launchprep 0.5.0 → 0.5.2

package/net/client.mjs

@@ -36,6 +36,13 @@ export const deepScan = ({ key, digest, profile, ruleIds, appName, idempotencyKe
     rule_ids: ruleIds,
     app_name: appName,
     idempotency_key: idempotencyKey,
+    // What the digest read and what did not fit the size cap. The model is
+    // already told what it cannot see; this is so the CUSTOMER is told too,
+    // in the report - a big repo gets its most relevant slice, and reporting
+    // that slice as "everything" would let someone believe every file was
+    // checked when it was not.
+    files_read: digest.coverage?.filesRead ?? null,
+    files_skipped: digest.coverage?.filesSkipped ?? null,
   }});
 
 export { BASE };

package/net/commands.mjs

@@ -99,6 +99,17 @@ async function deep(args) {
     console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
     process.exit(1);
   }
+  // Not an error the customer did anything to cause, and nothing was spent -
+  // say both, or a 409 reads like a failure and they wonder if they lost a scan.
+  if (r.status === 409 && r.data?.error === 'scan_in_progress') {
+    const since = r.data.startedAt ? new Date(r.data.startedAt) : null;
+    const mins  = since ? Math.max(1, Math.round((Date.now() - since.getTime()) / 60000)) : null;
+    console.error(`\n  ${C.red}You already have a scan running.${C.off}`);
+    console.error(`  ${C.d}Started ${mins ? mins + (mins === 1 ? ' minute' : ' minutes') + ' ago' : 'a moment ago'}` +
+                  `. A scan takes about four minutes; wait for it to finish and run this again.${C.off}`);
+    console.error(`  ${C.grn}No scan was used.${C.off}\n`);
+    process.exit(1);
+  }
   if (r.status === 402 && (r.data?.error === 'attempt_ceiling' || r.data?.error === 'spend_ceiling')) {
     console.error(`\n  ${C.red}This key has run too many scans that did not finish.${C.off}`);
     console.error(`  ${C.d}${r.data.attempts} attempts against a ${r.data.limit}-scan licence. Something is going`);
@@ -150,7 +161,10 @@ async function deep(args) {
     if (r.data.refunded) {
       console.log(`  ${C.grn}This scan did not finish, so it does not count against your five.${C.off}`);
     }
-    console.log(`  ${C.d}Run it again and they usually complete.${C.off}\n`);
+    const failed = missed.filter(m => !m.declined), declined = missed.filter(m => m.declined);
+    if (failed.length)   console.log(`  ${C.d}Run it again and these usually complete.${C.off}`);
+    if (declined.length) console.log(`  ${C.d}${declined.length} ${declined.length === 1 ? 'was' : 'were'} declined by the review model for this code — a re-run will not change that.${C.off}`);
+    console.log('');
   }
 
   if (r.data.report?.url) {
@@ -158,6 +172,13 @@ async function deep(args) {
     console.log(`  ${C.o}${r.data.report.url}${C.off}`);
     console.log(`  ${C.d}dated, shareable, and it expires in ${r.data.report.expiresInDays} days${C.off}\n`);
   }
+  // A big repo gets its most security-relevant slice, not every file. Saying
+  // nothing here would let someone believe every file was checked. One line,
+  // only when something was actually left out.
+  if (digest.coverage?.filesSkipped > 0) {
+    console.log(`  ${C.d}Read the ${digest.coverage.filesRead} most security-relevant files; ` +
+                `${digest.coverage.filesSkipped} did not fit this scan's size cap and were not checked.${C.off}\n`);
+  }
   console.log(`  ${C.d}${r.data.scansRemaining} deep scan${r.data.scansRemaining === 1 ? '' : 's'} left${C.off}\n`);
 
