launchprep 0.3.0 → 0.5.0

package/README.md

@@ -69,6 +69,27 @@ the report link keeps working, and that link expires.
 
 If there is no terminal — CI, a script — it refuses rather than assuming yes.
 
+## Telling it about your app
+
+Some things are not in the code — where your users live, whether your AI is
+allowed to act, how many people you expect. Those checks are skipped, and the
+scan lists them. Put the answers in `launchprep.json` at the top of your
+project and run again:
+
+```json
+{
+  "jurisdictions": ["eu"],
+  "has_accounts": true,
+  "llm_tools_enabled": true,
+  "stage": "production"
+}
+```
+
+What you state beats what was detected, and the report shows it back under
+**You said** so a wrong answer is visible rather than silently changing
+results. The free scan is unlimited, so correcting and re-running costs
+nothing.
+
 ## In CI
 
 ```bash

package/net/consent.mjs

@@ -21,6 +21,11 @@ export async function confirmUpload({ digest, host, assumeYes = false, showFiles
   console.log(`\n${C.b}Before this runs${C.off}\n`);
   console.log(`  This sends ${C.b}${files} files${C.off} of your code ${C.d}(about ${tokens} tokens)${C.off}`);
   console.log(`  to ${C.b}${host}${C.off}, and from there to Anthropic, so a model can read them.\n`);
+  if (digest.secretsRedacted > 0) {
+    console.log(`  ${C.g}${digest.secretsRedacted} secret${digest.secretsRedacted === 1 ? '' : 's'} masked before sending${C.off} — keys, passwords, tokens and`);
+    console.log(`  the rows of any database dump are replaced on this machine, so their`);
+    console.log(`  values never leave it. Only that they existed, and where, is sent.\n`);
+  }
   console.log(`  ${C.g}Your code is not stored.${C.off} It is held in memory for the scan and discarded.`);
   console.log(`  ${C.g}The findings are kept${C.off} — file names, line numbers, and what to fix —`);
   console.log(`  so the report link keeps working. That link expires.\n`);

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "launchprep",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
-    "launchprep": "./bin/launchprep.mjs"
+    "launchprep": "bin/launchprep.mjs"
   },
   "files": [
     "src",
@@ -17,7 +17,7 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },

package/src/checks-ai.mjs

@@ -1,12 +1,21 @@
 // AI cost and safety. Barely covered by the corpus, which is exactly why it
 // matters: this is the family nobody else is checking.
+import { looksLikePlaceholder } from './placeholder.mjs';
+
 const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
 
 const lineOf = (text, i) => text.slice(0, i).split('\n').length;
 const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
-const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|lib|services?)\//.test(p);
-const isClient = (p) => /\/(components?|pages?|app|src)\//.test(p) && !isServer(p);
+// (^|/) not just / — a slash was REQUIRED before the word, so a project laid
+// out as api/src/... or server/src/... or backend/src/... never matched as a
+// server, and then matched as a browser because it contains /src/. Result: the
+// scanner told people running a plain Node backend that their API key was
+// "shipped to every visitor". It fired twice on this repository's own api/.
+// A fabricated CRITICAL is the failure this whole product is built to avoid.
+// 'backend' and 'worker' added because they are as common as 'server'.
+const isServer = (p) => /(^|\/)(api|routes?|server|backend|actions?|controllers?|handlers?|endpoints?|resolvers?|lib|services?|workers?|jobs?)\//.test(p);
+const isClient = (p) => /(^|\/)(components?|pages?|app|src|client|frontend|ui|views?)\//.test(p) && !isServer(p);
 
 const LLM_CALL = /\.(messages|chat\.completions|completions|responses)\.create\s*\(|generateText\s*\(|streamText\s*\(|\.generateContent\s*\(/;
 
@@ -148,12 +157,24 @@ export const AI_CHECKS = [
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path)) continue;
-      const re = /\b(eval|exec|execSync|spawnSync|Function)\s*\(|\.query\s*\(\s*`/g;
+      // `exec` as a bare word is two different things. `child_process.exec(cmd)`
+      // runs a program; `re.exec(text)` is how JavaScript matches a regular
+      // expression, and appears in ordinary code constantly - three times in
+      // this scanner's own source, which is how it reported three CRITICALs
+      // about itself. So `.exec(` preceded by a dot only counts when the thing
+      // before the dot is actually child_process.
