launchprep 0.0.1 → 0.2.0

package/src/checks-ai.mjs

@@ -0,0 +1,255 @@
+// AI cost and safety. Barely covered by the corpus, which is exactly why it
+// matters: this is the family nobody else is checking.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+const lineOf = (text, i) => text.slice(0, i).split('\n').length;
+const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
+const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|lib|services?)\//.test(p);
+const isClient = (p) => /\/(components?|pages?|app|src)\//.test(p) && !isServer(p);
+
+const LLM_CALL = /\.(messages|chat\.completions|completions|responses)\.create\s*\(|generateText\s*\(|streamText\s*\(|\.generateContent\s*\(/;
+
+export const AI_CHECKS = [
+
+// ---- a public AI endpoint is a public API on your credit card -------------
+{ id: 'AIOP-018', run(repo, profile) {
+    if (!profile.calls_llm || !profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path) || !isServer(f.path)) continue;
+      if (!LLM_CALL.test(f.text)) continue;
+      const authed = /\b(session|getUser|auth\(\)|getServerSession|req\.user|userId|apiKey|requireAuth|clerkId)\b/.test(f.text);
+      if (authed) continue;
+      const m = f.text.match(LLM_CALL);
+      out.push(finding('AIOP-018', 'AI endpoint reachable without logging in', 'critical',
+        f.path, lineOf(f.text, f.text.indexOf(m[0])),
+        'Anyone on the internet can call this endpoint and it will spend your model credits. No account, no limit, no way to identify who did it.',
+        'Require a signed-in user before calling the model, and attach a per-user budget.'));
+    }
+    return out;
+  }},
+
+// ---- no ceiling on what a single request can cost ------------------------
+{ id: 'AI-003', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    // Two problems the 68-repo audit exposed, and it fired 1,471 times.
+    //
+    // A fixed 700-character window is not the call. A generateText() with a long
+    // prompt puts maxOutputTokens past the end of the window, so a bounded call
+    // reads as unbounded. Read the balanced expression instead.
+    //
+    // And even when each hit is TRUE, 1,471 of them is not a report. An AI
+    // platform has hundreds of call sites; listing every one is the same failure
+    // as DATA-003's 605 - correct, and useless. One finding, with the count.
+    const call = (t, i, max = 3000) => {
+      const open = t.indexOf('(', i);
+      if (open === -1) return t.slice(i, i + 400);
+      let depth = 0;
+      for (let j = open; j < Math.min(t.length, open + max); j++) {
+        if (t[j] === '(' || t[j] === '{') depth++;
+        else if (t[j] === ')' || t[j] === '}') { if (--depth === 0) return t.slice(i, j + 1); }
+      }
+      return t.slice(i, i + max);
+    };
+    const BOUNDED = /max_tokens|maxTokens|max_output_tokens|maxOutputTokens|max_completion_tokens|maxCompletionTokens|stopSequences|stop_sequences/;
+
+    const sites = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = new RegExp(LLM_CALL.source, 'g');
+      let m;
+      while ((m = re.exec(f.text))) {
+        if (BOUNDED.test(call(f.text, m.index))) continue;
+        sites.push({ path: f.path, line: lineOf(f.text, m.index) });
+      }
+    }
+    if (!sites.length) return [];
+    const eg = sites.slice(0, 4).map(x => `${x.path}:${x.line}`).join(', ');
+    return [finding('AI-003',
+      `${sites.length} model call${sites.length === 1 ? '' : 's'} with no token ceiling`,
+      'high', sites[0].path, sites[0].line,
+      `Without a token limit one request can generate until the model decides to stop, and you pay for every token of it. A prompt that loops, or a user who asks for "everything you know about X", bills whatever it likes.` +
+      (sites.length > 4 ? ` Seen at ${eg}, and ${sites.length - 4} more.` : ` Seen at ${eg}.`),
+      'Set a token ceiling on every model call - max_tokens, or maxOutputTokens on the Vercel AI SDK.')];
+  }},
+
+// ---- the model to run chosen by the caller -------------------------------
+{ id: 'AI-004', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      // The model VALUE has to come from the request. Looking for the word
+      // "request" anywhere within 400 characters found n8n's
+      //   model: createModel(modelConfig, ...)
+      // because an unrelated `request.modelName` sat six lines above it. That is
+      // judging the neighbourhood, not the line.
