launchprep 0.3.0 → 0.5.0

package/src/placeholder.mjs

@@ -0,0 +1,72 @@
+// Is this value a real credential, or something that only looks like one?
+//
+// This is the seventh-and-eighth instance of the mistake this codebase keeps
+// making: matching a SHAPE and calling it a secret. Scanning its own repository
+// produced five CRITICALs and every one was this —
+//
+//   .github/workflows/ci.yml   postgresql://postgres:postgres@localhost/..._test
+//   cli/src/git-history.mjs    /^AKIAIOSFODNN7EXAMPLE$/     (a detection pattern)
+//   cli/src/checks-*.mjs       the regexes that look for model output
+//
+// None is a credential. The first is the throwaway database every project with
+// CI tests spins up; the second is AWS's own published example; the third is
+// source code that describes a pattern rather than containing a secret.
+//
+// The discipline is the one written at the top of the project guide: read the
+// VALUE, and the line it sits on, not the shape. A leaked key is high-entropy,
+// points at a real host, and is not sitting inside a regex.
+//
+// The redaction pass in redact.mjs learned the same lesson separately. This is
+// the shared version so a fix in one place is a fix in both.
+
+// The value spells out that it is not real.
+const FAKE_WORDS = /(example|sample|dummy|placeholder|fake|changeme|redacted|notreal|donotuse|yourkey|your[_-]key|xxx+|test[_-]?key|foobar)/i;
+
+// Sequences a human types when inventing a key.
+const TYPED_BY_HAND = /abcdefghij|0123456789|qwerty|lorem|(.)\1{7,}/i;
+
+// A substitution means the real value is somewhere else: ${VAR}, {{var}},
+// [password], <password>, $VAR, %s.
+const SUBSTITUTION = /[$%]\{|\{\{|\[[a-z][a-z0-9_.-]*\]|<[a-z][a-z0-9_.-]*>|\$[A-Z_][A-Z0-9_]*/i;
+
+// A connection string that points nowhere real.
+const LOCAL_OR_SERVICE_HOST =
+  /@(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host|hostname|example\.(?:com|org|net)|postgres|postgresql|mysql|mariadb|mongo|mongodb|redis|db|database)(?:[-_][a-z0-9-]+)?(?::\d+)?(?:[/?]|$)/i;
+// user and password are the same word, or are the words for themselves.
+const DEFAULT_CREDENTIALS =
+  /:\/\/([a-z0-9_-]+):\1@|:\/\/(?:user|username|admin|root|foo|bar|test|me)[^:@/]*:(?:pass|password|passwd|secret|hunter2|foo|bar|test)/i;
+// a password that announces it is for testing
+const TEST_CREDENTIALS = /:\/\/[^:@/]+:[^@/]*(?:test|demo|local|dev|dummy|ci|example)[^@/]*@/i;
+
+// AWS publishes these two in its own documentation. They are in a thousand
+// READMEs and are not anyone's key.
+const AWS_DOC_KEYS = /^(AKIAIOSFODNN7EXAMPLE|ASIAIOSFODNN7EXAMPLE)$/;
+
+/**
+ * @param value the matched string
+ * @param line  the whole line it appeared on (optional, but much better with it)
+ * @param path  the file path (optional)
+ */
+export function looksLikePlaceholder(value, line = '', path = '') {
+  const v = String(value);
+
+  if (FAKE_WORDS.test(v) || TYPED_BY_HAND.test(v) || SUBSTITUTION.test(v)) return true;
+  if (AWS_DOC_KEYS.test(v)) return true;
+  if (LOCAL_OR_SERVICE_HOST.test(v) || DEFAULT_CREDENTIALS.test(v) || TEST_CREDENTIALS.test(v)) return true;
+
+  const l = String(line);
+  // The line DEFINES a pattern rather than holding a secret: a regex literal,
+  // a list of shapes to look for. This is what made the scanner flag itself.
+  if (/\/\^|\^.*\$\/|\\b|\\d|\\w|\[A-Za-z0-9|\[0-9A-Z|RegExp\(|\.test\(|\.match\(/.test(l)) return true;
+  // A comment, or documentation showing the format.
+  if (/^\s*(?:[#*]|\/\/|--)/.test(l)) return true;
+  // An assertion or fixture.
+  if (/expect\(|assert|describe\(|it\(['"`]|toBe\(|toEqual\(/.test(l)) return true;
+
+  const p = String(path);
+  // A test file or a fixture directory is not where real credentials live.
+  if (/(^|\/)(test|tests|__tests__|spec|e2e|cypress|fixtures?|mocks?|__mocks__|examples?)\//.test(p)) return true;
+  if (/\.(test|spec)\.[a-z]+$/.test(p)) return true;
+
+  return false;
+}