+      const re = /(?<![.\w])(eval|execSync|execFileSync|spawnSync|Function)\s*\(|(?<![.\w])exec\s*\(|\b(?:child_process|cp|shell)\.exec(?:File)?\s*\(|\.query\s*\(\s*`/g;
       let m;
       while ((m = re.exec(f.text))) {
         const around = f.text.slice(Math.max(0, m.index - 600), m.index + 200);
         if (!LLM_CALL.test(around) &&
             !/\b(completion|aiResponse|modelOutput|generated|llmResult)\b/i.test(around)) continue;
+        // "generated" and "completion" are ordinary English words. Requiring
+        // the neighbourhood to ALSO look like a model call stops a comment
+        // containing "generated" from turning a regex into a CRITICAL.
+        const ls = f.text.lastIndexOf('\n', m.index) + 1;
+        let le = f.text.indexOf('\n', m.index); if (le < 0) le = f.text.length;
+        if (looksLikePlaceholder(m[0], f.text.slice(ls, le), f.path)) continue;
         out.push(finding('AI-008', 'Model output used in a privileged operation', 'critical',
           f.path, lineOf(f.text, m.index),
           'What the model returns is being executed or used to build a query. Anyone who can steer the model can steer this.',
@@ -187,6 +208,12 @@ export const AI_CHECKS = [
 // ---- provider key used straight from the browser -------------------------
 { id: 'SEC-006', run(repo, profile) {
     if (!profile.calls_llm) return [];
+    // An app with no browser cannot ship a key to one. profile -> gate -> check
+    // is the whole idea of this scanner, and this check skipped the profile
+    // step: on an api-only, CLI or library project every src/ file looked like
+    // browser code, so a plain Node script was told its key is "shipped to
+    // every visitor" when it has no visitors.
+    if (['api-only', 'cli', 'library', 'mobile-ios', 'mobile-android'].includes(profile.surface)) return [];
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path) || !isClient(f.path)) continue;

package/src/checks-deploy.mjs

@@ -1,4 +1,6 @@
 // Deployment and transport. Mechanically detectable, high volume.
+import { looksLikePlaceholder } from './placeholder.mjs';
+
 const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
 const lineOf = (t, i) => t.slice(0, i).split('\n').length;
@@ -33,6 +35,12 @@ export const DEPLOY_CHECKS = [
       f.text.split('\n').forEach((line, i) => {
         if (/\$\{\{\s*secrets\./.test(line)) return;           // the correct pattern
         const m = line.match(SECRET_VALUE);
+        // Every project that tests against a database puts a throwaway one in
+        // CI - postgres:postgres@localhost/..._test. That is not a credential,
+        // and flagging it as a CRITICAL on nearly every real repository is how
+        // a scanner loses the right to be believed. This repo's own CI was
+        // flagged by this check.
+        if (m && looksLikePlaceholder(m[0], line, f.path)) return;
         if (m) out.push(finding('DEP-002', 'Credential written into the CI config', 'critical',
           f.path, i + 1,
           'This value is committed to the repository and printed in build logs. Anyone with read access to either has it.',

package/src/checks.mjs

@@ -9,6 +9,8 @@ import { FRAMEWORK_CHECKS } from './checks-frameworks.mjs';
 import { BATCH2_CHECKS } from './checks-batch2.mjs';
 import { BATCH3_CHECKS } from './checks-batch3.mjs';
 import { BATCH4_CHECKS } from './checks-batch4.mjs';
+import { scanGitHistory } from './git-history.mjs';
+import { looksLikePlaceholder } from './placeholder.mjs';
 
 const finding = (id, title, severity, file, line, detail, fix) =>
   ({ id, title, severity, file, line, detail, fix });
@@ -17,6 +19,32 @@ const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 const BASE_CHECKS = [
 
+// SEC-009 — a key that was committed, then "removed". SEC-001/003 read the
+// working tree, so deleting the line hides it from them while it stays in
+// .git forever and travels with every clone. scope:'root' because history is
+// a property of the repository, not of a workspace.