   // --fail-on <severity>: the CI gate, same contract as the free scan. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Launch readiness checker. Reads your code and tells you what will break before your users find out.",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   "scripts": {
     "verify": "node scripts/verify-readonly.mjs",
     "pretest": "node scripts/verify-readonly.mjs",
-    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs",
+    "test": "node test/run.mjs && node test/gate.mjs && node test/redact.mjs && node test/git-history.mjs && node test/no-false-alarms.mjs && node test/answers.mjs && node test/standards.mjs && node test/interactive.mjs",
     "prepack": "node scripts/prepare-publish.mjs",
     "postpack": "node scripts/restore-after-publish.mjs"
   },

package/src/check-helpers.mjs

@@ -0,0 +1,43 @@
+// The helpers every tier-1 check file used to define for itself, byte-for-byte,
+// in ten separate copies. That duplication is not harmless: it is exactly how
+// isServer drifted into three different regexes, one of them still carrying a
+// bug already fixed in another. One definition here means one behaviour
+// everywhere, and a fix lands in one place.
+//
+// Only the provably-identical helpers live here. isServer is deliberately NOT
+// among them - its three copies genuinely disagree about which directories are
+// "server", and unifying them is a behaviour change that needs its own corpus
+// pass, not a mechanical dedup.
+
+// A finding is just this shape. Named so a check reads as prose.
+export const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+// 1-based line number of a byte offset.
+export const lineOf = (text, i) => text.slice(0, i).split('\n').length;
+
+// The whole source line containing a byte offset (no trailing newline).
+export const lineAt = (t, i) => {
+  const a = t.lastIndexOf('\n', i) + 1;
+  const b = t.indexOf('\n', i);
+  return t.slice(a, b === -1 ? t.length : b);
+};
+
+// Is this path source code we should read the body of?
+export const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
+
+// The text with comments blanked to spaces (line length and offsets preserved),
+// so a pattern cannot match inside a // or /* */ or a leading-# comment. This is
+// the guard behind "judge the line, not a 200-char neighbourhood".
+export const codeOnly = (t) => {
+  let out = '', i = 0;
+  const blank = (s) => s.replace(/[^\n]/g, ' ');
+  while (i < t.length) {
+    const two = t.slice(i, i + 2);
+    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
+    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
+    out += t[i]; i++;
+  }
+  return out;
+};

package/src/checks-ai.mjs

@@ -1,12 +1,9 @@
+import { finding, lineOf, isCode } from './check-helpers.mjs';
 // AI cost and safety. Barely covered by the corpus, which is exactly why it
 // matters: this is the family nobody else is checking.
 import { looksLikePlaceholder } from './placeholder.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, i) => text.slice(0, i).split('\n').length;
-const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
 // (^|/) not just / — a slash was REQUIRED before the word, so a project laid
 // out as api/src/... or server/src/... or backend/src/... never matched as a
 // server, and then matched as a browser because it contains /src/. Result: the

package/src/checks-auth.mjs

@@ -1,8 +1,5 @@
+import { finding, lineOf, isCode } from './check-helpers.mjs';
 // Accounts, sessions, and the secrets that protect them.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const isCode = (p) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(p);
 
