launchprep 0.1.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,31 @@
+Launchprep Licence
+
+Copyright (c) 2026 Bc. Bektur Aibekov, IČO 29522471, Prague, Czech Republic.
+All rights reserved.
+
+You may:
+
+  1. Install and run this software to scan source code that you own or are
+     authorised to scan.
+  2. Make copies as reasonably necessary for that use (for example, inside a
+     CI pipeline or a container image you operate).
+
+You may not:
+
+  3. Copy, redistribute, sublicense, sell, or publish this software or any
+     part of it, including the rule and check definitions it contains.
+  4. Extract, reproduce, or adapt the rule and check definitions for use in
+     any other product or service, commercial or not.
+  5. Remove or alter this notice.
+
+Versions 0.1.0 and 0.2.0 of the "launchprep" npm package were published under
+the MIT licence; that grant stands for those versions. This licence applies to
+this version and all later ones.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY ARISING FROM THE USE OF THE SOFTWARE. Findings are produced
+by automated analysis and may be incomplete or wrong; they are information,
+not a guarantee of security or fitness for launch.
+
+Questions and permissions: hello@launchprep.dev

package/README.md

@@ -13,7 +13,7 @@ No signup. No dashboard. Nothing added to your repo.
 
 ## What it does
 
-288 checks — but it works out what you built **before** running any of them, so
+289 checks — but it works out what you built **before** running any of them, so
 you are not told about problems you cannot have. A static site is asked 48
 questions; a multi-tenant SaaS with payments and AI is asked 158.
 
@@ -69,6 +69,19 @@ the report link keeps working, and that link expires.
 
 If there is no terminal — CI, a script — it refuses rather than assuming yes.
 
+## In CI
+
+```bash
+npx launchprep . --fail-on critical         # exit 1 if a critical is found
+npx launchprep deep . --yes --fail-on high  # the paid scan as a gate
+```
+
+Without `--fail-on` the exit code stays 0 — a report, not a verdict. With it,
+findings at or above the threshold (`critical`, `high`, `medium`, `low`, `any`)
+fail the build. On a deep scan, checks that did not complete fail it too — a
+check that could not run has not passed. A path that does not exist always
+exits 2: a scan of nothing must never look like a clean scan of something.
+
 ## Free and paid
 
 Everything above is free, unlimited, forever — every check a program can make on
@@ -81,4 +94,6 @@ delete. See <https://launchprep.dev>.
 
 ## Licence
 
-MIT
+Proprietary — see the LICENSE file. Run it on anything you are authorised to
+scan; the rules and checks may not be copied into other products. Versions
+0.1.0 and 0.2.0 were published under MIT and remain so.

package/bin/launchprep.mjs

@@ -15,10 +15,24 @@ const argv = process.argv.slice(2);
 const cmd = argv[0];
 const KNOWN = new Set(['login', 'logout', 'deep', 'whoami', 'help', '--help', '-h']);
 
-if (!KNOWN.has(cmd)) {
-  // free scan - src/ only, nothing from net/ is loaded at all
-  await import('../src/index.mjs');
-} else {
-  const { run } = await import('../net/commands.mjs');
-  await run(cmd, argv.slice(1));
+// Anything that reaches here uncaught would otherwise print a Node stack
+// trace at someone who paid $29 and cannot read one. A network that is down
+// is not a bug in their project, and it should not look like one.
+try {
+  if (!KNOWN.has(cmd)) {
+    // free scan - src/ only, nothing from net/ is loaded at all
+    await import('../src/index.mjs');
+  } else {
+    const { run } = await import('../net/commands.mjs');
+    await run(cmd, argv.slice(1));
+  }
+} catch (e) {
+  const msg = e?.message || String(e);
+  process.stderr.write(`\n  \x1b[31m${msg}\x1b[0m\n`);
+  if (/could not reach|did not answer/i.test(msg)) {
+    process.stderr.write(`  \x1b[2mThe free checks do not need the network. Run \x1b[0mnpx ${BRAND.slug}\x1b[2m on its own.\x1b[0m\n`);
+    process.stderr.write(`  \x1b[2mIf this keeps happening, mail ${BRAND.email} — your scans are not spent unless a scan runs.\x1b[0m\n`);
+  }
+  process.stderr.write('\n');
+  process.exit(1);
 }

