launchprep 0.4.0 → 0.5.1

package/README.md

@@ -69,6 +69,27 @@ the report link keeps working, and that link expires.
 
 If there is no terminal — CI, a script — it refuses rather than assuming yes.
 
+## Telling it about your app
+
+Some things are not in the code — where your users live, whether your AI is
+allowed to act, how many people you expect. Those checks are skipped, and the
+scan lists them. Put the answers in `launchprep.json` at the top of your
+project and run again:
+
+```json
+{
+  "jurisdictions": ["eu"],
+  "has_accounts": true,
+  "llm_tools_enabled": true,
+  "stage": "production"
+}
+```
+
+What you state beats what was detected, and the report shows it back under
+**You said** so a wrong answer is visible rather than silently changing
+results. The free scan is unlimited, so correcting and re-running costs
+nothing.
+
 ## In CI
 
 ```bash

package/net/client.mjs

@@ -36,6 +36,13 @@ export const deepScan = ({ key, digest, profile, ruleIds, appName, idempotencyKe
     rule_ids: ruleIds,
     app_name: appName,
     idempotency_key: idempotencyKey,
+    // What the digest read and what did not fit the size cap. The model is
+    // already told what it cannot see; this is so the CUSTOMER is told too,
+    // in the report - a big repo gets its most relevant slice, and reporting
+    // that slice as "everything" would let someone believe every file was
+    // checked when it was not.
+    files_read: digest.coverage?.filesRead ?? null,
+    files_skipped: digest.coverage?.filesSkipped ?? null,
   }});
 
 export { BASE };

package/net/commands.mjs

@@ -99,6 +99,17 @@ async function deep(args) {
     console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
     process.exit(1);
   }
+  // Not an error the customer did anything to cause, and nothing was spent -
+  // say both, or a 409 reads like a failure and they wonder if they lost a scan.
+  if (r.status === 409 && r.data?.error === 'scan_in_progress') {
+    const since = r.data.startedAt ? new Date(r.data.startedAt) : null;
+    const mins  = since ? Math.max(1, Math.round((Date.now() - since.getTime()) / 60000)) : null;
+    console.error(`\n  ${C.red}You already have a scan running.${C.off}`);
+    console.error(`  ${C.d}Started ${mins ? mins + (mins === 1 ? ' minute' : ' minutes') + ' ago' : 'a moment ago'}` +
+                  `. A scan takes about four minutes; wait for it to finish and run this again.${C.off}`);
+    console.error(`  ${C.grn}No scan was used.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402 && (r.data?.error === 'attempt_ceiling' || r.data?.error === 'spend_ceiling')) {
     console.error(`\n  ${C.red}This key has run too many scans that did not finish.${C.off}`);
     console.error(`  ${C.d}${r.data.attempts} attempts against a ${r.data.limit}-scan licence. Something is going`);
@@ -150,7 +161,10 @@ async function deep(args) {
     if (r.data.refunded) {
       console.log(`  ${C.grn}This scan did not finish, so it does not count against your five.${C.off}`);
     }
-    console.log(`  ${C.d}Run it again and they usually complete.${C.off}\n`);
+    const failed = missed.filter(m => !m.declined), declined = missed.filter(m => m.declined);
+    if (failed.length)   console.log(`  ${C.d}Run it again and these usually complete.${C.off}`);
+    if (declined.length) console.log(`  ${C.d}${declined.length} ${declined.length === 1 ? 'was' : 'were'} declined by the review model for this code — a re-run will not change that.${C.off}`);
+    console.log('');
   }
 
   if (r.data.report?.url) {
@@ -158,6 +172,13 @@ async function deep(args) {
     console.log(`  ${C.o}${r.data.report.url}${C.off}`);
     console.log(`  ${C.d}dated, shareable, and it expires in ${r.data.report.expiresInDays} days${C.off}\n`);
   }
+  // A big repo gets its most security-relevant slice, not every file. Saying
+  // nothing here would let someone believe every file was checked. One line,
+  // only when something was actually left out.
