launchprep 0.5.0 → 0.5.1

package/net/client.mjs

@@ -36,6 +36,13 @@ export const deepScan = ({ key, digest, profile, ruleIds, appName, idempotencyKe
     rule_ids: ruleIds,
     app_name: appName,
     idempotency_key: idempotencyKey,
+    // What the digest read and what did not fit the size cap. The model is
+    // already told what it cannot see; this is so the CUSTOMER is told too,
+    // in the report - a big repo gets its most relevant slice, and reporting
+    // that slice as "everything" would let someone believe every file was
+    // checked when it was not.
+    files_read: digest.coverage?.filesRead ?? null,
+    files_skipped: digest.coverage?.filesSkipped ?? null,
   }});
 
 export { BASE };

package/net/commands.mjs

@@ -99,6 +99,17 @@ async function deep(args) {
     console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
     process.exit(1);
   }
+  // Not an error the customer did anything to cause, and nothing was spent -
+  // say both, or a 409 reads like a failure and they wonder if they lost a scan.
+  if (r.status === 409 && r.data?.error === 'scan_in_progress') {
+    const since = r.data.startedAt ? new Date(r.data.startedAt) : null;
+    const mins  = since ? Math.max(1, Math.round((Date.now() - since.getTime()) / 60000)) : null;
+    console.error(`\n  ${C.red}You already have a scan running.${C.off}`);
+    console.error(`  ${C.d}Started ${mins ? mins + (mins === 1 ? ' minute' : ' minutes') + ' ago' : 'a moment ago'}` +
+                  `. A scan takes about four minutes; wait for it to finish and run this again.${C.off}`);
+    console.error(`  ${C.grn}No scan was used.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402 && (r.data?.error === 'attempt_ceiling' || r.data?.error === 'spend_ceiling')) {
     console.error(`\n  ${C.red}This key has run too many scans that did not finish.${C.off}`);
     console.error(`  ${C.d}${r.data.attempts} attempts against a ${r.data.limit}-scan licence. Something is going`);
@@ -150,7 +161,10 @@ async function deep(args) {
     if (r.data.refunded) {
       console.log(`  ${C.grn}This scan did not finish, so it does not count against your five.${C.off}`);
     }
-    console.log(`  ${C.d}Run it again and they usually complete.${C.off}\n`);
+    const failed = missed.filter(m => !m.declined), declined = missed.filter(m => m.declined);
+    if (failed.length)   console.log(`  ${C.d}Run it again and these usually complete.${C.off}`);
+    if (declined.length) console.log(`  ${C.d}${declined.length} ${declined.length === 1 ? 'was' : 'were'} declined by the review model for this code — a re-run will not change that.${C.off}`);
+    console.log('');
   }
 
   if (r.data.report?.url) {
@@ -158,6 +172,13 @@ async function deep(args) {
     console.log(`  ${C.o}${r.data.report.url}${C.off}`);
     console.log(`  ${C.d}dated, shareable, and it expires in ${r.data.report.expiresInDays} days${C.off}\n`);
   }
+  // A big repo gets its most security-relevant slice, not every file. Saying
+  // nothing here would let someone believe every file was checked. One line,
+  // only when something was actually left out.
+  if (digest.coverage?.filesSkipped > 0) {
+    console.log(`  ${C.d}Read the ${digest.coverage.filesRead} most security-relevant files; ` +
+                `${digest.coverage.filesSkipped} did not fit this scan's size cap and were not checked.${C.off}\n`);
+  }
   console.log(`  ${C.d}${r.data.scansRemaining} deep scan${r.data.scansRemaining === 1 ? '' : 's'} left${C.off}\n`);
 