package/net/client.mjs

@@ -1,5 +1,6 @@
 // Talking to launchprep.dev. The only file in the CLI that opens a connection.
-const BASE = process.env.LAUNCHPREP_API || 'https://api.launchprep.dev';
+import { BRAND } from '../src/brand.mjs';
+const BASE = process.env.LAUNCHPREP_API || BRAND.api;
 
 async function call(path, { key, body, method = 'POST' } = {}) {
   let res;

package/net/commands.mjs

@@ -32,6 +32,7 @@ async function login(args) {
   if (!/^lp_/.test(key)) { console.error(`\n  ${C.red}That does not look like a licence key.${C.off} They start with lp_\n`); process.exit(1); }
 
   const r = await validate(key);
+  if (r.status === 429) { console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}.${C.off}\n`); process.exit(1); }
   if (r.status === 401) { console.error(`\n  ${C.red}That key is not recognised.${C.off}\n`); process.exit(1); }
   if (r.status === 403) { console.error(`\n  ${C.red}That key has been revoked.${C.off}\n`); process.exit(1); }
   if (!r.ok) { console.error(`\n  ${C.red}Could not check the key${C.off} ${C.d}(${r.status})${C.off}\n`); process.exit(1); }
@@ -94,6 +95,16 @@ async function deep(args) {
   const r = await deepScan({ key: c.key, digest, profile,
     ruleIds: tier2.map(x => x.id), appName: basename(target), idempotencyKey: idem });
 
+  if (r.status === 429) {
+    console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
+    process.exit(1);
+  }
+  if (r.status === 402 && (r.data?.error === 'attempt_ceiling' || r.data?.error === 'spend_ceiling')) {
+    console.error(`\n  ${C.red}This key has run too many scans that did not finish.${C.off}`);
+    console.error(`  ${C.d}${r.data.attempts} attempts against a ${r.data.limit}-scan licence. Something is going`);
+    console.error(`  wrong on our side rather than yours — mail ${BRAND.email} and we will sort it out.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402) {
     console.error(`\n  ${C.red}No deep scans left${C.off} ${C.d}(${r.data?.used}/${r.data?.limit} used)${C.off}\n`);
     process.exit(1);
@@ -122,12 +133,47 @@ async function deep(args) {
     console.log(`      ${f.detail}`);
     console.log(`      ${C.grn}Fix${C.off}  ${f.fix}\n`);
   }
+  // Printed BEFORE the report link, and before the scans-left line, because a
+  // reader who stops at the findings must still have seen this. A check that
+  // did not run is a hole in the answer, not a footnote to it.
+  const missed = r.data.incomplete || [];
+  if (missed.length) {
+    console.log(`${C.red}${C.b}${missed.length} check${missed.length === 1 ? '' : 's'} did not complete${C.off}`);
+    console.log(`  ${C.d}These are not a pass. Nothing below was ruled out.${C.off}`);
+    for (const m of missed.slice(0, 8)) {
+      console.log(`  ${C.red}~${C.off} ${C.g}${m.id.padEnd(12)}${C.off}${C.d}${(m.title || '').slice(0, 58)}${C.off}`);
+    }
+    if (missed.length > 8) console.log(`  ${C.d}and ${missed.length - 8} more${C.off}`);
+    if (r.data.coverage !== undefined) {
+      console.log(`  ${C.d}${Math.round(r.data.coverage * 100)}% of the ${r.data.rulesAsked} checks in this scan answered.${C.off}`);
+    }
+    if (r.data.refunded) {
+      console.log(`  ${C.grn}This scan did not finish, so it does not count against your five.${C.off}`);
+    }
+    console.log(`  ${C.d}Run it again and they usually complete.${C.off}\n`);
+  }
+
   if (r.data.report?.url) {
     console.log(`${C.b}Your report${C.off}`);
     console.log(`  ${C.o}${r.data.report.url}${C.off}`);
     console.log(`  ${C.d}dated, shareable, and it expires in ${r.data.report.expiresInDays} days${C.off}\n`);
   }
   console.log(`  ${C.d}${r.data.scansRemaining} deep scan${r.data.scansRemaining === 1 ? '' : 's'} left${C.off}\n`);
+
+  // --fail-on <severity>: the CI gate, same contract as the free scan. The
+  // human report above has fully printed; the pipeline now gets its verdict.
+  // A scan with holes trips the gate too — a check that did not run has not
+  // passed, and a gate that shrugs at that is a gate that waves through the
+  // exact case it exists for.
+  const failOn = args[args.indexOf('--fail-on') + 1];
+  if (args.includes('--fail-on')) {
+    if (!(failOn in rank) && failOn !== 'any') {
+      console.error('  --fail-on must be one of: critical, high, medium, low, any');
+      process.exit(2);
+    }
+    const limit = failOn === 'any' ? 3 : rank[failOn];
+    if (findings.some(f => rank[f.severity] <= limit) || missed.length) process.exit(1);
+  }
 }
 