+      const re = /model\s*:\s*(?!['"`])([a-zA-Z_$][\w.$\[\]'"]*)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 200);
+        if (!LLM_CALL.test(around)) continue;
+        if (!/^(body|req|request|params|query|input|payload|searchParams|args|dto)\b/i.test(m[1])) continue;
+        out.push(finding('AI-004', 'Caller decides which model runs', 'medium',
+          f.path, lineOf(f.text, m.index),
+          'The model name comes from the request, so a caller can select your most expensive model on every call.',
+          'Pick the model from a fixed allowlist on the server.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- user text landing in the system prompt ------------------------------
+{ id: 'AI-001', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = /(?:\bsystem\w*\s*[:=]\s*[`"'][^`"']{0,400}\$\{[^}]+\}|role\s*:\s*['"`]system['"`][\s\S]{0,200}?content\s*:\s*[`"'][^`"']{0,300}\$\{[^}]+\})/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const interp = m[0].match(/\$\{([^}]+)\}/)?.[1] || '';
+        if (!/\b(body|req|request|input|message|query|prompt|user|params|content)\b/i.test(interp)) continue;
+        out.push(finding('AI-001', 'User input goes into the system prompt', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Text from the user is being pasted into the instructions that control the model. A user can write "ignore previous instructions" and take over what your app does.',
+          'Keep user text in the user turn, wrapped in clear delimiters. Never build the system prompt from request data.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- model output treated as trusted ------------------------------------
+{ id: 'AI-007', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !/\.(tsx|jsx|ts|js|vue|svelte)$/.test(f.path)) continue;
+      const re = /(dangerouslySetInnerHTML|\bv-html\b|\.innerHTML\s*=)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 200);
+        // only names that unambiguously mean model output - "message" and "content"
+        // appear in every forum, chat and CMS ever written
+        if (!/\b(completion|aiResponse|ai_response|modelOutput|model_output|llmResult|llm_response|generatedText|generated_text|assistantMessage|assistant_message)\b/i.test(around)) continue;
+        out.push(finding('AI-007', 'Model output rendered as raw HTML', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Whatever the model returns is injected into the page as HTML. If a user can influence the prompt, they can make the model emit a script tag that runs for everyone who views it.',
+          'Render model output as text, or sanitise it before inserting it as HTML.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- model output driving a privileged operation -------------------------
+{ id: 'AI-008', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = /\b(eval|exec|execSync|spawnSync|Function)\s*\(|\.query\s*\(\s*`/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 600), m.index + 200);
+        if (!LLM_CALL.test(around) &&
+            !/\b(completion|aiResponse|modelOutput|generated|llmResult)\b/i.test(around)) continue;
+        out.push(finding('AI-008', 'Model output used in a privileged operation', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'What the model returns is being executed or used to build a query. Anyone who can steer the model can steer this.',
+          'Validate model output against a strict schema, and never pass it to eval, a shell, or a raw SQL string.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- agent loop that can run forever ------------------------------------
+{ id: 'AIOP-010', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = /while\s*\(\s*(true|1)\s*\)|for\s*\(\s*;\s*;\s*\)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const body = f.text.slice(m.index, m.index + 1200);
+        if (!LLM_CALL.test(body)) continue;
+        if (/\b(maxIterations|maxSteps|max_steps|iterations?\s*<|steps?\s*<|attempts?\s*<|turn\s*<)\b/.test(body)) continue;
+        out.push(finding('AIOP-010', 'Agent loop has no iteration limit', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'This loop calls the model with no maximum number of turns. One task that fails to converge keeps calling the API until something else stops it, and you pay per turn.',
+          'Add a hard maximum number of iterations and stop when it is reached.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- provider key used straight from the browser -------------------------
+{ id: 'SEC-006', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path) || !isClient(f.path)) continue;
