launchprep 0.0.1 → 0.2.0

package/src/checks-injection.mjs

@@ -0,0 +1,322 @@
+// User input concatenated into a SQL query.
+//
+// This was missing from all 288 rules. A project with `${req.params.id}` dropped
+// straight into a query got back "SELECT * on users, MEDIUM" and nothing about
+// the injection on the same line - which is the single most famous way a launch
+// goes wrong, and the one a reader would most expect us to catch.
+//
+// It is also the check most likely to cry wolf, because half the SQL in a modern
+// codebase is written with tagged templates that look identical to the dangerous
+// form and are completely safe. So the discipline that removed 166 false alarms
+// applies in full: read the value, judge the line, and require evidence the
+// thing is used the dangerous way. Three separate facts must all hold:
+//
+//   1. the string is actually SQL          - a verb AND a clause, not the word "select"
+//   2. something is interpolated into it   - not a constant string
+//   3. that something came from a request  - not a literal, not a column name
+//
+// And then the safe forms are subtracted, because every one of them would
+// otherwise fire on correct code.
+
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+
+// Comments blanked to spaces; offsets and line numbers survive, the words do
+// not. A comment reading "never do `SELECT * FROM users WHERE id = ${id}`" is
+// advice against the bug, not the bug.
+const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};
+
+// A verb and a clause. "select" alone matches a React prop, a CSS selector, a
+// variable called selectedUser and about forty other innocent things.
+const IS_SQL = /\b(select|insert\s+into|update|delete\s+from|replace\s+into)\b[\s\S]{0,300}?\b(from|into|where|set|values|join)\b/i;
+
+// The expression must trace to something the caller sent. A table name pulled
+// from a constant is a different (smaller) problem and not this finding.
+//
+// Every entry here is ROOTED - req.query, not query. The first version accepted
+// a bare `query.`, `params.` and `body.` and immediately flagged Sequelize's own
+//
+//     query.query = `SELECT * FROM FINAL TABLE (${query.query})`
+//
+// as a critical injection, because `query.query` matched. That is the twelfth
+// time this codebase has matched a NAME where it needed a CONTEXT, and on a
+// CRITICAL rule it is the one that costs the most: a reader cannot tell a
+// wrong finding from an irrelevant one, and stops believing the other 288.
+const FROM_REQUEST = new RegExp([
+  'req\\.(params|query|body|headers|cookies)',
+  'request\\.(params|query|body|args|form|json|GET|POST|values|data)',
+  '\\bctx\\.(request|params|query)',
+  'searchParams\\.get',
+  '\\$_(GET|POST|REQUEST|COOKIE)\\b',
+  'event\\.(queryStringParameters|pathParameters|body)',
+  '\\bgetQuery\\(|\\breadBody\\(',
+  '\\bformData\\.get',
+].join('|'));
+
+// Bare `params.id` IS the request in a Next.js, Remix or SvelteKit route
+// handler - and is just a variable anywhere else. So it counts as evidence
+// only in a file that is a route handler, which is a fact about the file
+// rather than a guess about the name.
+const BARE_PARAMS = /\bparams\.[A-Za-z_$]|\bsearchParams\.[A-Za-z_$]/;
+const IS_ROUTE_FILE = (path, code) =>
+  /(^|\/)(app|pages|src\/app|src\/pages)\/.*\/(route|page)\.(ts|tsx|js|jsx)$/.test(path) ||
+  /(^|\/)pages\/api\//.test(path) ||
+  /(^|\/)routes?\//.test(path) ||
+  /\+server\.(ts|js)$/.test(path) ||
+  /\bexport\s+(async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE)\s*\(/.test(code) ||
+  /\bexport\s+const\s+(GET|POST|PUT|PATCH|DELETE)\s*=/.test(code);
+
+// One hop of data flow, because one hop is where the bug actually lives.
+//
+//     const { id } = req.params;
+//     db.query(`select * from users where id = ${id}`)
+//
+// is far more common than interpolating req.params.id directly, and a check
+// that only saw the direct form would miss most real instances while claiming
+// to cover this. So: collect the names a file binds FROM a request, then treat
+// those names as the request.
+//
+// Scope is ignored on purpose. Tracking it properly needs a parser, and a file
+// that reads req.params.id into `id` and then pastes `id` into SQL is not
+// meaningfully ambiguous. What this must not do is taint a name bound from
+// anything else, which is why only these forms count.