package/src/questions.mjs

@@ -0,0 +1,206 @@
+// The questions the scanner asks when it cannot tell something from the code,
+// written for the person who reads the report.
+//
+// The scanner can gate on 33 facts. Five of them had wording; the other 28
+// printed their internal name — a customer saw "? llm_tools_enabled" and
+// "? has_webhooks_in" as the last thing on screen. The stated audience is
+// people who cannot read code, and those are not questions, they are variable
+// names a programmer wrote for themselves.
+//
+// Each entry carries:
+//   ask     the question, in words someone non-technical can answer
+//   answer  what to write in launchprep.json, shown so the answer is obvious
+//   why     what it unlocks, so the question does not feel like paperwork
+//
+// The rule for the wording is the same one the findings follow: name the
+// consequence, not the mechanism. "Can people sign in?" not "has_accounts".
+export const QUESTION = {
+  // --- who and where -------------------------------------------------------
+  jurisdictions: {
+    ask: 'Where do your users live?',
+    answer: '"jurisdictions": ["eu"]   — any of: eu, uk, us, ca, ru, kz, other',
+    why: 'decides which privacy laws reach you at all',
+  },
+  business_model: {
+    ask: 'Who is this for — businesses, consumers, or a marketplace?',
+    answer: '"business_model": "b2b-saas"   — b2b-saas, b2c, marketplace, internal',
+    why: 'a marketplace holds other people’s money and has different duties',
+  },
+  expected_scale: {
+    ask: 'Roughly how many users do you expect in the first year?',
+    answer: '"expected_scale": "under-100k"   — under-1k, under-100k, over-100k',
+    why: 'what is safe at 100 users falls over at 100,000',
+  },
+  audience_locale: {
+    ask: 'Do you serve more than one language or region?',
+    answer: '"audience_locale": "multi"   — single, multi',
+    why: 'dates, times and text break first when you cross a border',
+  },
+  serves_currency: {
+    ask: 'Do you charge in more than one currency?',
+    answer: '"serves_currency": "multi"   — single, multi',
+    why: 'rounding and exchange rates are where money quietly goes missing',
+  },
+  data_sensitivity: {
+    ask: 'Do you hold anything especially sensitive — money, health, or data about children?',
+    answer: '"data_sensitivity": "financial"   — normal, financial, health, children',
+    why: 'these carry duties ordinary personal data does not',
+  },
+
+  // --- what the app is -----------------------------------------------------
+  surface: {
+    ask: 'What is it — a website, a web app, an API, or a mobile app?',
+    answer: '"surface": "web-app"   — web-site, web-app, api-only, mobile-ios, mobile-android, cli, library',
+    why: 'a static site cannot have most of these problems, and is not asked about them',
+  },
+  stage: {
+    ask: 'Is this live, about to launch, or still a prototype?',
+    answer: '"stage": "pre-launch"   — prototype, pre-launch, production',
+    why: 'a prototype is not asked about backups; something about to launch is',
+  },
+  is_public: {
+    ask: 'Can anyone on the internet reach it, or is it internal only?',
+    answer: '"is_public": true',