+  if (digest.coverage?.filesSkipped > 0) {
+    console.log(`  ${C.d}Read the ${digest.coverage.filesRead} most security-relevant files; ` +
+                `${digest.coverage.filesSkipped} did not fit this scan's size cap and were not checked.${C.off}\n`);
+  }
   console.log(`  ${C.d}${r.data.scansRemaining} deep scan${r.data.scansRemaining === 1 ? '' : 's'} left${C.off}\n`);
 
   // --fail-on <severity>: the CI gate, same contract as the free scan. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },

package/src/check-helpers.mjs

@@ -0,0 +1,43 @@
+// The helpers every tier-1 check file used to define for itself, byte-for-byte,
+// in ten separate copies. That duplication is not harmless: it is exactly how
+// isServer drifted into three different regexes, one of them still carrying a
+// bug already fixed in another. One definition here means one behaviour
+// everywhere, and a fix lands in one place.
+//
+// Only the provably-identical helpers live here. isServer is deliberately NOT
+// among them - its three copies genuinely disagree about which directories are
+// "server", and unifying them is a behaviour change that needs its own corpus
+// pass, not a mechanical dedup.
+
+// A finding is just this shape. Named so a check reads as prose.
+export const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+// 1-based line number of a byte offset.
+export const lineOf = (text, i) => text.slice(0, i).split('\n').length;
+
+// The whole source line containing a byte offset (no trailing newline).
+export const lineAt = (t, i) => {
+  const a = t.lastIndexOf('\n', i) + 1;
+  const b = t.indexOf('\n', i);
+  return t.slice(a, b === -1 ? t.length : b);
+};
+
+// Is this path source code we should read the body of?
+export const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
+
+// The text with comments blanked to spaces (line length and offsets preserved),
+// so a pattern cannot match inside a // or /* */ or a leading-# comment. This is
+// the guard behind "judge the line, not a 200-char neighbourhood".
+export const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};

package/src/checks-ai.mjs

@@ -1,12 +1,18 @@
+import { finding, lineOf, isCode } from './check-helpers.mjs';
 // AI cost and safety. Barely covered by the corpus, which is exactly why it
 // matters: this is the family nobody else is checking.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
+import { looksLikePlaceholder } from './placeholder.mjs';
 
-const lineOf = (text, i) => text.slice(0, i).split('\n').length;
-const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
-const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|lib|services?)\//.test(p);
-const isClient = (p) => /\/(components?|pages?|app|src)\//.test(p) && !isServer(p);
+
+// (^|/) not just / — a slash was REQUIRED before the word, so a project laid
+// out as api/src/... or server/src/... or backend/src/... never matched as a
+// server, and then matched as a browser because it contains /src/. Result: the
+// scanner told people running a plain Node backend that their API key was
+// "shipped to every visitor". It fired twice on this repository's own api/.
+// A fabricated CRITICAL is the failure this whole product is built to avoid.
+// 'backend' and 'worker' added because they are as common as 'server'.
+const isServer = (p) => /(^|\/)(api|routes?|server|backend|actions?|controllers?|handlers?|endpoints?|resolvers?|lib|services?|workers?|jobs?)\//.test(p);
+const isClient = (p) => /(^|\/)(components?|pages?|app|src|client|frontend|ui|views?)\//.test(p) && !isServer(p);
 
 const LLM_CALL = /\.(messages|chat\.completions|completions|responses)\.create\s*\(|generateText\s*\(|streamText\s*\(|\.generateContent\s*\(/;
 
@@ -148,12 +154,24 @@ export const AI_CHECKS = [
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path)) continue;
-      const re = /\b(eval|exec|execSync|spawnSync|Function)\s*\(|\.query\s*\(\s*`/g;
+      // `exec` as a bare word is two different things. `child_process.exec(cmd)`
+      // runs a program; `re.exec(text)` is how JavaScript matches a regular
+      // expression, and appears in ordinary code constantly - three times in
+      // this scanner's own source, which is how it reported three CRITICALs
+      // about itself. So `.exec(` preceded by a dot only counts when the thing
+      // before the dot is actually child_process.
+      const re = /(?<![.\w])(eval|execSync|execFileSync|spawnSync|Function)\s*\(|(?<![.\w])exec\s*\(|\b(?:child_process|cp|shell)\.exec(?:File)?\s*\(|\.query\s*\(\s*`/g;
       let m;
       while ((m = re.exec(f.text))) {
         const around = f.text.slice(Math.max(0, m.index - 600), m.index + 200);
         if (!LLM_CALL.test(around) &&
             !/\b(completion|aiResponse|modelOutput|generated|llmResult)\b/i.test(around)) continue;
+        // "generated" and "completion" are ordinary English words. Requiring
+        // the neighbourhood to ALSO look like a model call stops a comment
+        // containing "generated" from turning a regex into a CRITICAL.
