launchprep 0.1.0 → 0.2.0

package/bin/launchprep.mjs

@@ -15,10 +15,24 @@ const argv = process.argv.slice(2);
 const cmd = argv[0];
 const KNOWN = new Set(['login', 'logout', 'deep', 'whoami', 'help', '--help', '-h']);
 
-if (!KNOWN.has(cmd)) {
-  // free scan - src/ only, nothing from net/ is loaded at all
-  await import('../src/index.mjs');
-} else {
-  const { run } = await import('../net/commands.mjs');
-  await run(cmd, argv.slice(1));
+// Anything that reaches here uncaught would otherwise print a Node stack
+// trace at someone who paid $29 and cannot read one. A network that is down
+// is not a bug in their project, and it should not look like one.
+try {
+  if (!KNOWN.has(cmd)) {
+    // free scan - src/ only, nothing from net/ is loaded at all
+    await import('../src/index.mjs');
+  } else {
+    const { run } = await import('../net/commands.mjs');
+    await run(cmd, argv.slice(1));
+  }
+} catch (e) {
+  const msg = e?.message || String(e);
+  process.stderr.write(`\n  \x1b[31m${msg}\x1b[0m\n`);
+  if (/could not reach|did not answer/i.test(msg)) {
+    process.stderr.write(`  \x1b[2mThe free checks do not need the network. Run \x1b[0mnpx ${BRAND.slug}\x1b[2m on its own.\x1b[0m\n`);
+    process.stderr.write(`  \x1b[2mIf this keeps happening, mail ${BRAND.email} — your scans are not spent unless a scan runs.\x1b[0m\n`);
+  }
+  process.stderr.write('\n');
+  process.exit(1);
 }

package/net/client.mjs

@@ -1,5 +1,6 @@
 // Talking to launchprep.dev. The only file in the CLI that opens a connection.
-const BASE = process.env.LAUNCHPREP_API || 'https://api.launchprep.dev';
+import { BRAND } from '../src/brand.mjs';
+const BASE = process.env.LAUNCHPREP_API || BRAND.api;
 
 async function call(path, { key, body, method = 'POST' } = {}) {
   let res;

package/net/commands.mjs

@@ -32,6 +32,7 @@ async function login(args) {
   if (!/^lp_/.test(key)) { console.error(`\n  ${C.red}That does not look like a licence key.${C.off} They start with lp_\n`); process.exit(1); }
 
   const r = await validate(key);
+  if (r.status === 429) { console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}.${C.off}\n`); process.exit(1); }
   if (r.status === 401) { console.error(`\n  ${C.red}That key is not recognised.${C.off}\n`); process.exit(1); }
   if (r.status === 403) { console.error(`\n  ${C.red}That key has been revoked.${C.off}\n`); process.exit(1); }
   if (!r.ok) { console.error(`\n  ${C.red}Could not check the key${C.off} ${C.d}(${r.status})${C.off}\n`); process.exit(1); }
@@ -94,6 +95,10 @@ async function deep(args) {
   const r = await deepScan({ key: c.key, digest, profile,
     ruleIds: tier2.map(x => x.id), appName: basename(target), idempotencyKey: idem });
 
+  if (r.status === 429) {
+    console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402) {
     console.error(`\n  ${C.red}No deep scans left${C.off} ${C.d}(${r.data?.used}/${r.data?.limit} used)${C.off}\n`);
     process.exit(1);
@@ -147,6 +152,11 @@ ${C.b}${BRAND.name}${C.off} ${C.d}${BRAND.tagline}${C.off}
 `);
 }
 