+    why: 'an internal tool has a very different attack surface',
+  },
+  tenancy: {
+    ask: 'Do separate companies or teams share one database?',
+    answer: '"tenancy": "multi-tenant-shared-db"   — single-tenant, multi-tenant-shared-db, multi-tenant-isolated',
+    why: 'this is the setting behind "one customer can read another customer’s data"',
+  },
+
+  // --- accounts and access -------------------------------------------------
+  has_accounts: {
+    ask: 'Can people sign in?',
+    answer: '"has_accounts": true',
+    why: 'unlocks every check about logins, sessions and passwords',
+  },
+  has_roles: {
+    ask: 'Do some users have more power than others — admin, editor, viewer?',
+    answer: '"has_roles": true',
+    why: 'unlocks the checks about someone giving themselves permissions',
+  },
+  has_admin_panel: {
+    ask: 'Is there an admin area only you and your staff can reach?',
+    answer: '"has_admin_panel": true',
+    why: 'an admin page left open is the shortest path to everything',
+  },
+  has_invitations: {
+    ask: 'Can users invite other people to join them?',
+    answer: '"has_invitations": true',
+    why: 'invite links are commonly guessable or never expire',
+  },
+  stack_auth: {
+    ask: 'How do people sign in — your own code, or a service?',
+    answer: '"stack": { "auth": "supabase-auth" }   — custom, supabase-auth, clerk, auth0, nextauth, devise',
+    why: 'hand-written login code is checked far more strictly',
+  },
+
+  // --- money ---------------------------------------------------------------
+  handles_payments: {
+    ask: 'Do you take payments, and through whom?',
+    answer: '"handles_payments": "stripe"   — none, stripe, paddle, lemonsqueezy, other',
+    why: 'unlocks the checks about webhooks, refunds and money stored as decimals',
+  },
+  has_subscriptions: {
+    ask: 'Do people pay you repeatedly — a subscription?',
+    answer: '"has_subscriptions": true',
+    why: 'failed renewals and cancellations are where subscription apps leak money',
+  },
+
+  // --- AI ------------------------------------------------------------------
+  calls_llm: {
+    ask: 'Does your app call an AI model?',
+    answer: '"calls_llm": true',
+    why: 'unlocks the AI checks — runaway costs, prompt injection, model output',
+  },
+  llm_input_from_user: {
+    ask: 'Does anything a user types get sent to the AI?',
+    answer: '"llm_input_from_user": true',
+    why: 'this is the difference between a prompt you wrote and one a stranger did',
+  },
+  llm_tools_enabled: {
+    ask: 'Can the AI do things on its own — send email, call an API, change data?',
+    answer: '"llm_tools_enabled": true',
+    why: 'an AI that can only talk is a very different risk from one that can act',
+  },
+  has_rag: {
+    ask: 'Does the AI read from your own documents or database to answer?',
+    answer: '"has_rag": true',
+    why: 'documents the AI reads can carry instructions that hijack it',
+  },
+
+  // --- how it runs ---------------------------------------------------------
+  sends_email: {
+    ask: 'Does your app send email to users?',
+    answer: '"sends_email": true',
+    why: 'unlocks deliverability, unsubscribe duties and password-reset checks',
