launchprep 0.4.0 → 0.5.1

package/src/questions.mjs

@@ -0,0 +1,206 @@
+// The questions the scanner asks when it cannot tell something from the code,
+// written for the person who reads the report.
+//
+// The scanner can gate on 33 facts. Five of them had wording; the other 28
+// printed their internal name — a customer saw "? llm_tools_enabled" and
+// "? has_webhooks_in" as the last thing on screen. The stated audience is
+// people who cannot read code, and those are not questions, they are variable
+// names a programmer wrote for themselves.
+//
+// Each entry carries:
+//   ask     the question, in words someone non-technical can answer
+//   answer  what to write in launchprep.json, shown so the answer is obvious
+//   why     what it unlocks, so the question does not feel like paperwork
+//
+// The rule for the wording is the same one the findings follow: name the
+// consequence, not the mechanism. "Can people sign in?" not "has_accounts".
+export const QUESTION = {
+  // --- who and where -------------------------------------------------------
+  jurisdictions: {
+    ask: 'Where do your users live?',
+    answer: '"jurisdictions": ["eu"]   — any of: eu, uk, us, ca, ru, kz, other',
+    why: 'decides which privacy laws reach you at all',
+  },
+  business_model: {
+    ask: 'Who is this for — businesses, consumers, or a marketplace?',
+    answer: '"business_model": "b2b-saas"   — b2b-saas, b2c, marketplace, internal',
+    why: 'a marketplace holds other people’s money and has different duties',
+  },
+  expected_scale: {
+    ask: 'Roughly how many users do you expect in the first year?',
+    answer: '"expected_scale": "under-100k"   — under-1k, under-100k, over-100k',
+    why: 'what is safe at 100 users falls over at 100,000',
+  },
+  audience_locale: {
+    ask: 'Do you serve more than one language or region?',
+    answer: '"audience_locale": "multi"   — single, multi',
+    why: 'dates, times and text break first when you cross a border',
+  },
+  serves_currency: {
+    ask: 'Do you charge in more than one currency?',
+    answer: '"serves_currency": "multi"   — single, multi',
+    why: 'rounding and exchange rates are where money quietly goes missing',
+  },
+  data_sensitivity: {
+    ask: 'Do you hold anything especially sensitive — money, health, or data about children?',
+    answer: '"data_sensitivity": "financial"   — normal, financial, health, children',
+    why: 'these carry duties ordinary personal data does not',
+  },
+
+  // --- what the app is -----------------------------------------------------
+  surface: {
+    ask: 'What is it — a website, a web app, an API, or a mobile app?',
+    answer: '"surface": "web-app"   — web-site, web-app, api-only, mobile-ios, mobile-android, cli, library',
+    why: 'a static site cannot have most of these problems, and is not asked about them',
+  },
+  stage: {
+    ask: 'Is this live, about to launch, or still a prototype?',
+    answer: '"stage": "pre-launch"   — prototype, pre-launch, production',
+    why: 'a prototype is not asked about backups; something about to launch is',
+  },
+  is_public: {
+    ask: 'Can anyone on the internet reach it, or is it internal only?',
+    answer: '"is_public": true',
+    why: 'an internal tool has a very different attack surface',
+  },
+  tenancy: {
+    ask: 'Do separate companies or teams share one database?',
+    answer: '"tenancy": "multi-tenant-shared-db"   — single-tenant, multi-tenant-shared-db, multi-tenant-isolated',
+    why: 'this is the setting behind "one customer can read another customer’s data"',
+  },
+
+  // --- accounts and access -------------------------------------------------
+  has_accounts: {
+    ask: 'Can people sign in?',
+    answer: '"has_accounts": true',
+    why: 'unlocks every check about logins, sessions and passwords',
+  },
+  has_roles: {
+    ask: 'Do some users have more power than others — admin, editor, viewer?',
+    answer: '"has_roles": true',
+    why: 'unlocks the checks about someone giving themselves permissions',
+  },
+  has_admin_panel: {
+    ask: 'Is there an admin area only you and your staff can reach?',
+    answer: '"has_admin_panel": true',
+    why: 'an admin page left open is the shortest path to everything',
+  },
+  has_invitations: {
+    ask: 'Can users invite other people to join them?',
+    answer: '"has_invitations": true',
+    why: 'invite links are commonly guessable or never expire',
+  },
+  stack_auth: {
+    ask: 'How do people sign in — your own code, or a service?',
+    answer: '"stack": { "auth": "supabase-auth" }   — custom, supabase-auth, clerk, auth0, nextauth, devise',
+    why: 'hand-written login code is checked far more strictly',
+  },
+
+  // --- money ---------------------------------------------------------------
+  handles_payments: {