 function help() {
@@ -140,13 +186,20 @@ ${C.b}${BRAND.name}${C.off} ${C.d}${BRAND.tagline}${C.off}
   ${C.b}npx ${BRAND.slug} logout${C.off}           forget the key
   ${C.b}npx ${BRAND.slug} deep${C.off} ${C.d}[path]${C.off}     the paid scan — asks before sending anything
 
-  ${C.d}--yes${C.off}   skip the upload confirmation ${C.d}(for CI)${C.off}
-  ${C.d}--json${C.off}  machine readable ${C.d}(free scan only)${C.off}
+  ${C.d}--yes${C.off}              skip the upload confirmation ${C.d}(for CI)${C.off}
+  ${C.d}--json${C.off}             machine readable ${C.d}(free scan only)${C.off}
+  ${C.d}--fail-on${C.off} ${C.d}<sev>${C.off}    exit 1 if findings reach this severity — fails a CI build
+                     ${C.d}critical | high | medium | low | any${C.off}
 
   ${C.d}https://${BRAND.slug}.dev${C.off}
 `);
 }
 
+const backoff = (r) => {
+  const s = Number(r.data?.retryAfter) || 60;
+  return s < 90 ? `${s} seconds` : `${Math.ceil(s / 60)} minutes`;
+};
+
 export async function run(cmd, args) {
   if (cmd === 'login')  return login(args);
   if (cmd === 'logout') return logout();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -11,12 +11,15 @@
     "net",
     "bin",
     "scripts/verify-readonly.mjs",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs"
+    "test": "node test/run.mjs && node test/gate.mjs",
+    "prepack": "node scripts/prepare-publish.mjs",
+    "postpack": "node scripts/restore-after-publish.mjs"
   },
   "keywords": [
     "security",
@@ -29,13 +32,11 @@
     "checklist"
   ],
   "homepage": "https://launchprep.dev",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/312labs/launchprep-app.git",
-    "directory": "cli"
-  },
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "engines": {
     "node": ">=18"
+  },
+  "bugs": {
+    "email": "hello@launchprep.dev"
   }
 }

package/src/brand.mjs

@@ -8,6 +8,8 @@ export const BRAND = {
   name:     'Launchprep',   // shown to humans
   slug:     'launchprep',   // npm package, plugin id, slash command
   tagline:  'readiness scan',
+  email:    'hello@launchprep.dev',   // the address that actually receives
+  api:      'https://api.launchprep.dev',
 };
 
 export const CMD = '/' + BRAND.slug;

package/src/checks-auth.mjs

@@ -13,8 +13,12 @@ export const AUTH_CHECKS = [
 { id: 'SEC-001', run(repo) {
     const envs = repo.files.filter(f => /(^|\/)\.env(\.local|\.production|\.development)?$/.test(f.path));
     if (!envs.length) return [];
-    const gi = repo.read('.gitignore') || '';
-    if (/^\s*\*?\.?env/m.test(gi) || /^\s*\.env\*/m.test(gi)) return [];
+
+    // Asked per file, against every .gitignore from the git repository root
+    // down - not just one at the scan root. Our own api/.env is excluded by a
+    // rule one directory up, and reading only the local file reported it as a
+    // CRITICAL leak. The whole chain, or the answer is a guess.
+    const ignored = repo.isIgnored || (() => false);
 