   // --fail-on <severity>: the CI gate, same contract as the free scan. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },

package/src/check-helpers.mjs

@@ -0,0 +1,43 @@
+// The helpers every tier-1 check file used to define for itself, byte-for-byte,
+// in ten separate copies. That duplication is not harmless: it is exactly how
+// isServer drifted into three different regexes, one of them still carrying a
+// bug already fixed in another. One definition here means one behaviour
+// everywhere, and a fix lands in one place.
+//
+// Only the provably-identical helpers live here. isServer is deliberately NOT
+// among them - its three copies genuinely disagree about which directories are
+// "server", and unifying them is a behaviour change that needs its own corpus
+// pass, not a mechanical dedup.
+
+// A finding is just this shape. Named so a check reads as prose.
+export const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+// 1-based line number of a byte offset.
+export const lineOf = (text, i) => text.slice(0, i).split('\n').length;
+
+// The whole source line containing a byte offset (no trailing newline).
+export const lineAt = (t, i) => {
+  const a = t.lastIndexOf('\n', i) + 1;
+  const b = t.indexOf('\n', i);
+  return t.slice(a, b === -1 ? t.length : b);
+};
+
+// Is this path source code we should read the body of?
+export const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
+
+// The text with comments blanked to spaces (line length and offsets preserved),
+// so a pattern cannot match inside a // or /* */ or a leading-# comment. This is
+// the guard behind "judge the line, not a 200-char neighbourhood".
+export const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};

package/src/checks-ai.mjs

@@ -1,12 +1,9 @@
+import { finding, lineOf, isCode } from './check-helpers.mjs';
 // AI cost and safety. Barely covered by the corpus, which is exactly why it
 // matters: this is the family nobody else is checking.
 import { looksLikePlaceholder } from './placeholder.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, i) => text.slice(0, i).split('\n').length;
-const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
 // (^|/) not just / — a slash was REQUIRED before the word, so a project laid
 // out as api/src/... or server/src/... or backend/src/... never matched as a
 // server, and then matched as a browser because it contains /src/. Result: the

package/src/checks-auth.mjs

@@ -1,8 +1,5 @@
+import { finding, lineOf, isCode } from './check-helpers.mjs';
 // Accounts, sessions, and the secrets that protect them.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
 
 const RATE_LIMITER =
   /rate-?limit|rateLimit|Ratelimit|throttle|slowDown|@upstash\/ratelimit|express-rate-limit|limiter\.|bottleneck/i;

package/src/checks-authz.mjs

@@ -1,10 +1,8 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Authorization: "is THIS user allowed to touch THIS record?"
 // The corpus calls this the most common real-world vulnerability, and it is the
 // family most likely to find something true in a vibe-coded app.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 // Everything between a handler's opening brace and its matching close, so we can
 // ask "does this handler mention the logged-in user anywhere?"

package/src/checks-batch2.mjs

@@ -1,15 +1,10 @@
+import { finding, lineOf, lineAt } from './check-helpers.mjs';
 // The remaining critical and high tier-1 checks.
 // Lesson applied throughout: judge the line, read the value, never the name alone.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const lineAt = (t, i) => {
-  const a = t.lastIndexOf('\n', i) + 1;
-  const b = t.indexOf('\n', i);
-  return t.slice(a, b === -1 ? t.length : b);
-};
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
-const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
+// anchored (^|\/) so a server dir at the REPO ROOT (api/x.ts) matches too -
+// the same root-level miss fixed in checks-batch4/API-010. Same list, additive.
+const isServer = (p) => /(^|\/)(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
 
 export const BATCH2_CHECKS = [
 

package/src/checks-batch3.mjs

@@ -1,7 +1,5 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Remaining tier-1 checks: data, deployment, framework config, real-user readiness.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
 const isProdSettings = (p) =>
   /settings/i.test(p) && !/local|dev|development|test|example|template/i.test(p);