+//
+// Only vendor-prefixed keys are looked for. See the long note in
+// git-history.mjs: a test private key and a real one are byte-identical, so
+// including those types fired on 15 of 68 real repositories and every hit was
+// a fixture. Narrowed to unmistakable prefixes it fires on 0 of 20.
+{ id:'SEC-009', scope:'root', run(repo){
+    const res = scanGitHistory(repo.root);
+    if (!res.findings.length) return [];
+    const kinds = [...new Set(res.findings.map(f => f.label))];
+    const what = kinds.length === 1 ? kinds[0]
+      : `${kinds.slice(0, -1).join(', ')} and ${kinds[kinds.length - 1]}`;
+    const n = res.findings.length;
+    return [finding('SEC-009',
+      `${n === 1 ? 'A key was' : `${n} keys were`} committed and is still in your git history`,
+      'critical', '.git', 1,
+      `Your ${what} appears in an old commit. Removing it from the file did not remove it — ` +
+      'every clone, fork and fetch of this repository still carries it, and anyone who has ever ' +
+      'had a copy can read it. Treat it as public.',
+      'Rotate the key at the provider now — that is what actually stops it being used. ' +
+      'Rewriting history afterwards is optional and does not help anyone who already cloned.')];
+  }},
+
 { id:'SEC-002', run(repo){
     const gi = repo.read('.gitignore');
     if (gi === null) return [];
@@ -85,6 +113,14 @@ const BASE_CHECKS = [
       for (const [re,label] of PATTERNS){
         let m; re.lastIndex=0;
         while ((m=re.exec(f.text))){
+          // The shape of a key is not a key. AWS publishes AKIAIOSFODNN7EXAMPLE
+          // in its own docs; a regex that LOOKS FOR keys contains one by
+          // definition; a test fixture is meant to. Scanning this repository
+          // produced four CRITICALs and every one was the scanner reading its
+          // own detection patterns back to itself.
+          const ls = f.text.lastIndexOf('\n', m.index) + 1;
+          let le = f.text.indexOf('\n', m.index); if (le < 0) le = f.text.length;
+          if (looksLikePlaceholder(m[0], f.text.slice(ls, le), f.path)) continue;
           out.push(finding('SEC-003',`Hardcoded ${label}`,'critical',
             f.path, lineOf(f.text,m.index),
             `A live ${label} is written directly into this file.`,

package/src/digest.mjs

@@ -1,3 +1,5 @@
+import { redact } from './redact.mjs';
+
 // Build the block of code the model reads.
 //
 // This is the single most expensive decision in the product. Every token here
@@ -128,9 +130,15 @@ export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
   const omitted = [];
   const spentByKind = {};
   let tokens = 0;
+  let secretsRedacted = 0;
 
   const take = (f, respectShare) => {
-    let body = f.text;
+    // Scrub secret values on this machine, before the file can enter the
+    // payload. A masked secret never leaves the user's disk. Done here rather
+    // than at read time so the free scan — which reads the same files but sends
+    // nothing — pays nothing for it.
+    const scrubbed = redact(f.text, f.path);
+    let body = scrubbed.text;
     let truncated = false;
     if (body.length > MAX_FILE_CHARS) { body = body.slice(0, MAX_FILE_CHARS); truncated = true; }
     const block = `\n──── ${f.path}${truncated ? '  [truncated]' : ''}\n${body}\n`;
@@ -144,6 +152,7 @@ export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
     included.push({ path: f.path, kind: f.kind, tokens: cost });
     spentByKind[f.kind] = (spentByKind[f.kind] || 0) + cost;
     tokens += cost;
+    secretsRedacted += scrubbed.count;
     return true;
   };
 
@@ -157,6 +166,9 @@ export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
     tokens,
     included,
     omitted,
+    // How many secret values were masked before anything left the machine.