     // A committed .env full of ChangeMe and localhost is a template, not a leak.
     // Only the values decide - flagging a placeholder file as CRITICAL is how a
@@ -33,7 +37,7 @@ export const AUTH_CHECKS = [
 
     const out = [];
     for (const f of envs) {
-      if (!f.text) continue;
+      if (!f.text || ignored(f.path)) continue;
       const hits = [];
       for (const line of f.text.split('\n')) {
         const eq = line.indexOf('=');

package/src/checks-deploy.mjs

@@ -3,6 +3,23 @@ const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
 const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
+// Comments blanked to spaces - offsets and line numbers survive, the words do
+// not. Our own server.mjs opens by explaining that it does NOT use
+// express.json(), and DATA-008 read that sentence as the call itself. Twelfth
+// time this shape has bitten: it matched a name where no code was.
+const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};
+
 export const DEPLOY_CHECKS = [
 
 // ---- a credential pasted into a CI workflow ------------------------------
@@ -157,13 +174,16 @@ export const DEPLOY_CHECKS = [
 // ---- no body size limit ---------------------------------------------------
 { id: 'DATA-008', run(repo, profile) {
     if (!profile.is_public) return [];
-    const express = repo.grep(/express\.json\s*\(|bodyParser\.json\s*\(/);
+    const CALL = /express\.json\s*\(|bodyParser\.json\s*\(/;
+    const express = repo.grep(CALL)
+      .map(f => ({ ...f, code: codeOnly(f.text) }))
+      .filter(f => CALL.test(f.code));
     if (!express.length) return [];
-    const limited = express.some(f => /json\s*\(\s*\{[^}]*limit\s*:/.test(f.text));
+    const limited = express.some(f => /json\s*\(\s*\{[^}]*limit\s*:/.test(f.code));
     if (limited) return [];
     const f = express[0];
     return [finding('DATA-008', 'No limit on request body size', 'medium',
-      f.path, lineOf(f.text, f.text.search(/express\.json|bodyParser\.json/)),
+      f.path, lineOf(f.code, f.code.search(CALL)),
       'A single request can send a body large enough to exhaust memory. No account needed.',
       'Pass a limit, e.g. express.json({ limit: "1mb" }).')];
   }},