+        const ls = f.text.lastIndexOf('\n', m.index) + 1;
+        let le = f.text.indexOf('\n', m.index); if (le < 0) le = f.text.length;
+        if (looksLikePlaceholder(m[0], f.text.slice(ls, le), f.path)) continue;
         out.push(finding('AI-008', 'Model output used in a privileged operation', 'critical',
           f.path, lineOf(f.text, m.index),
           'What the model returns is being executed or used to build a query. Anyone who can steer the model can steer this.',
@@ -187,6 +205,12 @@ export const AI_CHECKS = [
 // ---- provider key used straight from the browser -------------------------
 { id: 'SEC-006', run(repo, profile) {
     if (!profile.calls_llm) return [];
+    // An app with no browser cannot ship a key to one. profile -> gate -> check
+    // is the whole idea of this scanner, and this check skipped the profile
+    // step: on an api-only, CLI or library project every src/ file looked like
+    // browser code, so a plain Node script was told its key is "shipped to
+    // every visitor" when it has no visitors.
+    if (['api-only', 'cli', 'library', 'mobile-ios', 'mobile-android'].includes(profile.surface)) return [];
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path) || !isClient(f.path)) continue;

package/src/checks-auth.mjs

@@ -1,8 +1,5 @@
+import { finding, lineOf, isCode } from './check-helpers.mjs';
 // Accounts, sessions, and the secrets that protect them.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
 
 const RATE_LIMITER =
   /rate-?limit|rateLimit|Ratelimit|throttle|slowDown|@upstash\/ratelimit|express-rate-limit|limiter\.|bottleneck/i;

package/src/checks-authz.mjs

@@ -1,10 +1,8 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Authorization: "is THIS user allowed to touch THIS record?"
 // The corpus calls this the most common real-world vulnerability, and it is the
 // family most likely to find something true in a vibe-coded app.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 // Everything between a handler's opening brace and its matching close, so we can
 // ask "does this handler mention the logged-in user anywhere?"

package/src/checks-batch2.mjs

@@ -1,15 +1,10 @@
+import { finding, lineOf, lineAt } from './check-helpers.mjs';
 // The remaining critical and high tier-1 checks.
 // Lesson applied throughout: judge the line, read the value, never the name alone.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const lineAt = (t, i) => {
-  const a = t.lastIndexOf('\n', i) + 1;
-  const b = t.indexOf('\n', i);
-  return t.slice(a, b === -1 ? t.length : b);
-};
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
-const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
+// anchored (^|\/) so a server dir at the REPO ROOT (api/x.ts) matches too -
+// the same root-level miss fixed in checks-batch4/API-010. Same list, additive.
+const isServer = (p) => /(^|\/)(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
 
 export const BATCH2_CHECKS = [
 

package/src/checks-batch3.mjs

@@ -1,7 +1,5 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Remaining tier-1 checks: data, deployment, framework config, real-user readiness.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
 const isProdSettings = (p) =>
   /settings/i.test(p) && !/local|dev|development|test|example|template/i.test(p);

package/src/checks-batch4.mjs

@@ -1,18 +1,11 @@
+import { finding, lineOf, lineAt } from './check-helpers.mjs';
 // The last of the tier-1 checks.
 //
 // Discipline, same as everywhere else in this directory: read the value, not the
 // identifier. Judge the line, not a 200-character neighbourhood. Require evidence
 // that the thing is used the dangerous way before saying a word.
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const lineAt = (t, i) => {
-  const a = t.lastIndexOf('\n', i) + 1;
-  const b = t.indexOf('\n', i);
-  return t.slice(a, b === -1 ? t.length : b);
-};
 // the whole call expression starting at i, bounded so we never judge a neighbour
 const callAt = (t, i, max = 260) => {
   const open = t.indexOf('(', i);
@@ -26,7 +19,10 @@ const callAt = (t, i, max = 260) => {
 };
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
 const isServer = (p) =>
-  /\/(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
+  // anchored with (^|\/): a directory at the REPO ROOT (api/client.ts) has no
+  // leading slash, so /\/api\// missed it and API-010 skipped every root-level
+  // api/ file. Same list as before - this only adds the start-of-path case.