package/src/checks-batch4.mjs

@@ -1,18 +1,11 @@
+import { finding, lineOf, lineAt } from './check-helpers.mjs';
 // The last of the tier-1 checks.
 //
 // Discipline, same as everywhere else in this directory: read the value, not the
 // identifier. Judge the line, not a 200-character neighbourhood. Require evidence
 // that the thing is used the dangerous way before saying a word.
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const lineAt = (t, i) => {
-  const a = t.lastIndexOf('\n', i) + 1;
-  const b = t.indexOf('\n', i);
-  return t.slice(a, b === -1 ? t.length : b);
-};
 // the whole call expression starting at i, bounded so we never judge a neighbour
 const callAt = (t, i, max = 260) => {
   const open = t.indexOf('(', i);
@@ -26,7 +19,10 @@ const callAt = (t, i, max = 260) => {
 };
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
 const isServer = (p) =>
-  /\/(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
+  // anchored with (^|\/): a directory at the REPO ROOT (api/client.ts) has no
+  // leading slash, so /\/api\// missed it and API-010 skipped every root-level
+  // api/ file. Same list as before - this only adds the start-of-path case.
+  /(^|\/)(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
 
 // union of every manifest in the repo - monorepos keep the root one empty
 const depNames = (repo) => {

package/src/checks-deploy.mjs

@@ -1,26 +1,12 @@
+import { finding, lineOf, codeOnly } from './check-helpers.mjs';
 // Deployment and transport. Mechanically detectable, high volume.
 import { looksLikePlaceholder } from './placeholder.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // Comments blanked to spaces - offsets and line numbers survive, the words do
 // not. Our own server.mjs opens by explaining that it does NOT use
 // express.json(), and DATA-008 read that sentence as the call itself. Twelfth
 // time this shape has bitten: it matched a name where no code was.
-const codeOnly = (t) => {
-  let out = '', i = 0;
-  const blank = (s) => s.replace(/[^\n]/g, ' ');
-  while (i < t.length) {
-    const two = t.slice(i, i + 2);
-    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
-    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    out += t[i]; i++;
-  }
-  return out;
-};
 
 export const DEPLOY_CHECKS = [
 

package/src/checks-frameworks.mjs

@@ -1,8 +1,6 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Django and Rails. Both ship deliberately permissive defaults for local
 // development, and both document exactly which ones must change before deploying.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // a settings file that is meant for production, not somebody's laptop
 const isProdSettings = (p) =>

package/src/checks-injection.mjs

@@ -1,3 +1,4 @@
+import { finding, lineOf, codeOnly } from './check-helpers.mjs';
 // User input concatenated into a SQL query.
 //
 // This was missing from all 288 rules. A project with `${req.params.id}` dropped
@@ -18,25 +19,10 @@
 // And then the safe forms are subtracted, because every one of them would
 // otherwise fire on correct code.
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // Comments blanked to spaces; offsets and line numbers survive, the words do
 // not. A comment reading "never do `SELECT * FROM users WHERE id = ${id}`" is
 // advice against the bug, not the bug.
-const codeOnly = (t) => {
-  let out = '', i = 0;
-  const blank = (s) => s.replace(/[^\n]/g, ' ');
-  while (i < t.length) {
-    const two = t.slice(i, i + 2);
-    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
-    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    out += t[i]; i++;
-  }
-  return out;
-};
 
 // A verb and a clause. "select" alone matches a React prop, a CSS selector, a
 // variable called selectedUser and about forty other innocent things.

package/src/checks.mjs

@@ -1,3 +1,4 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Tier-1 checks: deterministic, no LLM, no network. Each returns findings with
 // a file:line so the user can go straight to it.
 import { AUTHZ_CHECKS } from './checks-authz.mjs';
@@ -11,11 +12,9 @@ import { BATCH3_CHECKS } from './checks-batch3.mjs';
 import { BATCH4_CHECKS } from './checks-batch4.mjs';
 import { scanGitHistory } from './git-history.mjs';
 import { looksLikePlaceholder } from './placeholder.mjs';
+import { makeView } from './fs-scan.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 const BASE_CHECKS = [
 
@@ -74,6 +73,18 @@ const BASE_CHECKS = [
         const full = m[1]+m[2];
         if (PUBLIC_BY_DESIGN.test(m[2]) || NOT_A_CREDENTIAL.test(m[2])) continue;
 