+      const re = /new\s+(Anthropic|OpenAI|GoogleGenerativeAI|Groq)\s*\(|dangerouslyAllowBrowser\s*:\s*true/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('SEC-006', 'AI provider called directly from the browser', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'Creating the client in browser code means your API key is shipped to every visitor. Anyone can extract it and spend your credits.',
+          'Call the provider from your own server route and keep the key there.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- usage limits the user can edit -------------------------------------
+{ id: 'AUTHZ-005', run(repo, profile) {
+    if (!profile.calls_llm || !profile.has_accounts) return [];
+    const out = [];
+    const QUOTA = /\b(credits?|tokens?_?(used|left|remaining|limit)|usage_?limit|quota|plan_?limit|monthly_?limit)\b/i;
+    for (const f of repo.files) {
+      if (!f.text || !/\.(sql|prisma|ts)$/.test(f.path)) continue;
+      const isSchema = /pgTable\s*\(|CREATE TABLE|^model\s+\w+/mi.test(f.text);
+      if (!isSchema) continue;
+      // a quota column sitting on the same table the user updates
+      const re = /(CREATE TABLE\s+(?:IF NOT EXISTS\s+)?["`]?(?:public\.)?(\w*users?\w*|\w*profiles?\w*|\w*accounts?\w*)[\s\S]{0,800}?);|((?:pgTable|model)\s*\(?\s*["'`]?(\w*users?\w*|\w*profiles?\w*)[\s\S]{0,800}?\})/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const block = m[0];
+        if (!QUOTA.test(block)) continue;
+        out.push(finding('AUTHZ-005', 'AI usage limits stored on a user-editable row', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The credit or quota column lives on the same record the user can update. If they can write to their own row, they can reset their own limit — and this is the exact breach that hit an app in your research.',
+          'Move quota to a table users cannot write to, and enforce the deduction server-side.'));
+        break;
+      }
+    }
+    return out;
+  }},
+
+// ---- no per-user budget at all ------------------------------------------
+{ id: 'RATE-004', run(repo, profile) {
+    if (!profile.calls_llm || !profile.has_accounts) return [];
+    const anyQuota = repo.grep(/\b(credits?|quota|usage_?limit|tokensUsed|tokens_used|rateLimit|ratelimit)\b/i).length;
+    if (anyQuota) return [];
+    const site = repo.files.find(f => f.text && isCode(f.path) && isServer(f.path) && LLM_CALL.test(f.text));
+    if (!site) return [];
+    return [finding('RATE-004', 'No per-user limit on AI usage', 'high',
+      site.path, lineOf(site.text, site.text.search(LLM_CALL)),
+      'Nothing in the codebase tracks how much any single user spends. One account running a script can generate a bill limited only by your provider account.',
+      'Count tokens or requests per user, store the total, and refuse the call once they pass their allowance.')];
+  }},
+
+// ---- nothing bounds total spend ------------------------------------------
+{ id: 'RATE-003', run(repo, profile) {
+    if (!profile.calls_llm || profile.stage !== 'production') return [];
+    const cap = repo.grep(/\b(dailyBudget|monthlyBudget|spendLimit|costLimit|budget_?cap|maxSpend|COST_LIMIT|BUDGET)\b/i).length;
+    if (cap) return [];
+    const site = repo.files.find(f => f.text && isCode(f.path) && LLM_CALL.test(f.text));
+    if (!site) return [];
+    return [finding('RATE-003', 'No overall spending ceiling', 'critical',
+      site.path, lineOf(site.text, site.text.search(LLM_CALL)),
+      'Per-request limits cap one call, not the total. Nothing here stops a bad day from becoming a five-figure invoice — the failure mode behind every horror story in your research.',
+      'Track cumulative spend and stop calling the provider past a daily ceiling. Set a budget alert in the provider console as a backstop.')];
+  }},
+];

package/src/checks-auth.mjs

@@ -0,0 +1,267 @@
+// Accounts, sessions, and the secrets that protect them.
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
+
+const RATE_LIMITER =
+  /rate-?limit|rateLimit|Ratelimit|throttle|slowDown|@upstash\/ratelimit|express-rate-limit|limiter\.|bottleneck/i;
+
+export const AUTH_CHECKS = [
+
+// ---- an .env that nothing is stopping from being committed ---------------
+{ id: 'SEC-001', run(repo) {
+    const envs = repo.files.filter(f => /(^|\/)\.env(\.local|\.production|\.development)?$/.test(f.path));
+    if (!envs.length) return [];
+
+    // Asked per file, against every .gitignore from the git repository root
+    // down - not just one at the scan root. Our own api/.env is excluded by a
+    // rule one directory up, and reading only the local file reported it as a
+    // CRITICAL leak. The whole chain, or the answer is a guess.
+    const ignored = repo.isIgnored || (() => false);
+
+    // A committed .env full of ChangeMe and localhost is a template, not a leak.
+    // Only the values decide - flagging a placeholder file as CRITICAL is how a
+    // scanner teaches people to ignore it.