 const RATE_LIMITER =
   /rate-?limit|rateLimit|Ratelimit|throttle|slowDown|@upstash\/ratelimit|express-rate-limit|limiter\.|bottleneck/i;
@@ -118,11 +115,25 @@ export const AUTH_CHECKS = [
     const out = [];
     for (const f of repo.files) {
       if (!f.text || !isCode(f.path)) continue;
-      const re = /createHash\s*\(\s*['"](md5|sha1|sha256|sha512)['"]\)/g;
+      const re = /createHash\s*\(\s*['"](md5|sha1|sha256|sha512)['"]\)\s*\.update\s*\(\s*([A-Za-z0-9_$.]+)?/g;
       let m;
       while ((m = re.exec(f.text))) {
-        const around = f.text.slice(Math.max(0, m.index - 400), m.index + 400);
-        if (!/password|passwd|\bpwd\b|credential/i.test(around)) continue;
+        // Judge what is being HASHED, not a 400-char neighbourhood. On real
+        // code this fired CRITICAL on `hashToken(raw){ createHash('sha256')
+        // .update(raw) }` because the word "password" appeared elsewhere in the
+        // file (a password-policy import). sha256 on a high-entropy token - a
+        // reset token, a session token, a CSRF value - is correct; on a user's
+        // password it is the vulnerability. The thing being hashed decides.
+        const arg = m[2] || '';
+        const TOKEN = /token|csrf|nonce|otp|session|reset|verif|magic|digest|\braw\b|hmac|signature|fingerprint|etag|checksum|api[_-]?key/i;
+        const PASS  = /password|passwd|\bpwd\b|\bpass\b/i;
+        if (TOKEN.test(arg)) continue;                    // hashing a token, not a password
+        const ctx = f.text.slice(Math.max(0, m.index - 200), m.index + 80);
+        const ctxToken = /token|csrf|nonce|\botp\b|session|reset|verif|magic|fingerprint/i.test(ctx);
+        const ctxPass  = /password|passwd|\bpwd\b/i.test(ctx);
+        // fire only when a password is what is hashed here: the argument names
+        // it, or the immediate surroundings do and are not about a token.
+        if (!(PASS.test(arg) || (ctxPass && !ctxToken))) continue;
         out.push(finding('AUTH-008', `Passwords hashed with ${m[1]}`, 'critical',
           f.path, lineOf(f.text, m.index),
           `${m[1]} is built to be fast, which is exactly wrong for passwords — a modern GPU tries billions of guesses per second. If your database leaks, the passwords are recoverable.`,

package/src/checks-authz.mjs

@@ -1,10 +1,8 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Authorization: "is THIS user allowed to touch THIS record?"
 // The corpus calls this the most common real-world vulnerability, and it is the
 // family most likely to find something true in a vibe-coded app.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 // Everything between a handler's opening brace and its matching close, so we can
 // ask "does this handler mention the logged-in user anywhere?"

package/src/checks-batch2.mjs

@@ -1,15 +1,10 @@
+import { finding, lineOf, lineAt } from './check-helpers.mjs';
 // The remaining critical and high tier-1 checks.
 // Lesson applied throughout: judge the line, read the value, never the name alone.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const lineAt = (t, i) => {
-  const a = t.lastIndexOf('\n', i) + 1;
-  const b = t.indexOf('\n', i);
-  return t.slice(a, b === -1 ? t.length : b);
-};
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
-const isServer = (p) => /\/(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
+// anchored (^|\/) so a server dir at the REPO ROOT (api/x.ts) matches too -
+// the same root-level miss fixed in checks-batch4/API-010. Same list, additive.
+const isServer = (p) => /(^|\/)(api|routes?|server|actions?|controllers?|handlers?)\//.test(p);
 
 export const BATCH2_CHECKS = [
 

package/src/checks-batch3.mjs

@@ -1,7 +1,5 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Remaining tier-1 checks: data, deployment, framework config, real-user readiness.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
 const isProdSettings = (p) =>
   /settings/i.test(p) && !/local|dev|development|test|example|template/i.test(p);

package/src/checks-batch4.mjs

@@ -1,18 +1,11 @@
+import { finding, lineOf, lineAt } from './check-helpers.mjs';
 // The last of the tier-1 checks.
 //
 // Discipline, same as everywhere else in this directory: read the value, not the
 // identifier. Judge the line, not a 200-character neighbourhood. Require evidence
 // that the thing is used the dangerous way before saying a word.
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
-const lineAt = (t, i) => {
-  const a = t.lastIndexOf('\n', i) + 1;
-  const b = t.indexOf('\n', i);
-  return t.slice(a, b === -1 ? t.length : b);
-};
 // the whole call expression starting at i, bounded so we never judge a neighbour
 const callAt = (t, i, max = 260) => {
   const open = t.indexOf('(', i);
@@ -26,7 +19,10 @@ const callAt = (t, i, max = 260) => {
 };
 const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
 const isServer = (p) =>
-  /\/(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
+  // anchored with (^|\/): a directory at the REPO ROOT (api/client.ts) has no
+  // leading slash, so /\/api\// missed it and API-010 skipped every root-level
+  // api/ file. Same list as before - this only adds the start-of-path case.
+  /(^|\/)(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
 