+const backoff = (r) => {
+  const s = Number(r.data?.retryAfter) || 60;
+  return s < 90 ? `${s} seconds` : `${Math.ceil(s / 60)} minutes`;
+};
+
 export async function run(cmd, args) {
   if (cmd === 'login')  return login(args);
   if (cmd === 'logout') return logout();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {

package/src/brand.mjs

@@ -8,6 +8,8 @@ export const BRAND = {
   name:     'Launchprep',   // shown to humans
   slug:     'launchprep',   // npm package, plugin id, slash command
   tagline:  'readiness scan',
+  email:    'hello@launchprep.dev',   // the address that actually receives
+  api:      'https://api.launchprep.dev',
 };
 
 export const CMD = '/' + BRAND.slug;

package/src/checks-auth.mjs

@@ -13,8 +13,12 @@ export const AUTH_CHECKS = [
 { id: 'SEC-001', run(repo) {
     const envs = repo.files.filter(f => /(^|\/)\.env(\.local|\.production|\.development)?$/.test(f.path));
     if (!envs.length) return [];
-    const gi = repo.read('.gitignore') || '';
-    if (/^\s*\*?\.?env/m.test(gi) || /^\s*\.env\*/m.test(gi)) return [];
+
+    // Asked per file, against every .gitignore from the git repository root
+    // down - not just one at the scan root. Our own api/.env is excluded by a
+    // rule one directory up, and reading only the local file reported it as a
+    // CRITICAL leak. The whole chain, or the answer is a guess.
+    const ignored = repo.isIgnored || (() => false);
 
     // A committed .env full of ChangeMe and localhost is a template, not a leak.
     // Only the values decide - flagging a placeholder file as CRITICAL is how a
@@ -33,7 +37,7 @@ export const AUTH_CHECKS = [
 
     const out = [];
     for (const f of envs) {
-      if (!f.text) continue;
+      if (!f.text || ignored(f.path)) continue;
       const hits = [];
       for (const line of f.text.split('\n')) {
         const eq = line.indexOf('=');

package/src/checks-deploy.mjs

@@ -3,6 +3,23 @@ const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
 const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
+// Comments blanked to spaces - offsets and line numbers survive, the words do
+// not. Our own server.mjs opens by explaining that it does NOT use
+// express.json(), and DATA-008 read that sentence as the call itself. Twelfth
+// time this shape has bitten: it matched a name where no code was.
+const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};
+
 export const DEPLOY_CHECKS = [
 
 // ---- a credential pasted into a CI workflow ------------------------------
@@ -157,13 +174,16 @@ export const DEPLOY_CHECKS = [
 // ---- no body size limit ---------------------------------------------------
 { id: 'DATA-008', run(repo, profile) {
     if (!profile.is_public) return [];
-    const express = repo.grep(/express\.json\s*\(|bodyParser\.json\s*\(/);
+    const CALL = /express\.json\s*\(|bodyParser\.json\s*\(/;
+    const express = repo.grep(CALL)
+      .map(f => ({ ...f, code: codeOnly(f.text) }))
+      .filter(f => CALL.test(f.code));
     if (!express.length) return [];
-    const limited = express.some(f => /json\s*\(\s*\{[^}]*limit\s*:/.test(f.text));
+    const limited = express.some(f => /json\s*\(\s*\{[^}]*limit\s*:/.test(f.code));
     if (limited) return [];
     const f = express[0];
     return [finding('DATA-008', 'No limit on request body size', 'medium',
-      f.path, lineOf(f.text, f.text.search(/express\.json|bodyParser\.json/)),
+      f.path, lineOf(f.code, f.code.search(CALL)),
       'A single request can send a body large enough to exhaust memory. No account needed.',
       'Pass a limit, e.g. express.json({ limit: "1mb" }).')];
   }},