+  /(^|\/)(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
 
 // union of every manifest in the repo - monorepos keep the root one empty
 const depNames = (repo) => {

package/src/checks-deploy.mjs

@@ -1,24 +1,12 @@
+import { finding, lineOf, codeOnly } from './check-helpers.mjs';
 // Deployment and transport. Mechanically detectable, high volume.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+import { looksLikePlaceholder } from './placeholder.mjs';
+
 
 // Comments blanked to spaces - offsets and line numbers survive, the words do
 // not. Our own server.mjs opens by explaining that it does NOT use
 // express.json(), and DATA-008 read that sentence as the call itself. Twelfth
 // time this shape has bitten: it matched a name where no code was.
-const codeOnly = (t) => {
-  let out = '', i = 0;
-  const blank = (s) => s.replace(/[^\n]/g, ' ');
-  while (i < t.length) {
-    const two = t.slice(i, i + 2);
-    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
-    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    out += t[i]; i++;
-  }
-  return out;
-};
 
 export const DEPLOY_CHECKS = [
 
@@ -33,6 +21,12 @@ export const DEPLOY_CHECKS = [
       f.text.split('\n').forEach((line, i) => {
         if (/\$\{\{\s*secrets\./.test(line)) return;           // the correct pattern
         const m = line.match(SECRET_VALUE);
+        // Every project that tests against a database puts a throwaway one in
+        // CI - postgres:postgres@localhost/..._test. That is not a credential,
+        // and flagging it as a CRITICAL on nearly every real repository is how
+        // a scanner loses the right to be believed. This repo's own CI was
+        // flagged by this check.
+        if (m && looksLikePlaceholder(m[0], line, f.path)) return;
         if (m) out.push(finding('DEP-002', 'Credential written into the CI config', 'critical',
           f.path, i + 1,
           'This value is committed to the repository and printed in build logs. Anyone with read access to either has it.',

package/src/checks-frameworks.mjs

@@ -1,8 +1,6 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Django and Rails. Both ship deliberately permissive defaults for local
 // development, and both document exactly which ones must change before deploying.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // a settings file that is meant for production, not somebody's laptop
 const isProdSettings = (p) =>

package/src/checks-injection.mjs

@@ -1,3 +1,4 @@
+import { finding, lineOf, codeOnly } from './check-helpers.mjs';
 // User input concatenated into a SQL query.
 //
 // This was missing from all 288 rules. A project with `${req.params.id}` dropped
@@ -18,25 +19,10 @@
 // And then the safe forms are subtracted, because every one of them would
 // otherwise fire on correct code.
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // Comments blanked to spaces; offsets and line numbers survive, the words do
 // not. A comment reading "never do `SELECT * FROM users WHERE id = ${id}`" is
 // advice against the bug, not the bug.
-const codeOnly = (t) => {
-  let out = '', i = 0;
-  const blank = (s) => s.replace(/[^\n]/g, ' ');
-  while (i < t.length) {
-    const two = t.slice(i, i + 2);
-    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
-    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    out += t[i]; i++;
-  }
-  return out;
-};
 
 // A verb and a clause. "select" alone matches a React prop, a CSS selector, a
 // variable called selectedUser and about forty other innocent things.

package/src/checks.mjs

@@ -1,3 +1,4 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Tier-1 checks: deterministic, no LLM, no network. Each returns findings with
 // a file:line so the user can go straight to it.
 import { AUTHZ_CHECKS } from './checks-authz.mjs';
@@ -9,14 +10,40 @@ import { FRAMEWORK_CHECKS } from './checks-frameworks.mjs';
 import { BATCH2_CHECKS } from './checks-batch2.mjs';
 import { BATCH3_CHECKS } from './checks-batch3.mjs';
 import { BATCH4_CHECKS } from './checks-batch4.mjs';
+import { scanGitHistory } from './git-history.mjs';
+import { looksLikePlaceholder } from './placeholder.mjs';
+import { makeView } from './fs-scan.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 const BASE_CHECKS = [
 
+// SEC-009 — a key that was committed, then "removed". SEC-001/003 read the
+// working tree, so deleting the line hides it from them while it stays in
+// .git forever and travels with every clone. scope:'root' because history is
+// a property of the repository, not of a workspace.