package/src/checks-injection.mjs

@@ -0,0 +1,322 @@
+// User input concatenated into a SQL query.
+//
+// This was missing from all 288 rules. A project with `${req.params.id}` dropped
+// straight into a query got back "SELECT * on users, MEDIUM" and nothing about
+// the injection on the same line - which is the single most famous way a launch
+// goes wrong, and the one a reader would most expect us to catch.
+//
+// It is also the check most likely to cry wolf, because half the SQL in a modern
+// codebase is written with tagged templates that look identical to the dangerous
+// form and are completely safe. So the discipline that removed 166 false alarms
+// applies in full: read the value, judge the line, and require evidence the
+// thing is used the dangerous way. Three separate facts must all hold:
+//
+//   1. the string is actually SQL          - a verb AND a clause, not the word "select"
+//   2. something is interpolated into it   - not a constant string
+//   3. that something came from a request  - not a literal, not a column name
+//
+// And then the safe forms are subtracted, because every one of them would
+// otherwise fire on correct code.
+
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+
+// Comments blanked to spaces; offsets and line numbers survive, the words do
+// not. A comment reading "never do `SELECT * FROM users WHERE id = ${id}`" is
+// advice against the bug, not the bug.
+const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};
+
+// A verb and a clause. "select" alone matches a React prop, a CSS selector, a
+// variable called selectedUser and about forty other innocent things.
+const IS_SQL = /\b(select|insert\s+into|update|delete\s+from|replace\s+into)\b[\s\S]{0,300}?\b(from|into|where|set|values|join)\b/i;
+
+// The expression must trace to something the caller sent. A table name pulled
+// from a constant is a different (smaller) problem and not this finding.
+//
+// Every entry here is ROOTED - req.query, not query. The first version accepted
+// a bare `query.`, `params.` and `body.` and immediately flagged Sequelize's own
+//
+//     query.query = `SELECT * FROM FINAL TABLE (${query.query})`
+//
+// as a critical injection, because `query.query` matched. That is the twelfth
+// time this codebase has matched a NAME where it needed a CONTEXT, and on a
+// CRITICAL rule it is the one that costs the most: a reader cannot tell a
+// wrong finding from an irrelevant one, and stops believing the other 288.
+const FROM_REQUEST = new RegExp([
+  'req\\.(params|query|body|headers|cookies)',
+  'request\\.(params|query|body|args|form|json|GET|POST|values|data)',
+  '\\bctx\\.(request|params|query)',
+  'searchParams\\.get',
+  '\\$_(GET|POST|REQUEST|COOKIE)\\b',
+  'event\\.(queryStringParameters|pathParameters|body)',
+  '\\bgetQuery\\(|\\breadBody\\(',
+  '\\bformData\\.get',
+].join('|'));
+
+// Bare `params.id` IS the request in a Next.js, Remix or SvelteKit route
+// handler - and is just a variable anywhere else. So it counts as evidence
+// only in a file that is a route handler, which is a fact about the file
+// rather than a guess about the name.
+const BARE_PARAMS = /\bparams\.[A-Za-z_$]|\bsearchParams\.[A-Za-z_$]/;
+const IS_ROUTE_FILE = (path, code) =>
+  /(^|\/)(app|pages|src\/app|src\/pages)\/.*\/(route|page)\.(ts|tsx|js|jsx)$/.test(path) ||
+  /(^|\/)pages\/api\//.test(path) ||
+  /(^|\/)routes?\//.test(path) ||
+  /\+server\.(ts|js)$/.test(path) ||
+  /\bexport\s+(async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE)\s*\(/.test(code) ||
+  /\bexport\s+const\s+(GET|POST|PUT|PATCH|DELETE)\s*=/.test(code);
+
+// One hop of data flow, because one hop is where the bug actually lives.
+//
+//     const { id } = req.params;
+//     db.query(`select * from users where id = ${id}`)
+//
+// is far more common than interpolating req.params.id directly, and a check
+// that only saw the direct form would miss most real instances while claiming
+// to cover this. So: collect the names a file binds FROM a request, then treat
+// those names as the request.
+//
+// Scope is ignored on purpose. Tracking it properly needs a parser, and a file
+// that reads req.params.id into `id` and then pastes `id` into SQL is not
+// meaningfully ambiguous. What this must not do is taint a name bound from
+// anything else, which is why only these forms count.
+const TAINT_SOURCES = [
+  // const { a, b } = req.params / req.query / req.body / await req.json()
+  /(?:const|let|var)\s*\{([^}]{1,200})\}\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|json\(\)|formData\(\))/g,
+  // const { id } = await params        (Next.js 15 route handlers)
+  /(?:const|let|var)\s*\{([^}]{1,200})\}\s*=\s*await\s+(?:params|searchParams)\b/g,