+    ask: 'Do you take payments, and through whom?',
+    answer: '"handles_payments": "stripe"   — none, stripe, paddle, lemonsqueezy, other',
+    why: 'unlocks the checks about webhooks, refunds and money stored as decimals',
+  },
+  has_subscriptions: {
+    ask: 'Do people pay you repeatedly — a subscription?',
+    answer: '"has_subscriptions": true',
+    why: 'failed renewals and cancellations are where subscription apps leak money',
+  },
+
+  // --- AI ------------------------------------------------------------------
+  calls_llm: {
+    ask: 'Does your app call an AI model?',
+    answer: '"calls_llm": true',
+    why: 'unlocks the AI checks — runaway costs, prompt injection, model output',
+  },
+  llm_input_from_user: {
+    ask: 'Does anything a user types get sent to the AI?',
+    answer: '"llm_input_from_user": true',
+    why: 'this is the difference between a prompt you wrote and one a stranger did',
+  },
+  llm_tools_enabled: {
+    ask: 'Can the AI do things on its own — send email, call an API, change data?',
+    answer: '"llm_tools_enabled": true',
+    why: 'an AI that can only talk is a very different risk from one that can act',
+  },
+  has_rag: {
+    ask: 'Does the AI read from your own documents or database to answer?',
+    answer: '"has_rag": true',
+    why: 'documents the AI reads can carry instructions that hijack it',
+  },
+
+  // --- how it runs ---------------------------------------------------------
+  sends_email: {
+    ask: 'Does your app send email to users?',
+    answer: '"sends_email": true',
+    why: 'unlocks deliverability, unsubscribe duties and password-reset checks',
+  },
+  has_file_uploads: {
+    ask: 'Can users upload files or images?',
+    answer: '"has_file_uploads": true',
+    why: 'uploads are how a stranger gets a file onto your server',
+  },
+  has_background_jobs: {
+    ask: 'Does work happen in the background — queues, scheduled tasks?',
+    answer: '"has_background_jobs": true',
+    why: 'a job that fails silently is a job nobody knows failed',
+  },
+  has_realtime: {
+    ask: 'Is there anything live — chat, notifications, a shared cursor?',
+    answer: '"has_realtime": true',
+    why: 'live connections are authorised differently from ordinary pages',
+  },
+  has_webhooks_in: {
+    ask: 'Do other services send data INTO your app automatically?',
+    answer: '"has_webhooks_in": true',
+    why: 'an unverified webhook is an open door anyone can post through',
+  },
+  collects_analytics: {
+    ask: 'Do you track how people use the app?',
+    answer: '"collects_analytics": true',
+    why: 'tracking without consent is the most common privacy fine',
+  },
+
+  // --- the plumbing --------------------------------------------------------
+  stack_database: {
+    ask: 'What stores your data?',
+    answer: '"stack": { "database": "postgres" }   — postgres, supabase, mysql, planetscale, mongodb, sqlite, none',
+    why: 'each has its own way of leaking one customer’s rows to another',
+  },
+  stack_framework: {
+    ask: 'What is it built with?',
+    answer: '"stack": { "framework": "next" }   — next, react, vue, django, rails, express, laravel, other',
+    why: 'unlocks the checks specific to that framework’s own footguns',
+  },
+  stack_host: {
+    ask: 'Where does it run?',
+    answer: '"stack": { "host": "vercel" }   — vercel, netlify, cloudflare, railway, fly, aws, gcp, vps, other',
+    why: 'a serverless host and a rented server fail in opposite ways',
+  },
+  stack_orm: {
+    ask: 'How does your code talk to the database — a library, or hand-written SQL?',
+    answer: '"stack": { "orm": "prisma" }   — prisma, drizzle, typeorm, sequelize, activerecord, raw-sql, none',
+    why: 'hand-written SQL is checked much harder for injection',
+  },
+  has_migrations: {
+    ask: 'Do you have database migrations — versioned schema changes?',
+    answer: '"has_migrations": true',
+    why: 'a migration that cannot be undone is a deploy that cannot be undone',
+  },
+  has_ci: {
+    ask: 'Does anything run your tests automatically when you push?',
+    answer: '"has_ci": true',
+    why: 'unlocks the checks about what your pipeline does and does not catch',
+  },
+};
+
+// gate.mjs uses dotted names (stack.auth); JSON and this file use underscores
+// for the top level. One map, so neither side has to know about the other.
+const DOTTED = { stack_auth: 'stack.auth', stack_database: 'stack.database',
+                 stack_framework: 'stack.framework', stack_host: 'stack.host',
+                 stack_orm: 'stack.orm' };
+const UNDERSCORED = Object.fromEntries(Object.entries(DOTTED).map(([k, v]) => [v, k]));
+
+export const questionFor = (fact) => QUESTION[UNDERSCORED[fact] || fact] || null;
+export const factNames = () => Object.keys(QUESTION).map(k => DOTTED[k] || k);