+const TAINT_SOURCES = [
+  // const { a, b } = req.params / req.query / req.body / await req.json()
+  /(?:const|let|var)\s*\{([^}]{1,200})\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|json\(\)|formData\(\))/g,
+  // const { id } = await params        (Next.js 15 route handlers)
+  /(?:const|let|var)\s*\{([^}]{1,200})\}\s*=\s*await\s+(?:params|searchParams)\b/g,
+  // const x = req.query.y / req.params.y / req.body.y
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g,
+  // const x = searchParams.get('y') / url.searchParams.get('y') / formData.get('y')
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.$]*(?:searchParams|formData)\.get\s*\(/g,
+  // python:  x = request.args.get('y') / request.form['y'] / request.json['y']
+  /([A-Za-z_][\w]*)\s*=\s*request\.(?:args|form|json|values|data|GET|POST)\b/g,
+  // php:  $x = $_GET['y']
+  /\$([A-Za-z_]\w*)\s*=\s*\$_(?:GET|POST|REQUEST|COOKIE)\b/g,
+];
+
+function taintedNames(code) {
+  const names = new Set();
+  for (const re of TAINT_SOURCES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      for (const part of m[1].split(',')) {
+        // { id }  and  { id: userId }  and  { id = 1 }  all bind the LAST name
+        const n = part.split(':').pop().split('=')[0].trim().replace(/^\.\.\./, '');
+        if (/^[A-Za-z_$][\w$]*$/.test(n)) names.add(n);
+      }
+    }
+  }
+  // Names so generic that binding one would taint half the file's arithmetic.
+  for (const junk of ['data', 'body', 'params', 'query', 'req', 'request', 'options', 'props']) names.delete(junk);
+  return names;
+}
+
+const usesTainted = (expr, names) => {
+  if (!names.size) return false;
+  for (const m of expr.matchAll(/[A-Za-z_$][\w$]*/g)) if (names.has(m[0])) return true;
+  return false;
+};
+
+// Wrapped in a numeric coercion it cannot carry a quote, a comment marker or a
+// semicolon. Flagging it would be flagging arithmetic.
+const COERCED = /^\s*(Number|parseInt|parseFloat|int|float|Integer\.parseInt|to_i|intval)\s*\(|^\s*\+\s*[A-Za-z_$]/;
+
+// Tagged templates that parameterise. These look EXACTLY like the dangerous
+// form and are the reason a naive version of this check would be unusable:
+// prisma.$queryRaw`...${id}...` is safe, prisma.$queryRawUnsafe(`...${id}...`)
+// is not, and the difference is six characters.
+const SAFE_TAG = /(^|[^\w$])(sql|SQL|sqlx?|prisma\.\$queryRaw|prisma\.\$executeRaw|\$queryRaw|\$executeRaw|db\.sql|tx\.sql|conn\.sql|knex\.raw|Prisma\.sql|drizzle|postgres|neon|planetscale)$/;
+
+// Where a template literal ends, honouring escapes and nested ${ } which may
+// themselves contain template literals.
+function endOfTemplate(t, start) {
+  let i = start + 1;
+  while (i < t.length) {
+    const c = t[i];
+    if (c === '\\') { i += 2; continue; }
+    if (c === '`') return i;
+    if (c === '$' && t[i + 1] === '{') {
+      let depth = 1; i += 2;
+      while (i < t.length && depth > 0) {
+        if (t[i] === '\\') { i += 2; continue; }
+        if (t[i] === '`') { const e = endOfTemplate(t, i); i = e === -1 ? t.length : e + 1; continue; }
+        if (t[i] === '{') depth++;
+        else if (t[i] === '}') depth--;
+        i++;
+      }
+      continue;
+    }
+    i++;
+  }
+  return -1;
+}
+
+// The ${ ... } expressions inside one template literal, as text.