+  // const x = req.query.y / req.params.y / req.body.y
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?(?:req|request)\.(?:params|query|body|headers|cookies)\b/g,
+  // const x = searchParams.get('y') / url.searchParams.get('y') / formData.get('y')
+  /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.$]*(?:searchParams|formData)\.get\s*\(/g,
+  // python:  x = request.args.get('y') / request.form['y'] / request.json['y']
+  /([A-Za-z_][\w]*)\s*=\s*request\.(?:args|form|json|values|data|GET|POST)\b/g,
+  // php:  $x = $_GET['y']
+  /\$([A-Za-z_]\w*)\s*=\s*\$_(?:GET|POST|REQUEST|COOKIE)\b/g,
+];
+
+function taintedNames(code) {
+  const names = new Set();
+  for (const re of TAINT_SOURCES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      for (const part of m[1].split(',')) {
+        // { id }  and  { id: userId }  and  { id = 1 }  all bind the LAST name
+        const n = part.split(':').pop().split('=')[0].trim().replace(/^\.\.\./, '');
+        if (/^[A-Za-z_$][\w$]*$/.test(n)) names.add(n);
+      }
+    }
+  }
+  // Names so generic that binding one would taint half the file's arithmetic.
+  for (const junk of ['data', 'body', 'params', 'query', 'req', 'request', 'options', 'props']) names.delete(junk);
+  return names;
+}
+
+const usesTainted = (expr, names) => {
+  if (!names.size) return false;
+  for (const m of expr.matchAll(/[A-Za-z_$][\w$]*/g)) if (names.has(m[0])) return true;
+  return false;
+};
+
+// Wrapped in a numeric coercion it cannot carry a quote, a comment marker or a
+// semicolon. Flagging it would be flagging arithmetic.
+const COERCED = /^\s*(Number|parseInt|parseFloat|int|float|Integer\.parseInt|to_i|intval)\s*\(|^\s*\+\s*[A-Za-z_$]/;
+
+// Tagged templates that parameterise. These look EXACTLY like the dangerous
+// form and are the reason a naive version of this check would be unusable:
+// prisma.$queryRaw`...${id}...` is safe, prisma.$queryRawUnsafe(`...${id}...`)
+// is not, and the difference is six characters.
+const SAFE_TAG = /(^|[^\w$])(sql|SQL|sqlx?|prisma\.\$queryRaw|prisma\.\$executeRaw|\$queryRaw|\$executeRaw|db\.sql|tx\.sql|conn\.sql|knex\.raw|Prisma\.sql|drizzle|postgres|neon|planetscale)$/;
+
+// Where a template literal ends, honouring escapes and nested ${ } which may
+// themselves contain template literals.
+function endOfTemplate(t, start) {
+  let i = start + 1;
+  while (i < t.length) {
+    const c = t[i];
+    if (c === '\\') { i += 2; continue; }
+    if (c === '`') return i;
+    if (c === '$' && t[i + 1] === '{') {
+      let depth = 1; i += 2;
+      while (i < t.length && depth > 0) {
+        if (t[i] === '\\') { i += 2; continue; }
+        if (t[i] === '`') { const e = endOfTemplate(t, i); i = e === -1 ? t.length : e + 1; continue; }
+        if (t[i] === '{') depth++;
+        else if (t[i] === '}') depth--;
+        i++;
+      }
+      continue;
+    }
+    i++;
+  }
+  return -1;
+}
+
+// The ${ ... } expressions inside one template literal, as text.
+function holes(tpl) {
+  const out = [];
+  for (let i = 0; i < tpl.length; i++) {
+    if (tpl[i] === '\\') { i++; continue; }
+    if (tpl[i] === '$' && tpl[i + 1] === '{') {
+      let depth = 1, j = i + 2; const from = j;
+      while (j < tpl.length && depth > 0) {
+        if (tpl[j] === '\\') { j += 2; continue; }
+        if (tpl[j] === '{') depth++;
+        else if (tpl[j] === '}') depth--;
+        if (depth > 0) j++;
+      }
+      out.push(tpl.slice(from, j));
+      i = j;
+    }
+  }
+  return out;
+}
+
+const JS  = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+const PY  = /\.py$/;
+const PHP = /\.php$/;
+const RB  = /\.rb$/;
+
+function scanJs(path, code, out) {
+  const routeFile = IS_ROUTE_FILE(path, code);
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h)
+    || (routeFile && BARE_PARAMS.test(h))
+    || usesTainted(h, tainted);
+  for (let i = 0; i < code.length; i++) {
+    if (code[i] !== '`') continue;
+    const end = endOfTemplate(code, i);
+    if (end === -1) break;
+    const tpl = code.slice(i + 1, end);
+    const before = code.slice(Math.max(0, i - 60), i).trimEnd();
+    i = end;
+
+    if (!IS_SQL.test(tpl)) continue;
+    if (SAFE_TAG.test(before)) continue;               // parameterised by the tag
+
+    const bad = holes(tpl).filter(h => isInput(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, i - tpl.length), expr: bad[0].trim(), how: 'a template literal' });
+  }
+
+  // "select ... where id = " + req.params.id
+  const CONCAT = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*\+\s*([^;\n]{1,120})/g;
+  let m;
+  while ((m = CONCAT.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    const rhs = m[3];