+        // Require EVIDENCE this is a real env var, not the NAME of one sitting
+        // inside a regex, a string list or a comment. On a real project this
+        // matched `PUBLIC_KEY` in the alternation /(...|PUBLIC_KEY|...)/ and
+        // called it an exposed secret - the recurring "name in a pattern" FP
+        // this codebase keeps relearning. Two forms count as real: an assignment
+        // (NEXT_PUBLIC_X = / :), or an env access (process.env.NEXT_PUBLIC_X).
+        const after  = f.text.slice(m.index + m[0].length, m.index + m[0].length + 24);
+        const before = f.text.slice(Math.max(0, m.index - 16), m.index);
+        const isAssignment = /^[A-Z0-9_]*\s*[:=](?!=)/.test(after);   // NAME= or NAME: (not ==)
+        const isEnvAccess  = /env\.$|env\[['\"`]?$|env\.get\(['\"`]?$/i.test(before);
+        if (!isAssignment && !isEnvAccess) continue;
+
         const certain = DEFINITELY_SECRET.test(m[2]);
         out.push(finding('SEC-004',
           certain ? 'Server secret exposed to the browser' : 'Possible secret exposed to the browser',
@@ -168,11 +179,29 @@ const BASE_CHECKS = [
   }},
 
 { id:'DEP-010', run(repo){
-    if (!repo.exists('package.json')) return [];
-    const has = ['package-lock.json','pnpm-lock.yaml','yarn.lock','bun.lockb'].some(l=>repo.exists(l));
-    return has ? [] : [finding('DEP-010','No lockfile committed','medium','package.json',1,
-      'Without a lockfile your production build can install different versions than you tested.',
-      'Commit the lockfile your package manager generates.')];
+    // "Dependencies unpinned." The no-lockfile half of this rule is DEP-011's
+    // job now (root-scoped, higher severity) - both firing on no-lockfile was a
+    // duplicate finding at two severities. This half is the one DEP-011 does
+    // NOT cover and a lockfile does NOT save you from: a spec that means
+    // "whatever is newest" no matter what - a wildcard, a dist-tag, or a
+    // git/URL target that can move under the same string. Caret and tilde
+    // ranges are the norm and a lockfile pins them, so they are not flagged -
+    // that would be noise on nearly every project.
+    const raw = repo.read('package.json');
+    if (!raw) return [];
+    let pkg; try { pkg = JSON.parse(raw); } catch { return []; }
+    const deps = { ...(pkg.dependencies||{}), ...(pkg.devDependencies||{}) };
+    const UNPINNED = /^(\*|x|latest|next|\d+\.(x|\*)|\d+\.\d+\.(x|\*))$/i;
+    const MOVING   = /^(git\+|github:|git:|https?:|file:)/i;
+    const bad = Object.entries(deps)
+      .filter(([, v]) => { const t = String(v).trim(); return UNPINNED.test(t) || MOVING.test(t); });
+    if (!bad.length) return [];
+    const names = bad.slice(0, 5).map(([n, v]) => `${n}: ${v}`).join(', ');
+    return [finding('DEP-010', 'Dependencies pinned to a moving target', 'medium', 'package.json', 1,
+      `${bad.length} dependency${bad.length === 1 ? ' resolves' : 'ies resolve'} to whatever is newest — ${names}` +
+      (bad.length > 5 ? ', and more' : '') + '. Even with a lockfile, anyone who installs without it gets ' +
+      'a different version than you tested, and the same string can mean new code tomorrow.',
+      'Pin these to a version — an exact one, or a caret range at least — so the same string always means the same code.')];
   }},
 
 { id:'API-002', run(repo,profile){
@@ -221,12 +250,16 @@ const IS_TEST = /(^|\/)(tests?|__tests__|__mocks__|spec|e2e|fixtures?|examples?)
 