package/src/redact.mjs

@@ -28,7 +28,12 @@ const PEM = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?
 
 // 2. Credentials embedded in a connection URL: scheme://user:pass@host.
 //    Keep the scheme and host (useful shape), mask only user:pass.
-const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+//
+//    http and ssh belong here as much as postgres does. A git remote with a
+//    token in it (https://bot:ghp_live...@github.com), an SMTP URL holding a
+//    provider key, a Grafana or Elasticsearch URL - all were uploaded intact
+//    while the privacy page promised the value never leaves the machine.
+const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb|https?|smtps?|ftps?|sftp|ssh|ldaps?|clickhouse|elasticsearch):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
 
 // 3. Provider keys by their published shape. pk_ (Stripe publishable) is left
 //    alone on purpose — it is designed to be public, and masking it was one of
@@ -54,7 +59,7 @@ const SHAPES = [
 //    and tokens that have no distinctive shape. It fires only on string
 //    literals, and holds back where the value is plainly not a secret: an env
 //    reference, a template placeholder, an interpolation, an empty string.
-const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
+const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret[_-]?key|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
 const ASSIGN = new RegExp(
   '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)(["\'`])([^"\'`\\n]{6,}?)\\2',
   'gi',

package/src/report.mjs

@@ -1,18 +1,14 @@
 import { BRAND } from './brand.mjs';
+import { questionFor } from './questions.mjs';
 
 const C = { red:'\x1b[31m', yel:'\x1b[33m', blu:'\x1b[34m', gry:'\x1b[90m',
             bold:'\x1b[1m', dim:'\x1b[2m', grn:'\x1b[32m', cyn:'\x1b[36m', off:'\x1b[0m' };
 const SEV = { critical:[C.red,'CRITICAL'], high:[C.yel,'HIGH'], medium:[C.blu,'MEDIUM'], low:[C.gry,'LOW'] };
 
-const QUESTION = {
-  business_model:  'Who is this for — consumers, businesses, a marketplace, or internal use?',
-  jurisdictions:   'Where are your users? (EU / UK / US / other — this decides which privacy rules apply)',
-  expected_scale:  'How many users do you expect — under 1k, under 100k, or more?',
-  serves_currency: 'Do you charge in more than one currency?',
-  audience_locale: 'Do you serve more than one language or region?',
-};
+// The wording lives in questions.mjs — 33 facts, not the 5 that had text.
+// A customer used to read "? llm_tools_enabled" as the last line of a scan.
 