+function holes(tpl) {
+  const out = [];
+  for (let i = 0; i < tpl.length; i++) {
+    if (tpl[i] === '\\') { i++; continue; }
+    if (tpl[i] === '$' && tpl[i + 1] === '{') {
+      let depth = 1, j = i + 2; const from = j;
+      while (j < tpl.length && depth > 0) {
+        if (tpl[j] === '\\') { j += 2; continue; }
+        if (tpl[j] === '{') depth++;
+        else if (tpl[j] === '}') depth--;
+        if (depth > 0) j++;
+      }
+      out.push(tpl.slice(from, j));
+      i = j;
+    }
+  }
+  return out;
+}
+
+const JS  = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const PY  = /\.py$/;
+const PHP = /\.php$/;
+const RB  = /\.rb$/;
+
+function scanJs(path, code, out) {
+  const routeFile = IS_ROUTE_FILE(path, code);
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h)
+    || (routeFile && BARE_PARAMS.test(h))
+    || usesTainted(h, tainted);
+  for (let i = 0; i < code.length; i++) {
+    if (code[i] !== '`') continue;
+    const end = endOfTemplate(code, i);
+    if (end === -1) break;
+    const tpl = code.slice(i + 1, end);
+    const before = code.slice(Math.max(0, i - 60), i).trimEnd();
+    i = end;
+
+    if (!IS_SQL.test(tpl)) continue;
+    if (SAFE_TAG.test(before)) continue;               // parameterised by the tag
+
+    const bad = holes(tpl).filter(h => isInput(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, i - tpl.length), expr: bad[0].trim(), how: 'a template literal' });
+  }
+
+  // "select ... where id = " + req.params.id
+  const CONCAT = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*\+\s*([^;\n]{1,120})/g;
+  let m;
+  while ((m = CONCAT.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    const rhs = m[3];
+    if (!isInput(rhs) || COERCED.test(rhs)) continue;
+    out.push({ line: lineOf(code, m.index), expr: rhs.trim().slice(0, 60), how: 'string concatenation' });
+  }
+}
+
+function scanPy(path, code, out) {
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h) || usesTainted(h, tainted);
+  // f"... {req.args['id']} ..."  -- the f prefix is what makes it interpolate
+  const FSTR = /\bf(["'])((?:(?!\1)[^\\]|\\.)*)\1|\bf("""|''')([\s\S]*?)\3/g;
+  let m;
+  while ((m = FSTR.exec(code))) {
+    const body = m[2] ?? m[4] ?? '';
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/\{([^{}]+)\}/g)].map(x => x[1])
+      .filter(h => isInput(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, m.index), expr: bad[0].trim(), how: 'an f-string' });
+  }
+
+  // "... %s ..." % x  and  "...".format(x)
+  //
+  // The % HAS to be applied to the string. cursor.execute("... %s", (x,)) is
+  // the correct parameterised call and looks almost the same - the difference
+  // is a comma instead of a percent sign, and it is the whole difference.
+  const APPLIED = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*(?:%\s*|\.format\s*\()([^\n;]{1,120})/g;
+  while ((m = APPLIED.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    if (!isInput(m[3]) || COERCED.test(m[3])) continue;
+    out.push({ line: lineOf(code, m.index), expr: m[3].trim().slice(0, 60), how: 'string formatting' });
+  }
+}
+
+function scanPhp(path, code, out) {
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h) || usesTainted(h, tainted);
+  const STR = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = STR.exec(code))) {
+    const body = m[1];
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/\{?\$([A-Za-z_]\w*(?:\[[^\]]+\])?(?:->\w+)?)\}?/g)].map(x => '$' + x[1])
+      .filter(h => isInput(h));
+    if (bad.length) { out.push({ line: lineOf(code, m.index), expr: bad[0], how: 'string interpolation' }); continue; }
+  }
+  const DOT = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*\.\s*([^;\n]{1,120})/g;
+  while ((m = DOT.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    if (!isInput(m[3])) continue;
+    out.push({ line: lineOf(code, m.index), expr: m[3].trim().slice(0, 60), how: 'string concatenation' });
+  }
+}
+
+function scanRb(path, code, out) {
+  const STR = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = STR.exec(code))) {
+    const body = m[1];
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/#\{([^}]+)\}/g)].map(x => x[1])
+      .filter(h => FROM_REQUEST.test(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, m.index), expr: bad[0].trim(), how: 'string interpolation' });
+  }
+}
+
+export const INJECTION_CHECKS = [
+
+{ id: 'DATA-015', run(repo) {
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text) continue;
+      const isJs = JS.test(f.path), isPy = PY.test(f.path),
+            isPhp = PHP.test(f.path), isRb = RB.test(f.path);
+      if (!isJs && !isPy && !isPhp && !isRb) continue;
+      // A migration writes its own SQL and takes no request input; a seed file
+      // is the same. Both are full of raw SQL and neither is reachable.
+      if (/(^|\/)(migrations?|seeds?|db\/migrate)\//.test(f.path)) continue;
+
+      const code = codeOnly(f.text);
+      const hits = [];
+      if (isJs)  scanJs(f.path, code, hits);
+      if (isPy)  scanPy(f.path, code, hits);
+      if (isPhp) scanPhp(f.path, code, hits);
+      if (isRb)  scanRb(f.path, code, hits);
+
+      // One finding per file. Somebody who builds queries this way builds them
+      // this way in twenty places, and twenty identical CRITICALs is not twenty
+      // times the information - it is one piece of information, shouted.