 function withoutTests(repo){
   const files = repo.files.filter(f => !IS_TEST.test(f.path));
-  return { ...repo, files,
-    has:  (re) => files.some(f => re.test(f.path)),
-    find: (re) => files.filter(f => re.test(f.path)),
-    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|sql|prisma)$/) =>
-      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
-  };
+  // has/find/grep run over the tests-excluded files; exists/read/isIgnored keep
+  // delegating to the underlying repo (disk-backed on the root scan), so a check
+  // can still ask about a file that was filtered here. Built through makeView so
+  // it carries the same capability set as every other view - the previous
+  // {...repo} spread inherited those three by luck, which is the drift this
+  // consolidation removes.
+  return makeView({
+    files, root: repo.root,
+    read: repo.read, exists: repo.exists, isIgnored: repo.isIgnored,
+  });
 }
 
 // Some facts live at the repo root and nowhere else - the lockfile, the CI

package/src/detect.mjs

@@ -1,8 +1,15 @@
-// Profile detection. Every fact carries evidence and a confidence level.
-// LOW confidence never produces a `fail` — the gate turns it into a question.
+// Profile detection. Every fact carries a value and the evidence for it.
+//
+// There used to be a third field, `confidence`, and a comment promising "LOW
+// confidence never produces a fail - the gate turns it into a question". The
+// gate never read it: the mechanism was described but never wired, so the field
+// was dead data on every fact and the comment described behaviour that did not
+// exist. Removed. The confidence argument is still ACCEPTED at the ~90 call
+// sites (harmless positional documentation of how sure the detector is) but is
+// no longer stored, so nothing can come to depend on a value nothing computes.
 import { readPackageJson, allDeps, stripComments, isWorkspaceRoot } from './fs-scan.mjs';
 
-const fact = (value, confidence, evidence = []) => ({ value, confidence, evidence });
+const fact = (value, _confidence, evidence = []) => ({ value, evidence });
 const dep  = (deps, ...names) => names.find(n => deps[n] !== undefined);
 
 // ---------- stack ----------

package/src/fs-scan.mjs

@@ -105,8 +105,19 @@ export function buildIgnore(rootAbs, sources) {
   };
 }
 
-// Every .gitignore from the git root down to the scan root, plus .git/info/exclude.
-export function ignoreChain(root) {
+// Every .gitignore from the git root down to the scan root, plus
+// .git/info/exclude, plus any .gitignore found INSIDE the tree.
+//
+// The ancestors alone were not enough. A .gitignore written in a subdirectory -
+// config/.gitignore, apps/web/.gitignore - was never read, so a .env it
+// correctly excluded was reported by SEC-001 as a leaked credential. Nesting
+// one is ordinary practice and it is the natural place for it in a monorepo.
+//
+// `inner` is appended AFTER the ancestors on purpose: buildIgnore is
+// last-match-wins and scopes each rule to the directory it was written in, so
+// appending gives the deeper file precedence, which is what git does. A nested
+// `!keep.env` therefore beats a root `.env*`.
+export function ignoreChain(root, inner = []) {
   const rootAbs = resolve(root);
   const gr = gitRoot(rootAbs);
   const dirs = [];
@@ -123,11 +134,37 @@ export function ignoreChain(root) {
     const t = readAt(gr, join('.git', 'info', 'exclude'));
     if (t !== null) sources.push({ dir: gr, text: t });
   }
-  return buildIgnore(rootAbs, sources);
+  return buildIgnore(rootAbs, [...sources, ...inner]);
+}
+
+// The ONE repo-view constructor. Every "repo" object a check receives - the
+// whole-repo scan, a workspace slice, the tests-excluded view - is built here,
+// so all three expose the SAME capabilities. Three hand-rolled versions is
+// exactly how isIgnored went missing from the workspace view and SEC-001 cried
+// wolf on every monorepo. Add a capability here and it exists in every view, or
+// the omission is a one-line default rather than a silent gap.
+//
+// has/find/grep always read the `files` array. The file accessors
+// (exists/read/isIgnored) are injected because they genuinely differ: the root
+// scan answers from disk, a slice answers from its own files. Injecting them
+// keeps that difference explicit instead of accidentally absent.
+const GREP_CODE = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|sql|prisma)$/;
+export function makeView({ files, root, isIgnored, read, exists, grepDefault = GREP_CODE }) {
+  return {
+    root, files,
+    has:  (re) => files.some(f => re.test(f.path)),
+    find: (re) => files.filter(f => re.test(f.path)),
+    grep: (re, pathRe = grepDefault) =>
+      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+    exists: exists   || ((rel) => files.some(f => f.path === rel)),
+    read:   read     || ((rel) => files.find(f => f.path === rel)?.text ?? null),
+    isIgnored: isIgnored || (() => false),
+  };
 }
 