+    // Surfaced on the consent screen so the promise is visible, not just made.
+    secretsRedacted,
     // what the model must be told it cannot see, or it will reason as though
     // the absence of an ownership check is proof there isn't one
     coverage: {

package/src/git-history.mjs

@@ -0,0 +1,255 @@
+// Read git's object store to find secrets that were committed and later
+// "removed".
+//
+// SEC-001 and SEC-003 read the working tree. That misses the mistake people
+// actually make: commit a key, notice, delete the line, commit again, and
+// believe it is gone. It is not. Every old version of every file is still in
+// .git, and it travels with every clone, every fork and every fetch. The
+// scanner's own finding text already said "deleting it later does not remove it
+// from git history" — and then did not look there.
+//
+// Read-only, and directly: verify-readonly.mjs forbids shelling out, so there
+// is no `git log` here. Loose objects are zlib streams on disk; packed objects
+// live in a packfile with its own index. Both are just reads.
+//
+// This is deliberately NOT a full git implementation. It reads blobs — the file
+// contents — and never needs to walk commits, resolve trees or understand
+// branches, because the question is only "does any version of anything in this
+// repository contain a secret", and every version of everything is a blob.
+import { readdirSync, readFileSync, existsSync, statSync } from 'node:fs';
+import { inflateSync, inflateRawSync } from 'node:zlib';
+import { join } from 'node:path';
+
+// ONLY credentials whose format means one thing and cannot mean another.
+//
+// This list was cut down after measuring, and the cut is the whole reason this
+// check is shippable. The first version looked for private keys, database URLs
+// and AWS/Google/Slack keys too, and fired on 15 of 68 real repositories — every
+// single hit a test fixture, a docker-compose service, or documentation. Five
+// rounds of filters got that to 22% and no further, because of one fact that no
+// amount of pattern-matching can get around:
+//
+//   A test private key and a production private key are BYTE-IDENTICAL. So are
+//   a docker-compose password and a real one. Only intent separates them, and
+//   intent is not in the value.
+//
+// A vendor-prefixed key is different: `sk_live_` is issued by Stripe and means
+// a live secret key, always. Nobody's test fixture has a real one. Narrowed to
+// these, the check fires on 2 of 21 repositories — and one of those two is
+// GitLab's own repository, which contains GitLab test tokens.
+//
+// The dropped types are not a gap we are hiding: SEC-001 and SEC-003 still find
+// all of them in the working tree. What is given up is only finding THOSE kinds
+// in deleted history, which is the exact case where they cannot be judged.
+const SECRETS = [
+  [/\bsk_live_[A-Za-z0-9]{20,}/g,            'Stripe live secret key'],
+  [/\brk_live_[A-Za-z0-9]{20,}/g,            'Stripe restricted live key'],
+  [/\bwhsec_[A-Za-z0-9]{24,}/g,              'Stripe webhook signing secret'],
+  [/\bsk-ant-[A-Za-z0-9_-]{24,}/g,           'Anthropic API key'],
+  [/\bsk-proj-[A-Za-z0-9_-]{24,}/g,          'OpenAI project key'],
+  [/\bghp_[A-Za-z0-9]{36,}/g,                'GitHub personal access token'],
+  [/\bgho_[A-Za-z0-9]{36,}/g,                'GitHub OAuth token'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g,            'GitLab personal access token'],
+  [/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g, 'SendGrid API key'],
+];
+
+// The first audit of this check fired on 7 of 8 major repositories and every
+// single hit was documentation, a test fixture or a secretlint allowlist — the
+// exact "matched a shape instead of judging the context" failure this codebase
+// has already made seven times. Three filters, in order of how much they caught:
+//
+//  1. The VALUE itself is a sample. `sk_live_abcdefghijk...` and
+//     `redis://username:password@host:port/db` are not credentials, they are
+//     the shape of one written down. A real secret is high-entropy; a fake one
+//     spells words, runs the alphabet, or literally says "password".