+      if (!hits.length) continue;
+      const h = hits[0];
+      const more = hits.length > 1 ? ` The same pattern appears ${hits.length} times in this file.` : '';
+      out.push(finding('DATA-015',
+        'Anyone can read or delete your whole database by typing into a form', 'critical',
+        f.path, h.line,
+        `A value that came straight from the visitor is pasted into a database query through ${h.how} — here it is \`${h.expr}\`. Whatever they type is not treated as data, it is treated as part of the instruction. Typing the right thing into that field reads every table, changes any row, or deletes the lot, and nothing in the code stops it.${more}`,
+        'Never build the query by joining strings. Leave a placeholder where the value goes and pass the value alongside it — `db.query("select * from users where id = $1", [id])` — so the database treats it as data no matter what it contains.'));
+    }
+    return out;
+  }},
+
+];

package/src/checks.mjs

@@ -0,0 +1,221 @@
+// Tier-1 checks: deterministic, no LLM, no network. Each returns findings with
+// a file:line so the user can go straight to it.
+import { AUTHZ_CHECKS } from './checks-authz.mjs';
+import { INJECTION_CHECKS } from './checks-injection.mjs';
+import { AI_CHECKS } from './checks-ai.mjs';
+import { DEPLOY_CHECKS } from './checks-deploy.mjs';
+import { AUTH_CHECKS } from './checks-auth.mjs';
+import { FRAMEWORK_CHECKS } from './checks-frameworks.mjs';
+import { BATCH2_CHECKS } from './checks-batch2.mjs';
+import { BATCH3_CHECKS } from './checks-batch3.mjs';
+import { BATCH4_CHECKS } from './checks-batch4.mjs';
+
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+const lineOf = (text, index) => text.slice(0, index).split('\n').length;
+
+const BASE_CHECKS = [
+
+{ id:'SEC-002', run(repo){
+    const gi = repo.read('.gitignore');
+    if (gi === null) return [];
+    if (/^\s*\.env/m.test(gi)) return [];
+    return [finding('SEC-002','.env is not in .gitignore','high','.gitignore',1,
+      'Nothing stops a future commit from publishing your secrets.',
+      'Add a line containing  .env*  to .gitignore')];
+  }},
+
+{ id:'SEC-004', run(repo){
+    // Many NEXT_PUBLIC_* keys are public BY DESIGN. Stripe's publishable key and
+    // Supabase's anon key belong in the browser; flagging them as CRITICAL is the
+    // fastest way to lose a user's trust in every other finding.
+    const PUBLIC_BY_DESIGN = /(PUBLISHABLE|ANON_KEY|PUBLIC_KEY|SITE_KEY|VAPID|POSTHOG|SENTRY_DSN|MEASUREMENT_ID|^(GA|GTM)_|TURNSTILE|RECAPTCHA_SITE|HCAPTCHA|MAPBOX|GOOGLE_MAPS|ALGOLIA_SEARCH|AMPLITUDE|MIXPANEL_TOKEN)/;
+    // names that are settings, not credentials
+    const NOT_A_CREDENTIAL = /(ENABLE|DISABLE|REQUIRE|ALLOW|SHOW|USE)_/;
+    // unambiguous: these must never be public
+    const DEFINITELY_SECRET = /(SECRET|SERVICE_ROLE|PRIVATE_KEY|_SK_|OPENAI|ANTHROPIC|CLAUDE|GROQ|SENDGRID|RESEND|TWILIO|AWS_SECRET|DATABASE_URL|CONNECTION_STRING)/;
+
+    const out=[];
+    for (const f of repo.files){
+      if (!f.text || !/\.(ts|tsx|js|jsx|mjs|env)$/.test(f.path)) continue;
+      if (/\.(example|sample|template)$/i.test(f.path)) continue;
+      const re=/\b(NEXT_PUBLIC_|VITE_|REACT_APP_|PUBLIC_)([A-Z0-9_]*(KEY|SECRET|TOKEN|PASSWORD)[A-Z0-9_]*)/g;
+      let m;
+      while ((m=re.exec(f.text))){
+        const full = m[1]+m[2];
+        if (PUBLIC_BY_DESIGN.test(m[2]) || NOT_A_CREDENTIAL.test(m[2])) continue;
+
+        const certain = DEFINITELY_SECRET.test(m[2]);
+        out.push(finding('SEC-004',
+          certain ? 'Server secret exposed to the browser' : 'Possible secret exposed to the browser',
+          certain ? 'critical' : 'medium',
+          f.path, lineOf(f.text,m.index),
+          certain
+            ? `${full} — the ${m[1]} prefix ships this value to every visitor's browser, and this is a credential that must stay on your server.`
+            : `${full} — the ${m[1]} prefix makes this readable by anyone who opens your site. If it is a provider's publishable key that is fine; if it grants write access it is not.`,
+          certain
+            ? 'Remove the public prefix, read it only on the server, and rotate the key.'