package/src/checks-injection.mjs

@@ -0,0 +1,322 @@
+// User input concatenated into a SQL query.
+//
+// This was missing from all 288 rules. A project with `${req.params.id}` dropped
+// straight into a query got back "SELECT * on users, MEDIUM" and nothing about
+// the injection on the same line - which is the single most famous way a launch
+// goes wrong, and the one a reader would most expect us to catch.
+//
+// It is also the check most likely to cry wolf, because half the SQL in a modern
+// codebase is written with tagged templates that look identical to the dangerous
+// form and are completely safe. So the discipline that removed 166 false alarms
+// applies in full: read the value, judge the line, and require evidence the
+// thing is used the dangerous way. Three separate facts must all hold:
+//
+//   1. the string is actually SQL          - a verb AND a clause, not the word "select"
+//   2. something is interpolated into it   - not a constant string
+//   3. that something came from a request  - not a literal, not a column name
+//
+// And then the safe forms are subtracted, because every one of them would
+// otherwise fire on correct code.
+
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+
+// Comments blanked to spaces; offsets and line numbers survive, the words do
+// not. A comment reading "never do `SELECT * FROM users WHERE id = ${id}`" is
+// advice against the bug, not the bug.
+const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};
+
+// A verb and a clause. "select" alone matches a React prop, a CSS selector, a
+// variable called selectedUser and about forty other innocent things.
+const IS_SQL = /\b(select|insert\s+into|update|delete\s+from|replace\s+into)\b[\s\S]{0,300}?\b(from|into|where|set|values|join)\b/i;
+
+// The expression must trace to something the caller sent. A table name pulled
+// from a constant is a different (smaller) problem and not this finding.
+//
+// Every entry here is ROOTED - req.query, not query. The first version accepted
+// a bare `query.`, `params.` and `body.` and immediately flagged Sequelize's own
+//
+//     query.query = `SELECT * FROM FINAL TABLE (${query.query})`
+//
+// as a critical injection, because `query.query` matched. That is the twelfth
+// time this codebase has matched a NAME where it needed a CONTEXT, and on a
+// CRITICAL rule it is the one that costs the most: a reader cannot tell a
+// wrong finding from an irrelevant one, and stops believing the other 288.
+const FROM_REQUEST = new RegExp([
+  'req\\.(params|query|body|headers|cookies)',
+  'request\\.(params|query|body|args|form|json|GET|POST|values|data)',
+  '\\bctx\\.(request|params|query)',
+  'searchParams\\.get',
+  '\\$_(GET|POST|REQUEST|COOKIE)\\b',
+  'event\\.(queryStringParameters|pathParameters|body)',
+  '\\bgetQuery\\(|\\breadBody\\(',
+  '\\bformData\\.get',
+].join('|'));
+
+// Bare `params.id` IS the request in a Next.js, Remix or SvelteKit route
+// handler - and is just a variable anywhere else. So it counts as evidence
+// only in a file that is a route handler, which is a fact about the file
+// rather than a guess about the name.
+const BARE_PARAMS = /\bparams\.[A-Za-z_$]|\bsearchParams\.[A-Za-z_$]/;
+const IS_ROUTE_FILE = (path, code) =>
+  /(^|\/)(app|pages|src\/app|src\/pages)\/.*\/(route|page)\.(ts|tsx|js|jsx)$/.test(path) ||
+  /(^|\/)pages\/api\//.test(path) ||
+  /(^|\/)routes?\//.test(path) ||
+  /\+server\.(ts|js)$/.test(path) ||