+  },
+  has_file_uploads: {
+    ask: 'Can users upload files or images?',
+    answer: '"has_file_uploads": true',
+    why: 'uploads are how a stranger gets a file onto your server',
+  },
+  has_background_jobs: {
+    ask: 'Does work happen in the background — queues, scheduled tasks?',
+    answer: '"has_background_jobs": true',
+    why: 'a job that fails silently is a job nobody knows failed',
+  },
+  has_realtime: {
+    ask: 'Is there anything live — chat, notifications, a shared cursor?',
+    answer: '"has_realtime": true',
+    why: 'live connections are authorised differently from ordinary pages',
+  },
+  has_webhooks_in: {
+    ask: 'Do other services send data INTO your app automatically?',
+    answer: '"has_webhooks_in": true',
+    why: 'an unverified webhook is an open door anyone can post through',
+  },
+  collects_analytics: {
+    ask: 'Do you track how people use the app?',
+    answer: '"collects_analytics": true',
+    why: 'tracking without consent is the most common privacy fine',
+  },
+
+  // --- the plumbing --------------------------------------------------------
+  stack_database: {
+    ask: 'What stores your data?',
+    answer: '"stack": { "database": "postgres" }   — postgres, supabase, mysql, planetscale, mongodb, sqlite, none',
+    why: 'each has its own way of leaking one customer’s rows to another',
+  },
+  stack_framework: {
+    ask: 'What is it built with?',
+    answer: '"stack": { "framework": "next" }   — next, react, vue, django, rails, express, laravel, other',
+    why: 'unlocks the checks specific to that framework’s own footguns',
+  },
+  stack_host: {
+    ask: 'Where does it run?',
+    answer: '"stack": { "host": "vercel" }   — vercel, netlify, cloudflare, railway, fly, aws, gcp, vps, other',
+    why: 'a serverless host and a rented server fail in opposite ways',
+  },
+  stack_orm: {
+    ask: 'How does your code talk to the database — a library, or hand-written SQL?',
+    answer: '"stack": { "orm": "prisma" }   — prisma, drizzle, typeorm, sequelize, activerecord, raw-sql, none',
+    why: 'hand-written SQL is checked much harder for injection',
+  },
+  has_migrations: {
+    ask: 'Do you have database migrations — versioned schema changes?',
+    answer: '"has_migrations": true',
+    why: 'a migration that cannot be undone is a deploy that cannot be undone',
+  },
+  has_ci: {
+    ask: 'Does anything run your tests automatically when you push?',
+    answer: '"has_ci": true',
+    why: 'unlocks the checks about what your pipeline does and does not catch',
+  },
+};
+
+// gate.mjs uses dotted names (stack.auth); JSON and this file use underscores
+// for the top level. One map, so neither side has to know about the other.
+const DOTTED = { stack_auth: 'stack.auth', stack_database: 'stack.database',
+                 stack_framework: 'stack.framework', stack_host: 'stack.host',
+                 stack_orm: 'stack.orm' };
+const UNDERSCORED = Object.fromEntries(Object.entries(DOTTED).map(([k, v]) => [v, k]));
+
+export const questionFor = (fact) => QUESTION[UNDERSCORED[fact] || fact] || null;
+export const factNames = () => Object.keys(QUESTION).map(k => DOTTED[k] || k);