+    if (!isInput(rhs) || COERCED.test(rhs)) continue;
+    out.push({ line: lineOf(code, m.index), expr: rhs.trim().slice(0, 60), how: 'string concatenation' });
+  }
+}
+
+function scanPy(path, code, out) {
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h) || usesTainted(h, tainted);
+  // f"... {req.args['id']} ..."  -- the f prefix is what makes it interpolate
+  const FSTR = /\bf(["'])((?:(?!\1)[^\\]|\\.)*)\1|\bf("""|''')([\s\S]*?)\3/g;
+  let m;
+  while ((m = FSTR.exec(code))) {
+    const body = m[2] ?? m[4] ?? '';
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/\{([^{}]+)\}/g)].map(x => x[1])
+      .filter(h => isInput(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, m.index), expr: bad[0].trim(), how: 'an f-string' });
+  }
+
+  // "... %s ..." % x  and  "...".format(x)
+  //
+  // The % HAS to be applied to the string. cursor.execute("... %s", (x,)) is
+  // the correct parameterised call and looks almost the same - the difference
+  // is a comma instead of a percent sign, and it is the whole difference.
+  const APPLIED = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*(?:%\s*|\.format\s*\()([^\n;]{1,120})/g;
+  while ((m = APPLIED.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    if (!isInput(m[3]) || COERCED.test(m[3])) continue;
+    out.push({ line: lineOf(code, m.index), expr: m[3].trim().slice(0, 60), how: 'string formatting' });
+  }
+}
+
+function scanPhp(path, code, out) {
+  const tainted = taintedNames(code);
+  const isInput = (h) => FROM_REQUEST.test(h) || usesTainted(h, tainted);
+  const STR = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = STR.exec(code))) {
+    const body = m[1];
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/\{?\$([A-Za-z_]\w*(?:\[[^\]]+\])?(?:->\w+)?)\}?/g)].map(x => '$' + x[1])
+      .filter(h => isInput(h));
+    if (bad.length) { out.push({ line: lineOf(code, m.index), expr: bad[0], how: 'string interpolation' }); continue; }
+  }
+  const DOT = /(["'])((?:(?!\1)[^\\]|\\.)*)\1\s*\.\s*([^;\n]{1,120})/g;
+  while ((m = DOT.exec(code))) {
+    if (!IS_SQL.test(m[2])) continue;
+    if (!isInput(m[3])) continue;
+    out.push({ line: lineOf(code, m.index), expr: m[3].trim().slice(0, 60), how: 'string concatenation' });
+  }
+}
+
+function scanRb(path, code, out) {
+  const STR = /"((?:[^"\\]|\\.)*)"/g;
+  let m;
+  while ((m = STR.exec(code))) {
+    const body = m[1];
+    if (!IS_SQL.test(body)) continue;
+    const bad = [...body.matchAll(/#\{([^}]+)\}/g)].map(x => x[1])
+      .filter(h => FROM_REQUEST.test(h) && !COERCED.test(h));
+    if (!bad.length) continue;
+    out.push({ line: lineOf(code, m.index), expr: bad[0].trim(), how: 'string interpolation' });
+  }
+}
+
+export const INJECTION_CHECKS = [
+
+{ id: 'DATA-015', run(repo) {
+    const out = [];
+    for (const f of repo.files) {
+      if (!f.text) continue;
+      const isJs = JS.test(f.path), isPy = PY.test(f.path),
+            isPhp = PHP.test(f.path), isRb = RB.test(f.path);
+      if (!isJs && !isPy && !isPhp && !isRb) continue;
+      // A migration writes its own SQL and takes no request input; a seed file
+      // is the same. Both are full of raw SQL and neither is reachable.
+      if (/(^|\/)(migrations?|seeds?|db\/migrate)\//.test(f.path)) continue;
+
+      const code = codeOnly(f.text);
+      const hits = [];
+      if (isJs)  scanJs(f.path, code, hits);
+      if (isPy)  scanPy(f.path, code, hits);
+      if (isPhp) scanPhp(f.path, code, hits);
+      if (isRb)  scanRb(f.path, code, hits);
+
+      // One finding per file. Somebody who builds queries this way builds them
+      // this way in twenty places, and twenty identical CRITICALs is not twenty
+      // times the information - it is one piece of information, shouted.
+      if (!hits.length) continue;
+      const h = hits[0];
+      const more = hits.length > 1 ? ` The same pattern appears ${hits.length} times in this file.` : '';
+      out.push(finding('DATA-015',
+        'Anyone can read or delete your whole database by typing into a form', 'critical',
+        f.path, h.line,
+        `A value that came straight from the visitor is pasted into a database query through ${h.how} — here it is \`${h.expr}\`. Whatever they type is not treated as data, it is treated as part of the instruction. Typing the right thing into that field reads every table, changes any row, or deletes the lot, and nothing in the code stops it.${more}`,
+        'Never build the query by joining strings. Leave a placeholder where the value goes and pass the value alongside it — `db.query("select * from users where id = $1", [id])` — so the database treats it as data no matter what it contains.'));
+    }
+    return out;
+  }},
+
+];