+  /\bexport\s+(async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE)\s*\(/.test(code) ||
+  /\bexport\s+const\s+(GET|POST|PUT|PATCH|DELETE)\s*=/.test(code);
+
+// One hop of data flow, because one hop is where the bug actually lives.
+//
+//     const { id } = req.params;
+//     db.query(`select * from users where id = ${id}`)
+//
+// is far more common than interpolating req.params.id directly, and a check
+// that only saw the direct form would miss most real instances while claiming
+// to cover this. So: collect the names a file binds FROM a request, then treat
+// those names as the request.
+//
+// Scope is ignored on purpose. Tracking it properly needs a parser, and a file
+// that reads req.params.id into `id` and then pastes `id` into SQL is not
+// meaningfully ambiguous. What this must not do is taint a name bound from
+// anything else, which is why only these forms count.
+const TAINT_SOURCES = [
+  // const { a, b } = req.params / req.query / req.body / await req.json()
+  /(?:const|let|var)\s*\{([^}]{1,200})\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|json\(\)|formData\(\))/g,
+  // const { id } = await params        (Next.js 15 route handlers)
+  /(?:const|let|var)\s*\{([^}]{1,200})\}\s*=\s*await\s+(?:params|searchParams)\b/g,
+  // const x = req.query.y / req.params.y / req.body.y
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g,
+  // const x = searchParams.get('y') / url.searchParams.get('y') / formData.get('y')
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.$]*(?:searchParams|formData)\.get\s*\(/g,
+  // python:  x = request.args.get('y') / request.form['y'] / request.json['y']
+  /([A-Za-z_][\w]*)\s*=\s*request\.(?:args|form|json|values|data|GET|POST)\b/g,
+  // php:  $x = $_GET['y']
+  /\$([A-Za-z_]\w*)\s*=\s*\$_(?:GET|POST|REQUEST|COOKIE)\b/g,
+];
+
+function taintedNames(code) {
+  const names = new Set();
+  for (const re of TAINT_SOURCES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      for (const part of m[1].split(',')) {
+        // { id }  and  { id: userId }  and  { id = 1 }  all bind the LAST name
+        const n = part.split(':').pop().split('=')[0].trim().replace(/^\.\.\./, '');
+        if (/^[A-Za-z_$][\w$]*$/.test(n)) names.add(n);
+      }
+    }
+  }
+  // Names so generic that binding one would taint half the file's arithmetic.
+  for (const junk of ['data', 'body', 'params', 'query', 'req', 'request', 'options', 'props']) names.delete(junk);
+  return names;
+}
+
+const usesTainted = (expr, names) => {
+  if (!names.size) return false;
+  for (const m of expr.matchAll(/[A-Za-z_$][\w$]*/g)) if (names.has(m[0])) return true;
+  return false;
+};
+
+// Wrapped in a numeric coercion it cannot carry a quote, a comment marker or a
+// semicolon. Flagging it would be flagging arithmetic.
+const COERCED = /^\s*(Number|parseInt|parseFloat|int|float|Integer\.parseInt|to_i|intval)\s*\(|^\s*\+\s*[A-Za-z_$]/;
+
+// Tagged templates that parameterise. These look EXACTLY like the dangerous
+// form and are the reason a naive version of this check would be unusable:
+// prisma.$queryRaw`...${id}...` is safe, prisma.$queryRawUnsafe(`...${id}...`)
+// is not, and the difference is six characters.
+const SAFE_TAG = /(^|[^\w$])(sql|SQL|sqlx?|prisma\.\$queryRaw|prisma\.\$executeRaw|\$queryRaw|\$executeRaw|db\.sql|tx\.sql|conn\.sql|knex\.raw|Prisma\.sql|drizzle|postgres|neon|planetscale)$/;
+
+// Where a template literal ends, honouring escapes and nested ${ } which may
+// themselves contain template literals.