+//
+// Only vendor-prefixed keys are looked for. See the long note in
+// git-history.mjs: a test private key and a real one are byte-identical, so
+// including those types fired on 15 of 68 real repositories and every hit was
+// a fixture. Narrowed to unmistakable prefixes it fires on 0 of 20.
+{ id:'SEC-009', scope:'root', run(repo){
+    const res = scanGitHistory(repo.root);
+    if (!res.findings.length) return [];
+    const kinds = [...new Set(res.findings.map(f => f.label))];
+    const what = kinds.length === 1 ? kinds[0]
+      : `${kinds.slice(0, -1).join(', ')} and ${kinds[kinds.length - 1]}`;
+    const n = res.findings.length;
+    return [finding('SEC-009',
+      `${n === 1 ? 'A key was' : `${n} keys were`} committed and is still in your git history`,
+      'critical', '.git', 1,
+      `Your ${what} appears in an old commit. Removing it from the file did not remove it — ` +
+      'every clone, fork and fetch of this repository still carries it, and anyone who has ever ' +
+      'had a copy can read it. Treat it as public.',
+      'Rotate the key at the provider now — that is what actually stops it being used. ' +
+      'Rewriting history afterwards is optional and does not help anyone who already cloned.')];
+  }},
+
 { id:'SEC-002', run(repo){
     const gi = repo.read('.gitignore');
     if (gi === null) return [];
@@ -46,6 +73,18 @@ const BASE_CHECKS = [
         const full = m[1]+m[2];
         if (PUBLIC_BY_DESIGN.test(m[2]) || NOT_A_CREDENTIAL.test(m[2])) continue;
 
+        // Require EVIDENCE this is a real env var, not the NAME of one sitting
+        // inside a regex, a string list or a comment. On a real project this
+        // matched `PUBLIC_KEY` in the alternation /(...|PUBLIC_KEY|...)/ and
+        // called it an exposed secret - the recurring "name in a pattern" FP
+        // this codebase keeps relearning. Two forms count as real: an assignment
+        // (NEXT_PUBLIC_X = / :), or an env access (process.env.NEXT_PUBLIC_X).
+        const after  = f.text.slice(m.index + m[0].length, m.index + m[0].length + 24);
+        const before = f.text.slice(Math.max(0, m.index - 16), m.index);
+        const isAssignment = /^[A-Z0-9_]*\s*[:=](?!=)/.test(after);   // NAME= or NAME: (not ==)
+        const isEnvAccess  = /env\.$|env\[['\"`]?$|env\.get\(['\"`]?$/i.test(before);
+        if (!isAssignment && !isEnvAccess) continue;
+
         const certain = DEFINITELY_SECRET.test(m[2]);
         out.push(finding('SEC-004',
           certain ? 'Server secret exposed to the browser' : 'Possible secret exposed to the browser',
@@ -85,6 +124,14 @@ const BASE_CHECKS = [
       for (const [re,label] of PATTERNS){
         let m; re.lastIndex=0;
         while ((m=re.exec(f.text))){
+          // The shape of a key is not a key. AWS publishes AKIAIOSFODNN7EXAMPLE
+          // in its own docs; a regex that LOOKS FOR keys contains one by
+          // definition; a test fixture is meant to. Scanning this repository
+          // produced four CRITICALs and every one was the scanner reading its
+          // own detection patterns back to itself.
+          const ls = f.text.lastIndexOf('\n', m.index) + 1;
+          let le = f.text.indexOf('\n', m.index); if (le < 0) le = f.text.length;
+          if (looksLikePlaceholder(m[0], f.text.slice(ls, le), f.path)) continue;
           out.push(finding('SEC-003',`Hardcoded ${label}`,'critical',
             f.path, lineOf(f.text,m.index),
             `A live ${label} is written directly into this file.`,
@@ -132,11 +179,29 @@ const BASE_CHECKS = [
   }},
 
 { id:'DEP-010', run(repo){
-    if (!repo.exists('package.json')) return [];
-    const has = ['package-lock.json','pnpm-lock.yaml','yarn.lock','bun.lockb'].some(l=>repo.exists(l));
-    return has ? [] : [finding('DEP-010','No lockfile committed','medium','package.json',1,
-      'Without a lockfile your production build can install different versions than you tested.',
-      'Commit the lockfile your package manager generates.')];
+    // "Dependencies unpinned." The no-lockfile half of this rule is DEP-011's
+    // job now (root-scoped, higher severity) - both firing on no-lockfile was a
+    // duplicate finding at two severities. This half is the one DEP-011 does
+    // NOT cover and a lockfile does NOT save you from: a spec that means
+    // "whatever is newest" no matter what - a wildcard, a dist-tag, or a
+    // git/URL target that can move under the same string. Caret and tilde
+    // ranges are the norm and a lockfile pins them, so they are not flagged -
+    // that would be noise on nearly every project.