+            : 'Confirm this key is meant to be public. If it is not, drop the prefix and rotate it.'));
+      }
+    }
+    return out;
+  }},
+
+{ id:'SEC-003', run(repo){
+    const out=[];
+    const PATTERNS=[
+      [/\bsk-ant-[A-Za-z0-9_-]{20,}/g,'Anthropic API key'],
+      [/\bsk-[A-Za-z0-9]{32,}/g,'OpenAI API key'],
+      [/\bAKIA[0-9A-Z]{16}\b/g,'AWS access key'],
+      [/\bghp_[A-Za-z0-9]{30,}/g,'GitHub token'],
+      [/\bxox[baprs]-[A-Za-z0-9-]{10,}/g,'Slack token'],
+    ];
+    for (const f of repo.files){
+      // placeholder/sample env files are meant to be committed - never a secret finding
+      if (!f.text || /\.(md|lock)$/.test(f.path)) continue;
+      if (/\.(example|sample|template|dist)$/i.test(f.path) ||
+          /\.env\.(example|sample|template)/i.test(f.path)) continue;
+      // A key in a .env file is not hardcoded - .env IS the environment
+      // variable, and telling someone to "move it to an environment variable"
+      // is advice to do the thing they already did. Whether that file is safe
+      // is a question about .gitignore, and SEC-001 is the check that knows
+      // how to ask it.
+      if (/(^|\/)\.env(\.[A-Za-z0-9_-]+)?$/.test(f.path)) continue;
+      for (const [re,label] of PATTERNS){
+        let m; re.lastIndex=0;
+        while ((m=re.exec(f.text))){
+          out.push(finding('SEC-003',`Hardcoded ${label}`,'critical',
+            f.path, lineOf(f.text,m.index),
+            `A live ${label} is written directly into this file.`,
+            'Move it to an environment variable and rotate the key — it must be treated as leaked.'));
+        }
+      }
+    }
+    return out;
+  }},
+
+{ id:'AUTH-001', run(repo,profile){
+    if (!profile.has_accounts) return [];
+    const out=[];
+    for (const f of repo.files){
+      if (!f.text || !/\.(ts|tsx|js|jsx)$/.test(f.path)) continue;
+      const re=/(localStorage|sessionStorage)\.setItem\(\s*['"`][^'"`]*(token|jwt|auth|session)/gi;
+      let m;
+      while ((m=re.exec(f.text))){
+        out.push(finding('AUTH-001','Session token stored in browser storage','high',
+          f.path, lineOf(f.text,m.index),
+          'Anything in localStorage is readable by any script on the page, so one XSS steals the login.',
+          'Store the session in an httpOnly, Secure, SameSite cookie instead.'));
+      }
+    }
+    return out;
+  }},
+
+{ id:'AI-003', run(repo,profile){
+    if (!profile.calls_llm) return [];
+    const out=[];
+    for (const f of repo.files){
+      if (!f.text || !/\.(ts|tsx|js|mjs|py)$/.test(f.path)) continue;
+      const re=/\.messages\.create\s*\(|\.chat\.completions\.create\s*\(/g;
+      let m;
+      while ((m=re.exec(f.text))){
+        const window_=f.text.slice(m.index, m.index+600);
+        if (/max_tokens|maxTokens|max_output_tokens/.test(window_)) continue;
+        out.push(finding('AI-003','AI call with no token ceiling','high',
+          f.path, lineOf(f.text,m.index),
+          'Without max_tokens a single request can generate — and bill — without limit.',
+          'Set max_tokens on every completion call.'));
+      }
+    }
+    return out;
+  }},
+
+{ id:'DEP-010', run(repo){
+    if (!repo.exists('package.json')) return [];
+    const has = ['package-lock.json','pnpm-lock.yaml','yarn.lock','bun.lockb'].some(l=>repo.exists(l));
+    return has ? [] : [finding('DEP-010','No lockfile committed','medium','package.json',1,
+      'Without a lockfile your production build can install different versions than you tested.',
+      'Commit the lockfile your package manager generates.')];
+  }},
+
+{ id:'API-002', run(repo,profile){
+    if (!profile.is_public) return [];
+    const out=[];
+    for (const f of repo.files){
+      if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
+      // \b around the backreference, and it is not cosmetic. The catch
+      // variable is usually `e`, and without boundaries that `e` matched the
+      // one inside the word "error" - so `res.json({ error: 'internal', ref })`,
+      // which is the CORRECT handling, was reported as leaking internals.