+function endOfTemplate(t, start) {
+  let i = start + 1;
+  while (i < t.length) {
+    const c = t[i];
+    if (c === '\\') { i += 2; continue; }
+    if (c === '`') return i;
+    if (c === '$' && t[i + 1] === '{') {
+      let depth = 1; i += 2;
+      while (i < t.length && depth > 0) {
+        if (t[i] === '\\') { i += 2; continue; }
+        if (t[i] === '`') { const e = endOfTemplate(t, i); i = e === -1 ? t.length : e + 1; continue; }
+        if (t[i] === '{') depth++;
+        else if (t[i] === '}') depth--;
+        i++;
+      }
+      continue;
+    }
+    i++;
+  }
+  return -1;
+}
+
+// The ${ ... } expressions inside one template literal, as text.
+function holes(tpl) {
+  const out = [];
+  for (let i = 0; i < tpl.length; i++) {
+    if (tpl[i] === '\\') { i++; continue; }
+    if (tpl[i] === '$' && tpl[i + 1] === '{') {
+      let depth = 1, j = i + 2; const from = j;
+      while (j < tpl.length && depth > 0) {
+        if (tpl[j] === '\\') { j += 2; continue; }
+        if (tpl[j] === '{') depth++;
+        else if (tpl[j] === '}') depth--;
+        if (depth > 0) j++;
+      }
+      out.push(tpl.slice(from, j));
+      i = j;
+    }
+  }
+  return out;
+}
+
+const JS  = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const PY  = /\.py$/;
+const PHP = /\.php$/;
+const RB  = /\.rb$/;
+
+function scanJs(path, code, out) {
+  const routeFile = IS_ROUTE_FILE(path, code);
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h)
+    || (routeFile && BARE_PARAMS.test(h))
+    || usesTainted(h, tainted);
+  for (let i = 0; i < code.length; i++) {
+    if (code[i] !== '`') continue;
+    const end = endOfTemplate(code, i);
+    if (end === -1) break;
+    const tpl = code.slice(i + 1, end);
+    const before = code.slice(Math.max(0, i - 60), i).trimEnd();
+    i = end;
+
+    if (!IS_SQL.test(tpl)) continue;
+    if (SAFE_TAG.test(before)) continue;               // parameterised by the tag
+
+    const bad = holes(tpl).filter(h => isInput(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, i - tpl.length), expr: bad[0].trim(), how: 'a template literal' });
+  }
+
+  // "select ... where id = " + req.params.id
+  const CONCAT = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*\+\s*([^;\n]{1,120})/g;
+  let m;
+  while ((m = CONCAT.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    const rhs = m[3];
+    if (!isInput(rhs) || COERCED.test(rhs)) continue;
+    out.push({ line: lineOf(code, m.index), expr: rhs.trim().slice(0, 60), how: 'string concatenation' });
+  }
+}
+
+function scanPy(path, code, out) {
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h) || usesTainted(h, tainted);
+  // f"... {req.args['id']} ..."  -- the f prefix is what makes it interpolate
+  const FSTR = /\bf(["'])((?:(?!\1)[^\\]|\\.)*)\1|\bf("""|''')([\s\S]*?)\3/g;
+  let m;
+  while ((m = FSTR.exec(code))) {
+    const body = m[2] ?? m[4] ?? '';
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/\{([^{}]+)\}/g)].map(x => x[1])
+      .filter(h => isInput(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, m.index), expr: bad[0].trim(), how: 'an f-string' });
+  }
+
+  // "... %s ..." % x  and  "...".format(x)
+  //
+  // The % HAS to be applied to the string. cursor.execute("... %s", (x,)) is
+  // the correct parameterised call and looks almost the same - the difference
+  // is a comma instead of a percent sign, and it is the whole difference.
+  const APPLIED = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*(?:%\s*|\.format\s*\()([^\n;]{1,120})/g;
