialisation via ${m[1]}`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          'These reconstruct arbitrary Ruby objects from the input. Given attacker-controlled data that has historically meant remote code execution.',
+          'Use YAML.safe_load, or JSON.parse for data you did not create.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-009', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.rb$/.test(f.path)) continue;
+      const re = /(send_file|send_data|render\s+file:)\s*[^,\n]*params\[/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 300), m.index + 200);
+        if (/File\.basename|sanitize_filename|allowlist|ALLOWED/.test(around)) continue;
+        out.push(finding('RB-009', 'File served from a caller-supplied path', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The filesystem is happy to accept ../../config/master.key as a filename. The caller chooses this path.',
+          'Look the file up by database id and derive the path yourself, never from the request.'));
+      }
+    }
+    return out;
+  }},
+
+{ id: 'RB-011', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails' || !profile.has_accounts) return [];
+    const f = repo.files.find(x => x.text && /config\/initializers\/filter_parameter_logging\.rb$/.test(x.path));
+    const app = repo.files.find(x => x.text && /config\/application\.rb$/.test(x.path));
+    const text = (f?.text || '') + (app?.text || '');
+    if (!text) return [];
+    if (/filter_parameters\s*\+?=\s*\[[^\]]*password/i.test(text)) return [];
+    return [finding('RB-011', 'Passwords are not filtered out of the logs', 'high',
+      (f || app).path, 1,
+      'Rails logs request parameters. Without a filter, every sign-in writes a plaintext password into production logs — which get shipped, backed up and searched.',
+      'config.filter_parameters += [:password, :password_confirmation, :token, :secret]')];
+  }},
+
+{ id: 'RB-012', run(repo, profile) {
+    if (profile.stack?.framework !== 'rails' || profile.stage !== 'production') return [];
+    const f = repo.files.find(x => x.text && prodEnvRb(x.path));
+    if (!f) return [];
+    const m = /^\s*config\.consider_all_requests_local\s*=\s*true/m.exec(f.text);
+    if (!m) return [];
+    return [finding('RB-012', 'Detailed exception pages enabled in production', 'high',
+      f.path, lineOf(f.text, m.index),
+      'Every 500 returns a full stack trace with source lines and local variable values to whoever triggered it.',
+      'config.consider_all_requests_local = false')];
+  }},
+];