+//  2. The surrounding LINE is prose or a fixture — a docs code fence, an
+//     `expect(...)`, an allowlist entry.
+//  3. The blob is a documentation or test FILE.
+const FAKE_VALUE = [
+  // No \b: a fixture key spells the word INSIDE the token, e.g.
+  // sk_live_51H8xExAmPlEkEyAbCdEf123. Word boundaries never match there, and
+  // that gap let this check fire on its own repository's test file.
+  /(example|sample|dummy|placeholder|fake|changeme|redacted|notreal|donotuse)/i,
+  /\b(your[_-]?key|my[_-]?secret|xxx+)\b/i,
+  /abcdefghij|0123456789|qwerty|lorem/i,
+  // A substitution of ANY form means the real value is not here: ${VAR},
+  // {{var}}, [password], <password>, %s, $VAR. Every remaining false positive
+  // in the first two audits was one of these.
+  /[$%]\{|\{\{|\[[a-z][a-z0-9_.-]*\]|<[a-z][a-z0-9_.-]*>|\$[A-Z_][A-Z0-9_]*/i,
+  // credentials that are the words for credentials
+  /:\/\/(?:user|username|admin|root|foo|bar|test|me|you)[^:@/]*:(?:pass|password|passwd|secret|hunter2|foo|bar|test)/i,
+  // A password containing "test", "demo", "local" or "dev" is a fixture. The
+  // corpus is full of mostest_password, knextest, devpassword.
+  /:\/\/[^:@/]+:[^@/]*(?:test|demo|local|dev|dummy|ci)[^@/]*@/i,
+  // A password that merely repeats the username or the service is a default,
+  // not a secret: postgres:postgres@, mysql:mysql@, redis:redis@.
+  /:\/\/([a-z0-9_-]+):\1@/i,
+  // The host is an internal service name from a docker-compose or CI network —
+  // a single label with no dot, e.g. @postgres:5432, @db, @mysql. A production
+  // database is reached at a real hostname.
+  /@(?:postgres|postgresql|mysql|mariadb|mongo|mongodb|redis|db|database|cache|queue)(?:[-_][a-z0-9-]+)?(?::\d+)?(?:[/?]|$)/i,
+  // a placeholder host is a placeholder URL
+  /@(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host|hostname|example\.(?:com|org|net)|your[^\s/]*)(?:[:/]|$)/i,
+  // no dot in the host at all: not a routable production endpoint
+  /:\/\/[^@/]+@[a-z0-9_-]+(?::\d+)?(?:[/?]|$)/i,
+  // AWS's own documentation key
+  /^AKIAIOSFODNN7EXAMPLE$/,
+];
+// Entropy: a real key is random. `sk_live_abcdef...` is not. Measured over the
+// secret's payload, after the recognisable prefix.
+function looksRandom(value) {
+  const body = value.replace(/^(sk_live_|rk_live_|whsec_|sk-ant-|sk-proj-|AKIA|AIza|gh[pousr]_|glpat-|xox[baprs]-|SG\.)/, '');
+  if (body.length < 12) return true;                 // too short to judge; keep it
+  const set = new Set(body.replace(/[^A-Za-z0-9]/g, ''));
+  if (set.size < 8) return false;                    // e.g. all a-f, or one repeated run
+  // sequential alphabet or digits is the signature of a hand-typed placeholder
+  let runs = 0;
+  for (let i = 1; i < body.length; i++) if (body.charCodeAt(i) === body.charCodeAt(i - 1) + 1) runs++;
+  return runs < body.length * 0.3;
+}
+// The line the secret sits on. Docs, assertions and allowlists are not leaks.