+  while ((m = APPLIED.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    if (!isInput(m[3]) || COERCED.test(m[3])) continue;
+    out.push({ line: lineOf(code, m.index), expr: m[3].trim().slice(0, 60), how: 'string formatting' });
+  }
+}
+
+function scanPhp(path, code, out) {
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h) || usesTainted(h, tainted);
+  const STR = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = STR.exec(code))) {
+    const body = m[1];
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/\{?\$([A-Za-z_]\w*(?:\[[^\]]+\])?(?:->\w+)?)\}?/g)].map(x => '$' + x[1])
+      .filter(h => isInput(h));
+    if (bad.length) { out.push({ line: lineOf(code, m.index), expr: bad[0], how: 'string interpolation' }); continue; }
+  }
+  const DOT = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*\.\s*([^;\n]{1,120})/g;
+  while ((m = DOT.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    if (!isInput(m[3])) continue;
+    out.push({ line: lineOf(code, m.index), expr: m[3].trim().slice(0, 60), how: 'string concatenation' });
+  }
+}
+
+function scanRb(path, code, out) {
+  const STR = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = STR.exec(code))) {
+    const body = m[1];
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/#\{([^}]+)\}/g)].map(x => x[1])
+      .filter(h => FROM_REQUEST.test(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, m.index), expr: bad[0].trim(), how: 'string interpolation' });
+  }
+}
+
+export const INJECTION_CHECKS = [
+
+{ id: 'DATA-015', run(repo) {
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text) continue;
+      const isJs = JS.test(f.path), isPy = PY.test(f.path),
+            isPhp = PHP.test(f.path), isRb = RB.test(f.path);
+      if (!isJs && !isPy && !isPhp && !isRb) continue;
+      // A migration writes its own SQL and takes no request input; a seed file
+      // is the same. Both are full of raw SQL and neither is reachable.
+      if (/(^|\/)(migrations?|seeds?|db\/migrate)\//.test(f.path)) continue;
+
+      const code = codeOnly(f.text);
+      const hits = [];
+      if (isJs)  scanJs(f.path, code, hits);
+      if (isPy)  scanPy(f.path, code, hits);
+      if (isPhp) scanPhp(f.path, code, hits);
+      if (isRb)  scanRb(f.path, code, hits);
+
+      // One finding per file. Somebody who builds queries this way builds them
+      // this way in twenty places, and twenty identical CRITICALs is not twenty
+      // times the information - it is one piece of information, shouted.
+      if (!hits.length) continue;
+      const h = hits[0];
+      const more = hits.length > 1 ? ` The same pattern appears ${hits.length} times in this file.` : '';
+      out.push(finding('DATA-015',
+        'Anyone can read or delete your whole database by typing into a form', 'critical',
+        f.path, h.line,
+        `A value that came straight from the visitor is pasted into a database query through ${h.how} — here it is \`${h.expr}\`. Whatever they type is not treated as data, it is treated as part of the instruction. Typing the right thing into that field reads every table, changes any row, or deletes the lot, and nothing in the code stops it.${more}`,
+        'Never build the query by joining strings. Leave a placeholder where the value goes and pass the value alongside it — `db.query("select * from users where id = $1", [id])` — so the database treats it as data no matter what it contains.'));
+    }
+    return out;
+  }},
+
+];