+    const PLACEHOLDER = /(changeme|your[-_]|xxx|todo|fixme|placeholder|example|dummy|<[^>]+>|^$|localhost|127\.0\.0\.1|\bfoo\b|\bbar\b|test[-_]?value)/i;
+    const REAL_SECRET = [
+      [/sk-ant-[A-Za-z0-9_-]{20,}/,        'an Anthropic key'],
+      [/sk-[A-Za-z0-9]{32,}/,              'an OpenAI key'],
+      [/AKIA[0-9A-Z]{16}/,                 'an AWS access key'],
+      [/ghp_[A-Za-z0-9]{30,}/,             'a GitHub token'],
+      [/xox[baprs]-[A-Za-z0-9-]{15,}/,     'a Slack token'],
+      [/eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/, 'a JWT'],
+      [/postgres(?:ql)?:\/\/[^:\s]+:[^@\s]{8,}@(?!localhost|127\.)/, 'a live database URL'],
+      [/[A-Za-z0-9+\/]{40,}={0,2}\s*$/m,   'a long random value'],
+    ];
+
+    const out = [];
+    for (const f of envs) {
+      if (!f.text || ignored(f.path)) continue;
+      const hits = [];
+      for (const line of f.text.split('\n')) {
+        const eq = line.indexOf('=');
+        if (line.trimStart().startsWith('#') || eq === -1) continue;
+        const value = line.slice(eq + 1).trim().replace(/^["']|["']$/g, '');
+        if (!value || PLACEHOLDER.test(value)) continue;
+        for (const [re, label] of REAL_SECRET)
+          if (re.test(value)) { hits.push(label); break; }
+      }
+      if (!hits.length) continue;
+      out.push(finding('SEC-001', `${f.path} holds real credentials and is not gitignored`, 'critical',
+        f.path, 1,
+        `This file contains ${[...new Set(hits)].join(' and ')}, and nothing in .gitignore excludes it. The next commit publishes it, and deleting it later does not remove it from git history.`,
+        'Add .env* to .gitignore. If it has already been committed, rotate every key in it - treat them as public.'));
+    }
+    return out;
+  }},
+
+// ---- Supabase service_role key anywhere near the browser -----------------
+{ id: 'SEC-005', run(repo, profile) {
+    if (profile.stack?.database !== 'supabase') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text) continue;
+      const re = /SERVICE_ROLE|service_role/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const line = f.text.slice(f.text.lastIndexOf('\n', m.index) + 1,
+                                  f.text.indexOf('\n', m.index));
+        const isPublic = /NEXT_PUBLIC_|VITE_|REACT_APP_|PUBLIC_/.test(line);
+        const inClient = /\/(components?|pages?)\//.test(f.path) || /['"]use client['"]/.test(f.text.slice(0, 200));
+        if (!isPublic && !inClient) continue;
+        out.push(finding('SEC-005', 'Supabase service_role key exposed to the browser', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The service_role key bypasses row level security completely. In browser code it hands every visitor unrestricted read and write access to your entire database.',
+          'Use the anon key in the browser. Keep service_role on the server only, and rotate it — assume it is compromised.'));
+        break;
+      }
+    }
+    return out;
+  }},
+
+// ---- login with no attempt limit -----------------------------------------
+{ id: 'AUTH-003', run(repo, profile) {
+    if (!profile.has_accounts || !profile.is_public) return [];
+    if (['clerk', 'auth0', 'supabase-auth'].includes(profile.stack?.auth)) return []; // provider handles it
+    const login = repo.files.filter(f => f.text && isCode(f.path) &&
+      /(login|signin|sign-in|authenticate)/i.test(f.path) &&
+      /\/(api|routes?|server|actions?)\//.test(f.path));
+    if (!login.length) return [];
+    if (login.some(f => RATE_LIMITER.test(f.text))) return [];
+    if (repo.grep(RATE_LIMITER, /middleware\.(ts|js)$/).length) return [];
+    const f = login[0];
+    return [finding('AUTH-003', 'Login endpoint has no attempt limit', 'high',
+      f.path, 1,
+      'Nothing slows down repeated guesses. A script can try millions of passwords against every account you have, and you will not notice.',
+      'Limit attempts per account and per IP — five in fifteen minutes is a common baseline — and lock or delay after that.')];
+  }},
+
+// ---- password reset that can be used to flood someone --------------------
+{ id: 'AUTH-004', run(repo, profile) {
+    if (!profile.has_accounts || !profile.sends_email) return [];
+    const reset = repo.files.filter(f => f.text && isCode(f.path) &&
+      /(reset|forgot).*(password|pass)|password.*(reset|forgot)/i.test(f.path) &&
+      /\/(api|routes?|server|actions?)\//.test(f.path));
+    if (!reset.length) return [];
+    if (reset.some(f => RATE_LIMITER.test(f.text))) return [];
+    const f = reset[0];
+    return [finding('AUTH-004', 'Password reset endpoint is not rate limited', 'high',
+      f.path, 1,
+      'Anyone can trigger unlimited reset emails to any address. That floods your users\' inboxes, burns your email reputation, and costs you per send — the 2am attack pattern from your research.',
+      'Rate limit by email address and by IP, and cap total resets per address per hour.')];
+  }},
+
+// ---- passwords stored with something that is not a KDF -------------------
+{ id: 'AUTH-008', run(repo, profile) {