+const FAKE_LINE = /(^\s*[#*]|^\s*\/\/|\.\. |::$|`{1,3}|expect\(|assert|describe\(|it\(|test\(|allows?"?\s*:|allowlist|secretlint|gitleaks|trufflehog|\.md:|<\/?[a-z]+>)/i;
+
+// What the secret was ASSIGNED TO, looking back from the match. A real key and
+// a test key are byte-identical — the only difference is intent, and intent is
+// written in the name above it. `EXAMPLE_PRIVATE_KEY = """`, `KEY1 = """` under
+// a "Keys and certificates for tests" docstring, `TEST_CERT`, `FIXTURE_KEY`.
+// This was the last class of false positive left in the corpus audit.
+const FAKE_DECLARATION = /\b(example|sample|test|tests|testing|fixture|mock|stub|dummy|fake|demo|placeholder|invalid|expired|revoked|specimen)[a-z0-9_]*\s*[:=]\s*(?:"""|'''|["'`]|$)/i;
+// The blob is documentation or a fixture. Detected from the content, since a
+// blob does not carry its path.
+//
+// The strongest signal is that the blob IS a test file. A test asserting that
+// secret-handling works necessarily contains secret-shaped strings — this
+// scanner's own test/redact.mjs does, and that is what made SEC-009 fire on
+// Launchprep's own repository the first time it ran. A key inside a test file
+// is a fixture; a real one would never be committed there deliberately.
+const FAKE_BLOB = /(^|\n)(#{1,3} |\.\. _|={3,}$|-{3,}$)|describe\(|it\(['"`]|def test_|class Test|@pytest|\bfixtures?\b/i;
+const IS_TEST_FILE = /(^|\n)\s*(?:import|from|const|let|require)[^\n]*\b(?:assert|chai|jest|mocha|vitest|pytest|unittest|testing)\b|(^|\n)\s*(?:describe|it|test)\s*\(|(^|\n)\s*(?:def test_|class Test)|\bok\(['"`]|expect\(/;
+
+// A blob big enough to be a build artefact or a vendored bundle is not where a
+// human pasted a key, and inflating hundreds of them is the whole cost here.
+const MAX_BLOB = 400_000;
+// A ceiling on total work so an enormous repository cannot make a scan hang.
+// Reached only on repositories with very deep history; reported honestly when
+// it happens rather than silently truncating.
+const MAX_OBJECTS = 20_000;
+
+function looseObjects(objDir, budget) {
+  const out = [];
+  let buckets;
+  try { buckets = readdirSync(objDir); } catch { return out; }
+  for (const b of buckets) {
+    if (!/^[0-9a-f]{2}$/.test(b)) continue;
+    let files;
+    try { files = readdirSync(join(objDir, b)); } catch { continue; }
+    for (const f of files) {
+      if (out.length >= budget) return out;
+      out.push({ id: b + f, path: join(objDir, b, f) });
+    }
+  }
+  return out;
+}
+
+// A packfile stores objects as a stream of zlib chunks with no per-object
+// offsets available without parsing .idx. Rather than implement idx parsing and
+// delta reconstruction — a large amount of code for a small gain — the packfile
+// is scanned for the zlib streams it contains and each is inflated where it
+// can be. Objects stored as deltas against another object are skipped: they are
+// modifications of a base, and a secret introduced in one shows up in the full
+// copy of some version anyway. Reported in `partial` so a clean result on a
+// packed repository never silently claims more than it checked.
+function packedBlobs(packDir, budget, onBlob) {
+  let files;
+  try { files = readdirSync(packDir); } catch { return { scanned: 0, partial: false }; }
+  let scanned = 0, partial = false;
+  for (const f of files.filter(x => x.endsWith('.pack'))) {
+    let buf;
+    try { buf = readFileSync(join(packDir, f)); } catch { continue; }
+    // header: 'PACK', version, count
+    if (buf.length < 12 || buf.toString('latin1', 0, 4) !== 'PACK') continue;
+    // Walk looking for zlib stream starts (0x78 followed by a valid check byte).
+    // Inflating from a wrong offset simply throws and is skipped, so a false
+    // start costs nothing but a try/catch.