package/src/redact.mjs

@@ -0,0 +1,127 @@
+// Strip secret VALUES out of a file before it is ever put in the upload digest.
+//
+// The deep scan sends a digest of the user's code to our server and on to
+// Anthropic. The privacy page promises credentials are never transmitted, and
+// until this module existed that promise was false: a backup.sql full of card
+// numbers, a docker-compose.yml with a plaintext password, or a key hardcoded
+// in source went up verbatim. Only .env was excluded.
+//
+// This runs in the CLI, on the user's machine, BEFORE anything leaves it — so a
+// masked secret never travels at all, not even to us. That is the only correct
+// place for it; redacting server-side would mean the secret already left.
+//
+// The rule of thumb is the inverse of the scanner's. The scanner must not cry
+// wolf, so it needs evidence before it fires. Redaction is the opposite: a
+// masked non-secret costs a little context, a leaked real secret is the whole
+// failure. So this leans aggressive on things SHAPED like secrets, and only
+// holds back where masking would destroy code the scan genuinely needs — a
+// reference like `process.env.STRIPE_KEY` is good code, not a leak, and stays.
+//
+// What the tier-2 rules ask about — authorization, tenancy, deletion, spend —
+// is never answered by the literal value of a key or a row of customer data, so
+// nothing here reduces what the scan can find.
+
+const TAG = (kind) => `«redacted:${kind}»`;
+
+// 1. PEM private-key blocks — the whole block, header to footer.
+const PEM = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g;
+
+// 2. Credentials embedded in a connection URL: scheme://user:pass@host.
+//    Keep the scheme and host (useful shape), mask only user:pass.
+const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+
+// 3. Provider keys by their published shape. pk_ (Stripe publishable) is left
+//    alone on purpose — it is designed to be public, and masking it was one of
+//    the original false positives this whole product learned from.
+const SHAPES = [
+  [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{10,}/g,               'stripe-key'],
+  [/\bwhsec_[A-Za-z0-9]{20,}/g,                                 'webhook-secret'],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}/g,                              'anthropic-key'],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}/g,                        'openai-key'],
+  [/\bAKIA[0-9A-Z]{16}\b/g,                                     'aws-access-key'],
+  [/\bASIA[0-9A-Z]{16}\b/g,                                     'aws-temp-key'],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g,                                'google-key'],
+  [/\bya29\.[0-9A-Za-z_-]{20,}/g,                               'google-oauth'],
+  [/\bgh[pousr]_[A-Za-z0-9]{36,}/g,                             'github-token'],
+  [/\bglpat-[A-Za-z0-9_-]{20,}/g,                               'gitlab-token'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}/g,                           'slack-token'],
+  [/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,             'sendgrid-key'],
+  [/\bre_[A-Za-z0-9_-]{20,}/g,                                  'resend-key'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, 'jwt'],
+];
+
+// 4. A value assigned to a secret-NAMED identifier. This catches the passwords
+//    and tokens that have no distinctive shape. It fires only on string