-export function render({ repo, scanned, lead, findings, questions, shallow = [] }) {
+export function render({ repo, scanned, lead, findings, questions, shallow = [], coverage = null, stated = null }) {
   const L = [];
   const p = (s = '') => L.push(s);
   const pr = lead.profile;
@@ -28,6 +24,21 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   row('Type', pr.surface, ev('surface'));
   row('Stack', [pr.stack.framework, pr.stack.database, pr.stack.host].filter(Boolean).join(' · ') || '—');
   row('Accounts', pr.has_accounts ? 'yes' : 'no', ev('has_accounts'));
+
+  // What the user stated beats what we detected, so it must be VISIBLE. A wrong
+  // answer silently changing which checks run would be worse than no answers
+  // at all — they would never find out why something was skipped.
+  if (stated && Object.keys(stated).length) {
+    const flat = [];
+    for (const [k, v] of Object.entries(stated)) {
+      if (v && typeof v === 'object' && !Array.isArray(v))
+        for (const [k2, v2] of Object.entries(v)) flat.push(`${k}.${k2}=${v2}`);
+      else flat.push(`${k}=${Array.isArray(v) ? v.join('/') : v}`);
+    }
+    p(`  ${C.gry}${'You said'.padEnd(10)}${C.off}${flat.slice(0, 6).join('  ')}` +
+      `${flat.length > 6 ? `  ${C.dim}+${flat.length - 6} more${C.off}` : ''}` +
+      `  ${C.dim}(from launchprep.json)${C.off}`);
+  }
   if (pr.tenancy !== 'none') row('Tenancy', pr.tenancy, ev('tenancy'));
   if (pr.calls_llm) row('AI', (pr.llm_providers || []).join(', ') || 'yes', ev('calls_llm'));
   if (pr.handles_payments !== 'none') row('Payments', pr.handles_payments);
@@ -78,7 +89,16 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   // ---------- what we did not check, and why ----------
   const g = lead.gate;
   p(`\n${C.bold}Coverage${C.off}`);
-  p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  // Say what RAN, not what applies. The difference is the tier-2 rules, which
+  // need a model to read the code — counting those as "applied" reported a
+  // pass on checks nothing performed.
+  if (coverage) {
+    p(`  ${C.bold}${coverage.ran}${C.off} of ${g.total} checks ran here`);
+    if (coverage.needsDeep)
+      p(`  ${C.bold}${coverage.needsDeep}${C.off} more apply to you but need a deep scan ${C.dim}(they need a model to read the code)${C.off}`);
+  } else {
+    p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  }
   p(`  ${C.dim}${g.skipped.length} skipped — they don't fit what you built${C.off}`);
 
   const bySkipFact = {};
@@ -92,10 +112,19 @@ export function render({ repo, scanned, lead, findings, questions, shallow = []
   // ---------- the three questions ----------
   if (questions.length) {
     p(`\n${C.bold}${g.unknown.length} more checks need ${questions.length} answer${questions.length === 1 ? '' : 's'}${C.off}`);
-    for (const [factName, n] of questions)
-      p(`  ${C.cyn}?${C.off} ${QUESTION[factName] || factName}  ${C.dim}(unlocks ${n})${C.off}`);
+    for (const [factName, n] of questions) {
+      const q = questionFor(factName);
+      p(`  ${C.cyn}?${C.off} ${q ? q.ask : factName}  ${C.dim}(unlocks ${n})${C.off}`);
+      if (q) p(`    ${C.dim}${q.answer}${C.off}`);
+    }
   }
 
-  p(`\n  ${C.dim}Anything above wrong? Correct it and the checks adjust.${C.off}\n`);
+  // This used to say "Correct it and the checks adjust" with no way on earth to
+  // do so — no flag, no file, no prompt. It was the last line of every scan and
+  // it invited an action that did not exist. Now it names the file that works.
+  if (questions.length)
+    p(`\n  ${C.dim}Put those in ${C.off}launchprep.json${C.dim} at the top of your project and run again — the answers unlock the checks above.${C.off}\n`);
+  else
+    p(`\n  ${C.dim}Wrong about your app? Correct it in ${C.off}launchprep.json${C.dim} and run again.${C.off}\n`);
   return L.join('\n');
 }