+    for (let i = 12; i < buf.length - 2; i++) {
+      if (scanned >= budget) { partial = true; return { scanned, partial }; }
+      if (buf[i] !== 0x78) continue;
+      const b1 = buf[i + 1];
+      if (((buf[i] << 8) | b1) % 31 !== 0) continue;
+      try {
+        const inflated = inflateSync(buf.subarray(i), { finishFlush: 2 /* Z_SYNC_FLUSH */ });
+        if (inflated.length && inflated.length <= MAX_BLOB) {
+          scanned++;
+          onBlob(inflated.toString('utf8'), `${f}@${i}`);
+        }
+      } catch { /* not a stream start, or a delta we do not reconstruct */ }
+    }
+  }
+  return { scanned, partial };
+}
+
+// Returns { findings, objectsScanned, partial, reason }.
+// `reason` is set when history could not be read at all, so the caller can say
+// so rather than implying a clean history.
+export function scanGitHistory(root) {
+  const gitDir = join(root, '.git');
+  if (!existsSync(gitDir)) return { findings: [], objectsScanned: 0, partial: false, reason: 'no-git' };
+  // A worktree or submodule has .git as a FILE pointing elsewhere. Not followed:
+  // the pointer can lead outside the directory the user asked us to scan, and
+  // reading outside it is not ours to do.
+  try { if (!statSync(gitDir).isDirectory()) return { findings: [], objectsScanned: 0, partial: false, reason: 'git-is-a-file' }; }
+  catch { return { findings: [], objectsScanned: 0, partial: false, reason: 'no-git' }; }
+
+  const seen = new Set();
+  const findings = [];
+  let objectsScanned = 0;
+
+  const inspect = (text, where) => {
+    if (!text || text.length > MAX_BLOB) return;
+    // A documentation page or a test file can contain any number of
+    // key-shaped strings and none of them are leaks.
+    const docish = FAKE_BLOB.test(text.slice(0, 2000)) || IS_TEST_FILE.test(text.slice(0, 4000));
+    for (const [re, label] of SECRETS) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(text))) {
+        const value = m[0];
+        if (FAKE_VALUE.some(f => f.test(value))) continue;
+        if (!looksRandom(value)) continue;
+        // the line it sits on decides as much as the value does
+        const ls = text.lastIndexOf('\n', m.index) + 1;
+        let le = text.indexOf('\n', m.index); if (le < 0) le = text.length;
+        const line = text.slice(ls, le);
+        if (FAKE_LINE.test(line)) continue;
+        // Look back a few hundred characters for the declaration this value was
+        // assigned to, and for a test/fixture docstring above it.
+        const before = text.slice(Math.max(0, m.index - 300), m.index);
+        if (FAKE_DECLARATION.test(before)) continue;
+        if (/\b(for tests?|test (?:keys?|certs?|fixtures?|data)|do not use|not a real)\b/i.test(before)) continue;
+        if (docish) continue;
+        // One finding per distinct secret, however many old commits carry it.
+        const key = label + ':' + value.slice(0, 24);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        findings.push({ label, where, hint: value.slice(0, 7) + '…' });
+      }
+    }
+  };
+
+  const objDir = join(gitDir, 'objects');
+  for (const o of looseObjects(objDir, MAX_OBJECTS)) {
+    try {
+      const raw = inflateSync(readFileSync(o.path));
+      const nul = raw.indexOf(0);
+      if (nul < 0) continue;
+      if (!raw.subarray(0, nul).toString('latin1').startsWith('blob')) continue;
+      objectsScanned++;
+      inspect(raw.subarray(nul + 1).toString('utf8'), o.id.slice(0, 8));
+    } catch { /* unreadable object; skipped */ }
+  }
+
+  const packed = packedBlobs(join(objDir, 'pack'), MAX_OBJECTS - objectsScanned, inspect);
+  objectsScanned += packed.scanned;
+
+  return { findings, objectsScanned, partial: packed.partial, reason: null };
+}

package/src/index.mjs

@@ -3,7 +3,7 @@ import { scanRepo } from './fs-scan.mjs';
 import { splitWorkspaces } from './workspace.mjs';
 import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
-import { runChecks, runRootChecks } from './checks.mjs';
+import { runChecks, runRootChecks, CHECKS } from './checks.mjs';
 import { render } from './report.mjs';
 import { existsSync, statSync } from 'node:fs';
 
@@ -41,11 +41,48 @@ if (!existsSync(target) || !statSync(target).isDirectory()) {
 const repo = scanRepo(target, { maxFiles: 12000 });
 const packages = splitWorkspaces(repo);
 
+// What the user told us about their own app, which beats what we guessed.