+    if (profile.stack?.auth !== 'custom') return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = /createHash\s*\(\s*['"](md5|sha1|sha256|sha512)['"]\)/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 400);
+        if (!/password|passwd|\bpwd\b|credential/i.test(around)) continue;
+        out.push(finding('AUTH-008', `Passwords hashed with ${m[1]}`, 'critical',
+          f.path, lineOf(f.text, m.index),
+          `${m[1]} is built to be fast, which is exactly wrong for passwords — a modern GPU tries billions of guesses per second. If your database leaks, the passwords are recoverable.`,
+          'Use bcrypt, scrypt, or argon2id. They are deliberately slow, which is the point.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- privileges read from something the user controls --------------------
+{ id: 'AUTH-002', run(repo, profile) {
+    if (!profile.has_accounts) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = /(?:localStorage|sessionStorage)\.getItem\s*\(\s*['"`][^'"`]*(role|admin|plan|tier|permission|premium|subscri)/gi;
+      let m;
+      while ((m = re.exec(f.text))) {
+        out.push(finding('AUTH-002', 'Permission level read from browser storage', 'critical',
+          f.path, lineOf(f.text, m.index),
+          'The user can open developer tools and edit this value. If anything is granted based on it, they grant it to themselves — this is the "change Member to Admin" demo from your research.',
+          'Read the role from the session on the server on every request that depends on it.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- session cookie missing its protections ------------------------------
+{ id: 'NEXT-013', run(repo, profile) {
+    if (!profile.has_accounts) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      const re = /cookies\(\)\.set\s*\(|res\.cookie\s*\(|setCookie\s*\(/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const call = f.text.slice(m.index, m.index + 400);
+        const around = f.text.slice(Math.max(0, m.index - 200), m.index + 400);
+        if (!/session|token|jwt|auth/i.test(around)) continue;
+        const missing = [];
+        if (!/httpOnly\s*:\s*true/i.test(call)) missing.push('httpOnly');
+        if (!/secure\s*:\s*true/i.test(call))   missing.push('secure');
+        if (!/sameSite/i.test(call))            missing.push('sameSite');
+        if (!missing.length) continue;
+        out.push(finding('NEXT-013', `Session cookie is missing ${missing.join(', ')}`, 'high',
+          f.path, lineOf(f.text, m.index),
+          'Without httpOnly any script on the page can read the session. Without secure it travels over plain HTTP. Without sameSite another site can make requests carrying it.',
+          'Set httpOnly: true, secure: true, sameSite: "lax" on the session cookie.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- nothing limits anything --------------------------------------------
+{ id: 'RATE-001', run(repo, profile) {
+    if (!profile.is_public || profile.surface === 'library') return [];
+    const hasRoutes = repo.files.some(f => /\/(api|routes?)\//.test(f.path) && isCode(f.path));
+    if (!hasRoutes) return [];
+    if (repo.grep(RATE_LIMITER).length) return [];
+    if (repo.exists('vercel.json') && /rateLimit/i.test(repo.read('vercel.json') || '')) return [];
+    const f = repo.files.find(x => /\/(api|routes?)\//.test(x.path) && isCode(x.path));
+    return [finding('RATE-001', 'No rate limiting anywhere in the project', 'high',
+      f.path, 1,
+      'Every endpoint accepts unlimited requests. One person with a loop can exhaust your database connections, your email quota, or your API credits.',
+      'Add rate limiting middleware covering all routes, with tighter limits on login, signup, password reset, and anything that costs money per call.')];
+  }},
+
+// ---- a state change behind a GET ----------------------------------------
+{ id: 'API-006', run(repo, profile) {
+    if (!profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text || !isCode(f.path)) continue;
+      if (!/\/(api|routes?)\//.test(f.path)) continue;
+      const re = /export\s+(?:async\s+)?function\s+GET\s*\([^)]*\)\s*\{/g;
+      let m;
+      while ((m = re.exec(f.text))) {
+        const body = f.text.slice(m.index, m.index + 900);
+        if (!/\.(delete|destroy|update|create|insert)\s*\(|DELETE\s+FROM|UPDATE\s+\w+\s+SET/i.test(body)) continue;
+        out.push(finding('API-006', 'A GET request changes data', 'high',
+          f.path, lineOf(f.text, m.index),
+          'Browsers, link previews and crawlers fetch GET URLs on their own. Anything that changes state behind one can be triggered by a link in a chat message.',
+          'Move the operation to POST, PUT or DELETE, and add CSRF protection.'));
+      }
+    }
+    return out;
+  }},
+
+// ---- HTTPS not enforced --------------------------------------------------
+// Reported from the field: this fired on a correctly configured Railway deploy
+// whose nginx.conf DOES send Strict-Transport-Security, because repo.grep
+// defaults to source-file extensions and .conf is not one of them - so the
+// evidence was there and simply never read.