 // union of every manifest in the repo - monorepos keep the root one empty
 const depNames = (repo) => {

package/src/checks-deploy.mjs

@@ -1,26 +1,12 @@
+import { finding, lineOf, codeOnly } from './check-helpers.mjs';
 // Deployment and transport. Mechanically detectable, high volume.
 import { looksLikePlaceholder } from './placeholder.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // Comments blanked to spaces - offsets and line numbers survive, the words do
 // not. Our own server.mjs opens by explaining that it does NOT use
 // express.json(), and DATA-008 read that sentence as the call itself. Twelfth
 // time this shape has bitten: it matched a name where no code was.
-const codeOnly = (t) => {
-  let out = '', i = 0;
-  const blank = (s) => s.replace(/[^\n]/g, ' ');
-  while (i < t.length) {
-    const two = t.slice(i, i + 2);
-    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
-    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    out += t[i]; i++;
-  }
-  return out;
-};
 
 export const DEPLOY_CHECKS = [
 

package/src/checks-frameworks.mjs

@@ -1,8 +1,6 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Django and Rails. Both ship deliberately permissive defaults for local
 // development, and both document exactly which ones must change before deploying.
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // a settings file that is meant for production, not somebody's laptop
 const isProdSettings = (p) =>

package/src/checks-injection.mjs

@@ -1,3 +1,4 @@
+import { finding, lineOf, codeOnly } from './check-helpers.mjs';
 // User input concatenated into a SQL query.
 //
 // This was missing from all 288 rules. A project with `${req.params.id}` dropped
@@ -18,25 +19,10 @@
 // And then the safe forms are subtracted, because every one of them would
 // otherwise fire on correct code.
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
-const lineOf = (t, i) => t.slice(0, i).split('\n').length;
 
 // Comments blanked to spaces; offsets and line numbers survive, the words do
 // not. A comment reading "never do `SELECT * FROM users WHERE id = ${id}`" is
 // advice against the bug, not the bug.
-const codeOnly = (t) => {
-  let out = '', i = 0;
-  const blank = (s) => s.replace(/[^\n]/g, ' ');
-  while (i < t.length) {
-    const two = t.slice(i, i + 2);
-    if (two === '//') { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    if (two === '/*') { const e = t.indexOf('*/', i + 2); const j = e === -1 ? t.length : e + 2; out += blank(t.slice(i, j)); i = j; continue; }
-    if (t[i] === '#' && /(^|\n)[ \t]*$/.test(out.slice(-40))) { const e = t.indexOf('\n', i); const j = e === -1 ? t.length : e; out += blank(t.slice(i, j)); i = j; continue; }
-    out += t[i]; i++;
-  }
-  return out;
-};
 
 // A verb and a clause. "select" alone matches a React prop, a CSS selector, a
 // variable called selectedUser and about forty other innocent things.

package/src/checks.mjs

@@ -1,3 +1,4 @@
+import { finding, lineOf } from './check-helpers.mjs';
 // Tier-1 checks: deterministic, no LLM, no network. Each returns findings with
 // a file:line so the user can go straight to it.
 import { AUTHZ_CHECKS } from './checks-authz.mjs';
@@ -11,11 +12,9 @@ import { BATCH3_CHECKS } from './checks-batch3.mjs';
 import { BATCH4_CHECKS } from './checks-batch4.mjs';
 import { scanGitHistory } from './git-history.mjs';
 import { looksLikePlaceholder } from './placeholder.mjs';
+import { makeView } from './fs-scan.mjs';
 
-const finding = (id, title, severity, file, line, detail, fix) =>
-  ({ id, title, severity, file, line, detail, fix });
 
-const lineOf = (text, index) => text.slice(0, index).split('\n').length;
 
 const BASE_CHECKS = [
 
@@ -74,6 +73,18 @@ const BASE_CHECKS = [
         const full = m[1]+m[2];
         if (PUBLIC_BY_DESIGN.test(m[2]) || NOT_A_CREDENTIAL.test(m[2])) continue;
 