+//    literals, and holds back where the value is plainly not a secret: an env
+//    reference, a template placeholder, an interpolation, an empty string.
+const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
+const ASSIGN = new RegExp(
+  '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)(["\'`])([^"\'`\\n]{6,}?)\\2',
+  'gi',
+);
+// values that are NOT secrets even though the key name matched
+const NOT_A_SECRET = /^(?:process\.env|import\.meta|os\.environ|ENV\[|Deno\.env|\$\{|\$[A-Z(]|<[A-Za-z%{]|\{\{|%[A-Za-z]|your[_-]|change[_-]?me|placeholder|example|dummy|test[_-]?key|xxx+|\*{3,}|\.{3,}|null|undefined|true|false|none|n\/?a)/i;
+
+// 4b. The same, unquoted: `POSTGRES_PASSWORD: hunter2` / `DB_PASS=hunter2` /
+//     Dockerfile `ENV SECRET hunter2`. This is how .env, YAML, Dockerfiles,
+//     Terraform and .ini files carry secrets, and none of them quote. Applied
+//     ONLY to those config files — in real code a bare `password: foo` is a
+//     variable reference (foo), and masking it would delete a name the scan
+//     wants. The value runs to end of line.
+// colon or equals, spaced or not: `PASSWORD: hunter2` (yaml), `SECRET=hunter2`
+// (.env), `token = "..."` handled by the quoted rule above.
+const ASSIGN_BARE = new RegExp(
+  '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)([^\\s"\'`#][^\\n#]*?)(\\s*(?:#.*)?)$',
+  'gim',
+);
+// Dockerfile / shell: `ENV DB_PASSWORD hunter2`, `ARG API_TOKEN=hunter2`. The
+// secret word is a substring of the identifier, and the value is one token.
+const DOCKER_ENV = new RegExp(
+  '\\b(ENV|ARG|export)\\s+([A-Za-z0-9_]*' + SECRET_NAME.source + '[A-Za-z0-9_]*[\\s=]+)(["\']?)([^\\s"\']+)\\3',
+  'gi',
+);
+const CONFIGISH = /(^|\/)(\.env|.*\.env|.*\.ya?ml|.*\.tf|.*\.tfvars|.*\.toml|.*\.ini|.*\.conf|.*\.properties|Dockerfile[^/]*|.*\.dockerfile)$/i;
+
+// 5. Bulk data in a SQL dump. The schema the scan needs comes from CREATE TABLE
+//    and ALTER; the rows do not, and the rows are where the customer PII and any
+//    secret literals in a dump actually live.
+const SQL_INSERT = /(\bINSERT\s+INTO\s+[^\n(]+?)(\([^)]*\)\s*)?\bVALUES\b[\s\S]*?;/gi;
+const SQL_COPY = /(\bCOPY\s+[^\n]+?FROM\s+stdin\s*;)[\s\S]*?\n\\\.$/gim;
+
+export function redact(text, path = '') {
+  if (!text) return { text, count: 0 };
+  let count = 0;
+  const bump = (n = 1) => { count += n; };
+
+  let out = text.replace(PEM, () => (bump(), TAG('private-key')));
+
+  out = out.replace(CONN, (_, scheme) => (bump(), `${scheme}${TAG('credentials')}@`));
+
+  for (const [re, kind] of SHAPES) {
+    out = out.replace(re, () => (bump(), TAG(kind)));
+  }
+
+  out = out.replace(ASSIGN, (m, head, q, val) => {
+    if (NOT_A_SECRET.test(val)) return m;
+    bump();
+    return `${head}${q}${TAG('secret')}${q}`;
+  });
+
+  if (CONFIGISH.test(path)) {
+    out = out.replace(ASSIGN_BARE, (m, head, val, trail) => {
+      if (NOT_A_SECRET.test(val)) return m;
+      bump();
+      return `${head}${TAG('secret')}${trail}`;
+    });
+    out = out.replace(DOCKER_ENV, (m, kw, name, q, val) => {
+      if (NOT_A_SECRET.test(val)) return m;
+      bump();
+      return `${kw} ${name}${q}${TAG('secret')}${q}`;
+    });
+  }
+
+  out = out.replace(SQL_INSERT, (m, head) => (bump(), `${head}VALUES ${TAG('rows')};`));
+  out = out.replace(SQL_COPY, (_, head) => (bump(), `${head} ${TAG('rows')}\n\\.`));
+
+  return { text: out, count };
+}