package/src/checks.mjs

@@ -1,6 +1,7 @@
 // Tier-1 checks: deterministic, no LLM, no network. Each returns findings with
 // a file:line so the user can go straight to it.
 import { AUTHZ_CHECKS } from './checks-authz.mjs';
+import { INJECTION_CHECKS } from './checks-injection.mjs';
 import { AI_CHECKS } from './checks-ai.mjs';
 import { DEPLOY_CHECKS } from './checks-deploy.mjs';
 import { AUTH_CHECKS } from './checks-auth.mjs';
@@ -75,6 +76,12 @@ const BASE_CHECKS = [
       if (!f.text || /\.(md|lock)$/.test(f.path)) continue;
       if (/\.(example|sample|template|dist)$/i.test(f.path) ||
           /\.env\.(example|sample|template)/i.test(f.path)) continue;
+      // A key in a .env file is not hardcoded - .env IS the environment
+      // variable, and telling someone to "move it to an environment variable"
+      // is advice to do the thing they already did. Whether that file is safe
+      // is a question about .gitignore, and SEC-001 is the check that knows
+      // how to ask it.
+      if (/(^|\/)\.env(\.[A-Za-z0-9_-]+)?$/.test(f.path)) continue;
       for (const [re,label] of PATTERNS){
         let m; re.lastIndex=0;
         while ((m=re.exec(f.text))){
@@ -137,7 +144,12 @@ const BASE_CHECKS = [
     const out=[];
     for (const f of repo.files){
       if (!f.text || !/\.(ts|js|mjs)$/.test(f.path)) continue;
-      const re=/catch\s*\(\s*(\w+)\s*\)\s*\{[^}]{0,200}?(?:json|send)\s*\(\s*\{[^}]{0,120}?\1(?:\.message|\.stack)?/gs;
+      // \b around the backreference, and it is not cosmetic. The catch
+      // variable is usually `e`, and without boundaries that `e` matched the
+      // one inside the word "error" - so `res.json({ error: 'internal', ref })`,
+      // which is the CORRECT handling, was reported as leaking internals.
+      // Found by writing the test pair this check shipped without.
+      const re=/catch\s*\(\s*(\w+)\s*\)\s*\{[^}]{0,200}?(?:json|send)\s*\(\s*\{[^}]{0,120}?\b\1\b(?:\.message|\.stack)?/gs;
       let m;
       while ((m=re.exec(f.text))){
         out.push(finding('API-002','Internal error details returned to the client','high',
@@ -165,7 +177,7 @@ const BASE_CHECKS = [
 const BASE = BASE_CHECKS.filter(c => c.id !== 'AI-003');
 // the fuller AUTH_CHECKS version supersedes the early inline SEC-001
 const B2 = BASE.filter(c => c.id !== 'SEC-001');
-export const CHECKS = [...B2, ...AUTHZ_CHECKS, ...AI_CHECKS, ...DEPLOY_CHECKS, ...AUTH_CHECKS, ...FRAMEWORK_CHECKS, ...BATCH2_CHECKS, ...BATCH3_CHECKS, ...BATCH4_CHECKS];
+export const CHECKS = [...B2, ...AUTHZ_CHECKS, ...AI_CHECKS, ...DEPLOY_CHECKS, ...AUTH_CHECKS, ...FRAMEWORK_CHECKS, ...BATCH2_CHECKS, ...BATCH3_CHECKS, ...BATCH4_CHECKS, ...INJECTION_CHECKS];
 
 // Test and fixture files are not deployed. A "vulnerability" in a spec file is
 // noise, and noise is what makes people stop reading findings.

package/src/fs-scan.mjs

@@ -1,7 +1,7 @@
 // Cheap repo walk. Everything downstream reads from this one pass so we never
 // hit the disk twice for the same file.
 import { readdirSync, readFileSync, statSync, existsSync, lstatSync, realpathSync } from 'node:fs';
-import { join, relative, extname, resolve, sep } from 'node:path';
+import { join, relative, extname, resolve, sep, dirname, posix } from 'node:path';
 
 const SKIP = new Set([
   'node_modules', '.git', '.next', 'dist', 'build', 'out', 'coverage',
@@ -34,6 +34,98 @@ function containedRealPath(root, full) {
   } catch { return null; }
 }
 