+    const raw = repo.read('package.json');
+    if (!raw) return [];
+    let pkg; try { pkg = JSON.parse(raw); } catch { return []; }
+    const deps = { ...(pkg.dependencies||{}), ...(pkg.devDependencies||{}) };
+    const UNPINNED = /^(\*|x|latest|next|\d+\.(x|\*)|\d+\.\d+\.(x|\*))$/i;
+    const MOVING   = /^(git\+|github:|git:|https?:|file:)/i;
+    const bad = Object.entries(deps)
+      .filter(([, v]) => { const t = String(v).trim(); return UNPINNED.test(t) || MOVING.test(t); });
+    if (!bad.length) return [];
+    const names = bad.slice(0, 5).map(([n, v]) => `${n}: ${v}`).join(', ');
+    return [finding('DEP-010', 'Dependencies pinned to a moving target', 'medium', 'package.json', 1,
+      `${bad.length} dependency${bad.length === 1 ? ' resolves' : 'ies resolve'} to whatever is newest — ${names}` +
+      (bad.length > 5 ? ', and more' : '') + '. Even with a lockfile, anyone who installs without it gets ' +
+      'a different version than you tested, and the same string can mean new code tomorrow.',
+      'Pin these to a version — an exact one, or a caret range at least — so the same string always means the same code.')];
   }},
 
 { id:'API-002', run(repo,profile){
@@ -185,12 +250,16 @@ const IS_TEST = /(^|\/)(tests?|__tests__|__mocks__|spec|e2e|fixtures?|examples?)
 
 function withoutTests(repo){
   const files = repo.files.filter(f => !IS_TEST.test(f.path));
-  return { ...repo, files,
-    has:  (re) => files.some(f => re.test(f.path)),
-    find: (re) => files.filter(f => re.test(f.path)),
-    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|sql|prisma)$/) =>
-      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
-  };
+  // has/find/grep run over the tests-excluded files; exists/read/isIgnored keep
+  // delegating to the underlying repo (disk-backed on the root scan), so a check
+  // can still ask about a file that was filtered here. Built through makeView so
+  // it carries the same capability set as every other view - the previous
+  // {...repo} spread inherited those three by luck, which is the drift this
+  // consolidation removes.
+  return makeView({
+    files, root: repo.root,
+    read: repo.read, exists: repo.exists, isIgnored: repo.isIgnored,
+  });
 }
 
 // Some facts live at the repo root and nowhere else - the lockfile, the CI

package/src/detect.mjs

@@ -1,8 +1,15 @@
-// Profile detection. Every fact carries evidence and a confidence level.
-// LOW confidence never produces a `fail` — the gate turns it into a question.
+// Profile detection. Every fact carries a value and the evidence for it.
+//
+// There used to be a third field, `confidence`, and a comment promising "LOW
+// confidence never produces a fail - the gate turns it into a question". The
+// gate never read it: the mechanism was described but never wired, so the field
+// was dead data on every fact and the comment described behaviour that did not
+// exist. Removed. The confidence argument is still ACCEPTED at the ~90 call
+// sites (harmless positional documentation of how sure the detector is) but is
+// no longer stored, so nothing can come to depend on a value nothing computes.
 import { readPackageJson, allDeps, stripComments, isWorkspaceRoot } from './fs-scan.mjs';
 
-const fact = (value, confidence, evidence = []) => ({ value, confidence, evidence });
+const fact = (value, _confidence, evidence = []) => ({ value, evidence });
 const dep  = (deps, ...names) => names.find(n => deps[n] !== undefined);
 
 // ---------- stack ----------