package/src/report.mjs

@@ -1,18 +1,14 @@
 import { BRAND } from './brand.mjs';
+import { questionFor } from './questions.mjs';
 
 const C = { red:'\x1b[31m', yel:'\x1b[33m', blu:'\x1b[34m', gry:'\x1b[90m',
             bold:'\x1b[1m', dim:'\x1b[2m', grn:'\x1b[32m', cyn:'\x1b[36m', off:'\x1b[0m' };
 const SEV = { critical:[C.red,'CRITICAL'], high:[C.yel,'HIGH'], medium:[C.blu,'MEDIUM'], low:[C.gry,'LOW'] };
 
-const QUESTION = {
-  business_model:  'Who is this for — consumers, businesses, a marketplace, or internal use?',
-  jurisdictions:   'Where are your users? (EU / UK / US / other — this decides which privacy rules apply)',
-  expected_scale:  'How many users do you expect — under 1k, under 100k, or more?',
-  serves_currency: 'Do you charge in more than one currency?',
-  audience_locale: 'Do you serve more than one language or region?',
-};
+// The wording lives in questions.mjs — 33 facts, not the 5 that had text.
+// A customer used to read "? llm_tools_enabled" as the last line of a scan.
 
-export function render({ repo, scanned, lead, findings, questions, shallow = [] }) {
+export function render({ repo, scanned, lead, findings, questions, shallow = [], coverage = null, stated = null }) {
   const L = [];
   const p = (s = '') => L.push(s);
   const pr = lead.profile;
@@ -28,6 +24,21 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   row('Type', pr.surface, ev('surface'));
   row('Stack', [pr.stack.framework, pr.stack.database, pr.stack.host].filter(Boolean).join(' · ') || '—');
   row('Accounts', pr.has_accounts ? 'yes' : 'no', ev('has_accounts'));
+
+  // What the user stated beats what we detected, so it must be VISIBLE. A wrong
+  // answer silently changing which checks run would be worse than no answers
+  // at all — they would never find out why something was skipped.
+  if (stated && Object.keys(stated).length) {
+    const flat = [];
+    for (const [k, v] of Object.entries(stated)) {
+      if (v && typeof v === 'object' && !Array.isArray(v))
+        for (const [k2, v2] of Object.entries(v)) flat.push(`${k}.${k2}=${v2}`);
+      else flat.push(`${k}=${Array.isArray(v) ? v.join('/') : v}`);
+    }
+    p(`  ${C.gry}${'You said'.padEnd(10)}${C.off}${flat.slice(0, 6).join('  ')}` +
+      `${flat.length > 6 ? `  ${C.dim}+${flat.length - 6} more${C.off}` : ''}` +
+      `  ${C.dim}(from launchprep.json)${C.off}`);
+  }
   if (pr.tenancy !== 'none') row('Tenancy', pr.tenancy, ev('tenancy'));
   if (pr.calls_llm) row('AI', (pr.llm_providers || []).join(', ') || 'yes', ev('calls_llm'));
   if (pr.handles_payments !== 'none') row('Payments', pr.handles_payments);
@@ -78,7 +89,16 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   // ---------- what we did not check, and why ----------
   const g = lead.gate;
   p(`\n${C.bold}Coverage${C.off}`);
-  p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  // Say what RAN, not what applies. The difference is the tier-2 rules, which
+  // need a model to read the code — counting those as "applied" reported a
+  // pass on checks nothing performed.
+  if (coverage) {
+    p(`  ${C.bold}${coverage.ran}${C.off} of ${g.total} checks ran here`);
+    if (coverage.needsDeep)
+      p(`  ${C.bold}${coverage.needsDeep}${C.off} more apply to you but need a deep scan ${C.dim}(they need a model to read the code)${C.off}`);
+  } else {
+    p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  }
   p(`  ${C.dim}${g.skipped.length} skipped — they don't fit what you built${C.off}`);
 
   const bySkipFact = {};
@@ -92,10 +112,19 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   // ---------- the three questions ----------
   if (questions.length) {
     p(`\n${C.bold}${g.unknown.length} more checks need ${questions.length} answer${questions.length === 1 ? '' : 's'}${C.off}`);
-    for (const [factName, n] of questions)
-      p(`  ${C.cyn}?${C.off} ${QUESTION[factName] || factName}  ${C.dim}(unlocks ${n})${C.off}`);
+    for (const [factName, n] of questions) {
+      const q = questionFor(factName);
+      p(`  ${C.cyn}?${C.off} ${q ? q.ask : factName}  ${C.dim}(unlocks ${n})${C.off}`);
+      if (q) p(`    ${C.dim}${q.answer}${C.off}`);
+    }
   }
 
-  p(`\n  ${C.dim}Anything above wrong? Correct it and the checks adjust.${C.off}\n`);
+  // This used to say "Correct it and the checks adjust" with no way on earth to
+  // do so — no flag, no file, no prompt. It was the last line of every scan and
+  // it invited an action that did not exist. Now it names the file that works.
+  if (questions.length)
+    p(`\n  ${C.dim}Put those in ${C.off}launchprep.json${C.dim} at the top of your project and run again — the answers unlock the checks above.${C.off}\n`);
+  else
+    p(`\n  ${C.dim}Wrong about your app? Correct it in ${C.off}launchprep.json${C.dim} and run again.${C.off}\n`);
   return L.join('\n');
 }