+
+// ---- the whole ignore chain, not just the file at the scan root ------------
+// .gitignore is resolved against the GIT repository root, which is often above
+// the directory being scanned. Reading only `<scanroot>/.gitignore` told us our
+// own api/.env was unprotected when the rule excluding it sits one level up, in
+// the repo root - a CRITICAL finding that was simply wrong. Same shape as every
+// other false positive we have had: it judged the file without the context that
+// decides it.
+//
+// Read-only, and it reads .git directly rather than shelling out to git, which
+// verify-readonly.mjs forbids.
+function gitRoot(from) {
+  let d = resolve(from);
+  for (let i = 0; i < 40; i++) {
+    if (existsSync(join(d, '.git'))) return d;
+    const up = dirname(d);
+    if (up === d) return null;
+    d = up;
+  }
+  return null;
+}
+
+// Enough of the gitignore syntax to answer "is this path excluded": globs,
+// anchoring, directory-only rules and negation. Not the whole spec - but the
+// alternative was a regex that guessed, and guessing is what produced the bug.
+function toRegExp(pattern) {
+  let p = pattern;
+  const anchored = p.startsWith('/') || p.slice(0, -1).includes('/');
+  if (p.startsWith('/')) p = p.slice(1);
+  if (p.endsWith('/')) p = p.slice(0, -1);
+  let re = '';
+  for (let i = 0; i < p.length; i++) {
+    const c = p[i];
+    if (c === '*') {
+      if (p[i + 1] === '*') { re += '.*'; i++; if (p[i + 1] === '/') i++; }
+      else re += '[^/]*';
+    }
+    else if (c === '?') re += '[^/]';
+    else re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  return new RegExp('^' + (anchored ? '' : '(?:.*/)?') + re + '(?:/.*)?$');
+}
+
+// Each rule is kept with the directory its .gitignore was written in, because
+// that is what its paths are relative to. Exported so the test shim builds its
+// matcher the same way rather than approximating it.
+export function buildIgnore(rootAbs, sources) {
+  const rules = [];
+  for (const { dir, text } of sources) {
+    for (const raw of String(text ?? '').split('\n')) {
+      const line = raw.trim();
+      if (!line || line.startsWith('#')) continue;
+      const negate = line.startsWith('!');
+      const pattern = negate ? line.slice(1) : line;
+      if (!pattern) continue;
+      rules.push({ dir, re: toRegExp(pattern), negate });
+    }
+  }
+  // last matching rule wins, which is what git does
+  return (relPath) => {
+    const abs = resolve(rootAbs, relPath);
+    let ignored = false;
+    for (const r of rules) {
+      const rel = relative(r.dir, abs);
+      if (!rel || rel.startsWith('..')) continue;
+      if (r.re.test(rel.split(sep).join(posix.sep))) ignored = !r.negate;
+    }
+    return ignored;
+  };
+}
+
+// Every .gitignore from the git root down to the scan root, plus .git/info/exclude.
+export function ignoreChain(root) {
+  const rootAbs = resolve(root);
+  const gr = gitRoot(rootAbs);
+  const dirs = [];
+  if (gr) { let d = rootAbs; while (true) { dirs.unshift(d); if (d === gr) break; const up = dirname(d); if (up === d) break; d = up; } }
+  else dirs.push(rootAbs);
+
+  const sources = [];
+  const readAt = (dir, rel) => { try { return readFileSync(join(dir, rel), 'utf8'); } catch { return null; } };
+  for (const d of dirs) {
+    const t = readAt(d, '.gitignore');
+    if (t !== null) sources.push({ dir: d, text: t });
+  }
+  if (gr) {
+    const t = readAt(gr, join('.git', 'info', 'exclude'));
+    if (t !== null) sources.push({ dir: gr, text: t });
+  }
+  return buildIgnore(rootAbs, sources);
+}
+
 export function scanRepo(root, { maxFiles = 6000 } = {}) {
   const files = [];
   const rootAbs = resolve(root);
@@ -74,6 +166,7 @@ export function scanRepo(root, { maxFiles = 6000 } = {}) {
       files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
     exists: (rel) => existsSync(join(root, rel)),
     read: (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
+    isIgnored: ignoreChain(root),
   };
 }
 

package/src/rules.json

@@ -1,6 +1,6 @@
 {
 "version": "0.1",
-"count": 288,
+"count": 289,
 "rules": [
 {
 "id": "SEC-001",
@@ -1013,6 +1013,16 @@
 "category": "data-and-scale"
 },
 {
+"id": "DATA-015",
+"title": "User input concatenated into a SQL query",
+"severity": "critical",
+"tier": 1,
+"check": "a request value interpolated into a SQL string instead of passed as a parameter",
+"note": "the oldest way to lose a database and still the most common. Parameterised queries are not a mitigation, they are the fix.",
+"origin": "gap",
+"category": "data-and-scale"
+},
+{
 "id": "INF-001",
 "title": "Single instance with no redundancy",
 "severity": "medium",