 export function scanRepo(root, { maxFiles = 6000 } = {}) {
   const files = [];
+  const nested = [];          // .gitignore files found inside the tree
   const rootAbs = resolve(root);
   const walk = (dir) => {
     if (files.length >= maxFiles) return;
@@ -135,6 +172,15 @@ export function scanRepo(root, { maxFiles = 6000 } = {}) {
     try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
     for (const e of entries) {
       if (files.length >= maxFiles) return;
+      // Read before the dotfile skip below, and deliberately NOT added to
+      // `files` - this is input to the ignore matcher, not part of the scan.
+      // The one at the scan root is already covered by the ancestor chain.
+      if (e.name === '.gitignore') {
+        if (dir !== rootAbs) {
+          try { nested.push({ dir, text: readFileSync(join(dir, e.name), 'utf8') }); } catch {}
+        }
+        continue;
+      }
       if (e.name.startsWith('.') && !e.name.startsWith('.env') && e.name !== '.github') continue;
       const full = join(dir, e.name);
 
@@ -157,17 +203,16 @@ export function scanRepo(root, { maxFiles = 6000 } = {}) {
     }
   };
   walk(root);
-  return {
-    root,
-    files,
-    has: (re) => files.some(f => re.test(f.path)),
-    find: (re) => files.filter(f => re.test(f.path)),
-    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb|sql|prisma|ya?ml)$|(^|\/)(Gemfile|manage\.py|artisan)$/) =>
-      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+  // The root scan answers exists/read from disk (so a check can ask about a file
+  // that was not walked into `files`, e.g. a large or binary one), greps a wider
+  // set of file types than a slice does, and carries the full .gitignore chain.
+  return makeView({
+    files, root,
+    grepDefault: /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb|sql|prisma|ya?ml)$|(^|\/)(Gemfile|manage\.py|artisan)$/,
     exists: (rel) => existsSync(join(root, rel)),
-    read: (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
-    isIgnored: ignoreChain(root),
-  };
+    read:   (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
+    isIgnored: ignoreChain(root, nested),
+  });
 }
 
 export function readPackageJson(repo) {

package/src/redact.mjs

@@ -28,7 +28,12 @@ const PEM = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?
 
 // 2. Credentials embedded in a connection URL: scheme://user:pass@host.
 //    Keep the scheme and host (useful shape), mask only user:pass.
-const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+//
+//    http and ssh belong here as much as postgres does. A git remote with a
+//    token in it (https://bot:ghp_live...@github.com), an SMTP URL holding a
+//    provider key, a Grafana or Elasticsearch URL - all were uploaded intact
+//    while the privacy page promised the value never leaves the machine.
+const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb|https?|smtps?|ftps?|sftp|ssh|ldaps?|clickhouse|elasticsearch):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
 
 // 3. Provider keys by their published shape. pk_ (Stripe publishable) is left
 //    alone on purpose — it is designed to be public, and masking it was one of
@@ -54,7 +59,7 @@ const SHAPES = [
 //    and tokens that have no distinctive shape. It fires only on string
 //    literals, and holds back where the value is plainly not a secret: an env
 //    reference, a template placeholder, an interpolation, an empty string.
-const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
+const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret[_-]?key|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
 const ASSIGN = new RegExp(
   '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)(["\'`])([^"\'`\\n]{6,}?)\\2',
   'gi',