+//
+// Adding Railway to a list of known platforms would fix that one deploy and
+// leave the next platform broken. The general signal is better: a server that
+// terminates TLS itself listens on 443. One listening on 8080 is behind
+// something that already did, and cannot redirect what it never receives.
+{ id: 'INF-006', run(repo, profile) {
+    if (!profile.is_public || !['web-app', 'web-site'].includes(profile.surface)) return [];
+
+    const CONFIGS = /\.(conf|toml|ya?ml|json|ini|cfg)$|\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb)$|(^|\/)(Caddyfile|Procfile|Dockerfile)$/;
+    const configText = repo.files
+      .filter(f => f.text && CONFIGS.test(f.path)).map(f => f.text).join('\n');
+
+    // already saying it, in any file type
+    if (/Strict-Transport-Security|hsts|forceSSL|force_ssl|SECURE_SSL_REDIRECT|SECURE_HSTS/i.test(configText)) return [];
+
+    // a managed platform terminates TLS and redirects at its edge
+    if (['vercel', 'netlify', 'cloudflare', 'railway', 'fly', 'render', 'heroku', 'deno']
+        .includes(profile.stack?.host)) return [];
+    if (repo.has(/(^|\/)(railway\.json|vercel\.json|netlify\.toml|fly\.toml|render\.yaml|app\.yaml|Procfile)$/)) return [];
+
+    // behind a proxy: nothing here listens on 443, so nothing here sees http://
+    const listens = [...configText.matchAll(/\blisten\s+(?:\[::\]:)?(\d{2,5})/gi)].map(m => m[1]);
+    if (listens.length && !listens.includes('443')) return [];
+
+    const f = repo.files.find(x => /(next\.config|server\.[tj]s|app\.[tj]s|nginx\.conf|middleware\.[tj]s)/.test(x.path));
+    if (!f) return [];
+    return [finding('INF-006', 'HTTPS is not enforced', 'high',
+      f.path, 1,
+      'Without a redirect and HSTS, a first visit can happen over plain HTTP, where session cookies and form posts are readable by anyone on the network.',
+      'Redirect all HTTP to HTTPS and send Strict-Transport-Security.')];
+  }},
+
+// ---- security headers ----------------------------------------------------
+{ id: 'API-012', run(repo, profile) {
+    if (!profile.is_public || !['web-app', 'web-site'].includes(profile.surface)) return [];
+    const all = repo.files.filter(f => f.text).map(f => f.text).join('\n');
+    const missing = [];
+    if (!/Content-Security-Policy/i.test(all))    missing.push('Content-Security-Policy');
+    if (!/X-Content-Type-Options/i.test(all))     missing.push('X-Content-Type-Options');
+    if (!/(X-Frame-Options|frame-ancestors)/i.test(all)) missing.push('X-Frame-Options');
+    if (missing.length < 2) return [];
+    const f = repo.files.find(x => /(next\.config|middleware\.[tj]s|server\.[tj]s|vercel\.json|netlify\.toml)/.test(x.path));
+    if (!f) return [];
+    return [finding('API-012', `Security headers missing: ${missing.join(', ')}`, 'medium',
+      f.path, 1,
+      'These headers are what stop your pages being framed by a lookalike site, and limit the damage if untrusted content ever reaches the page.',
+      'Set them once in your framework config or middleware — it applies to every response.')];
+  }},
+];