+      // Found by writing the test pair this check shipped without.
+      const re=/catch\s*\(\s*(\w+)\s*\)\s*\{[^}]{0,200}?(?:json|send)\s*\(\s*\{[^}]{0,120}?\b\1\b(?:\.message|\.stack)?/gs;
+      let m;
+      while ((m=re.exec(f.text))){
+        out.push(finding('API-002','Internal error details returned to the client','high',
+          f.path, lineOf(f.text,m.index),
+          'Raw error objects leak file paths, query fragments and library versions to anyone who can trigger them.',
+          'Log the real error server-side; return a generic message and a reference id.'));
+      }
+    }
+    return out;
+  }},
+
+{ id:'UP-002', run(repo,profile){
+    if (!profile.has_file_uploads) return [];
+    const hasLimit = repo.grep(/limits\s*:\s*\{[^}]*fileSize|maxFileSize|MAX_FILE_SIZE/).length;
+    if (hasLimit) return [];
+    const site = repo.grep(/multer\s*\(|formidable\s*\(|\.upload\s*\(/)[0];
+    return site ? [finding('UP-002','File uploads have no size limit','high',
+      site.path, 1,
+      'One user can upload a file large enough to fill your disk or exhaust memory.',
+      'Set an explicit maximum file size on the upload handler.')] : [];
+  }},
+];
+
+// AI checks supersede the earlier inline AI-003
+const BASE = BASE_CHECKS.filter(c => c.id !== 'AI-003');
+// the fuller AUTH_CHECKS version supersedes the early inline SEC-001
+const B2 = BASE.filter(c => c.id !== 'SEC-001');
+export const CHECKS = [...B2, ...AUTHZ_CHECKS, ...AI_CHECKS, ...DEPLOY_CHECKS, ...AUTH_CHECKS, ...FRAMEWORK_CHECKS, ...BATCH2_CHECKS, ...BATCH3_CHECKS, ...BATCH4_CHECKS, ...INJECTION_CHECKS];
+
+// Test and fixture files are not deployed. A "vulnerability" in a spec file is
+// noise, and noise is what makes people stop reading findings.
+const IS_TEST = /(^|\/)(tests?|__tests__|__mocks__|spec|e2e|fixtures?|examples?)\/|\.(test|spec)\.[jt]sx?$|\.stories\.[jt]sx?$/;
+
+function withoutTests(repo){
+  const files = repo.files.filter(f => !IS_TEST.test(f.path));
+  return { ...repo, files,
+    has:  (re) => files.some(f => re.test(f.path)),
+    find: (re) => files.filter(f => re.test(f.path)),
+    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|sql|prisma)$/) =>
+      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+  };
+}
+
+// Some facts live at the repo root and nowhere else - the lockfile, the CI
+// config, .gitignore. In a monorepo every workspace correctly lacks them, so a
+// check that looks for one from inside apps/web fires on every package and is
+// wrong every time. Those declare scope:'root' and run once, against the root.
+export function runRootChecks(repo, profile, applicableIds){
+  repo = withoutTests(repo);
+  const out=[];
+  for (const c of CHECKS){
+    if (c.scope !== 'root') continue;
+    if (applicableIds && !applicableIds.has(c.id)) continue;
+    try { out.push(...c.run(repo, profile)); } catch {}
+  }
+  return out;
+}
+
+export function runChecks(repo, profile, applicableIds){
+  repo = withoutTests(repo);
+  const out=[];
+  for (const c of CHECKS){
+    if (c.scope === 'root') continue;          // runRootChecks owns these
+    if (applicableIds && !applicableIds.has(c.id)) continue;
+    try { out.push(...c.run(repo, profile)); } catch {}
+  }
+  const rank={critical:0,high:1,medium:2,low:3};
+  return out.sort((a,b)=>rank[a.severity]-rank[b.severity]);
+}