+//
+// The scanner works most things out from the code, but some facts are simply
+// not in the code — where the users live, whether the AI is allowed to act,
+// how many people are expected. Those checks were skipped and the report said
+// "Correct it and the checks adjust", which was false: there was no way to
+// correct anything. This is that way.
+//
+// Reading a file the user wrote is still read-only. Nothing is written.
+const stated = (() => {
+  const raw = repo.read('launchprep.json');
+  if (raw === null) return null;
+  try {
+    const j = JSON.parse(raw);
+    return (j && typeof j === 'object' && !Array.isArray(j)) ? j : null;
+  } catch (e) {
+    // A broken file must be loud. Silently ignoring it would mean the user
+    // answers the questions, sees no change, and concludes the feature is fake.
+    process.stderr.write(`\n  \x1b[31mlaunchprep.json could not be read: ${e.message}\x1b[0m\n`);
+    process.stderr.write(`  \x1b[2mIt must be valid JSON. Nothing from it was used.\x1b[0m\n\n`);
+    return null;
+  }
+})();
+
+// Merge one level deep so { "stack": { "auth": "clerk" } } overrides only auth
+// and leaves the detected framework and database alone.
+const applyStated = (profile) => {
+  if (!stated) return profile;
+  const out = { ...profile };
+  for (const [k, v] of Object.entries(stated)) {
+    if (v && typeof v === 'object' && !Array.isArray(v) && out[k] && typeof out[k] === 'object')
+      out[k] = { ...out[k], ...v };
+    else out[k] = v;
+  }
+  return out;
+};
+
 // Profile and gate every app in the repo. Libraries are profiled too - they
 // simply match very few rules, which is the correct outcome, not a bug.
 const scanned = packages.map(w => {
   const full = detectProfile(w.view, { root: repo });
-  const profile = toGateProfile(full);
+  const profile = applyStated(toGateProfile(full));
   const g = gate(profile);
   const applicableIds = new Set(g.evaluated.map(r => r.id));
   const findings = runChecks(w.view, profile, applicableIds)
@@ -86,17 +123,28 @@ const shallow = lead.gate.evaluated
 
 const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
 
+// "51 checks apply to this app" counted 17 that nothing examined — tier-2 rules
+// that need the deep scan. Counting them as applying is a silent pass on a
+// third of the headline number, which is the one thing this scanner must never
+// do. It also threw away the sentence that sells the paid tier: those 17 are
+// not a gap, they are the product.
+const implemented = new Set(CHECKS.map(c => c.id));
+const coverage = {
+  ran:       lead.gate.evaluated.filter(r => implemented.has(r.id)).length,
+  needsDeep: lead.gate.evaluated.filter(r => !implemented.has(r.id)).length,
+};
+
 if (asJson) {
   console.log(JSON.stringify({
     packages: scanned.map(s => ({
       name: s.name, profile: s.profile,
       evaluated: s.gate.evaluated.length, skipped: s.gate.skipped.length, unknown: s.gate.unknown.length,
     })),
-    findings, questions,
+    findings, questions, coverage, stated,
     shallow: shallow.map(r => ({ id: r.id, title: r.title, severity: r.severity })),
   }, null, 2));
 } else {
-  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
+  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow, coverage, stated }));
 }
 
 // The gate, after the full report has printed: the human still sees