+        // Require EVIDENCE this is a real env var, not the NAME of one sitting
+        // inside a regex, a string list or a comment. On a real project this
+        // matched `PUBLIC_KEY` in the alternation /(...|PUBLIC_KEY|...)/ and
+        // called it an exposed secret - the recurring "name in a pattern" FP
+        // this codebase keeps relearning. Two forms count as real: an assignment
+        // (NEXT_PUBLIC_X = / :), or an env access (process.env.NEXT_PUBLIC_X).
+        const after  = f.text.slice(m.index + m[0].length, m.index + m[0].length + 24);
+        const before = f.text.slice(Math.max(0, m.index - 16), m.index);
+        const isAssignment = /^[A-Z0-9_]*\s*[:=](?!=)/.test(after);   // NAME= or NAME: (not ==)
+        const isEnvAccess  = /env\.$|env\[['\"`]?$|env\.get\(['\"`]?$/i.test(before);
+        if (!isAssignment && !isEnvAccess) continue;
+
         const certain = DEFINITELY_SECRET.test(m[2]);
         out.push(finding('SEC-004',
           certain ? 'Server secret exposed to the browser' : 'Possible secret exposed to the browser',
@@ -168,11 +179,29 @@ const BASE_CHECKS = [
   }},
 
 { id:'DEP-010', run(repo){
-    if (!repo.exists('package.json')) return [];
-    const has = ['package-lock.json','pnpm-lock.yaml','yarn.lock','bun.lockb'].some(l=>repo.exists(l));
-    return has ? [] : [finding('DEP-010','No lockfile committed','medium','package.json',1,
-      'Without a lockfile your production build can install different versions than you tested.',
-      'Commit the lockfile your package manager generates.')];
+    // "Dependencies unpinned." The no-lockfile half of this rule is DEP-011's
+    // job now (root-scoped, higher severity) - both firing on no-lockfile was a
+    // duplicate finding at two severities. This half is the one DEP-011 does
+    // NOT cover and a lockfile does NOT save you from: a spec that means
+    // "whatever is newest" no matter what - a wildcard, a dist-tag, or a
+    // git/URL target that can move under the same string. Caret and tilde
+    // ranges are the norm and a lockfile pins them, so they are not flagged -
+    // that would be noise on nearly every project.
+    const raw = repo.read('package.json');
+    if (!raw) return [];
+    let pkg; try { pkg = JSON.parse(raw); } catch { return []; }
+    const deps = { ...(pkg.dependencies||{}), ...(pkg.devDependencies||{}) };
+    const UNPINNED = /^(\*|x|latest|next|\d+\.(x|\*)|\d+\.\d+\.(x|\*))$/i;
+    const MOVING   = /^(git\+|github:|git:|https?:|file:)/i;
+    const bad = Object.entries(deps)
+      .filter(([, v]) => { const t = String(v).trim(); return UNPINNED.test(t) || MOVING.test(t); });
+    if (!bad.length) return [];
+    const names = bad.slice(0, 5).map(([n, v]) => `${n}: ${v}`).join(', ');
+    return [finding('DEP-010', 'Dependencies pinned to a moving target', 'medium', 'package.json', 1,
+      `${bad.length} dependency${bad.length === 1 ? ' resolves' : 'ies resolve'} to whatever is newest — ${names}` +
+      (bad.length > 5 ? ', and more' : '') + '. Even with a lockfile, anyone who installs without it gets ' +
+      'a different version than you tested, and the same string can mean new code tomorrow.',
+      'Pin these to a version — an exact one, or a caret range at least — so the same string always means the same code.')];
   }},
 
 { id:'API-002', run(repo,profile){
@@ -221,12 +250,16 @@ const IS_TEST = /(^|\/)(tests?|__tests__|__mocks__|spec|e2e|fixtures?|examples?)
 
 function withoutTests(repo){
   const files = repo.files.filter(f => !IS_TEST.test(f.path));
-  return { ...repo, files,
-    has:  (re) => files.some(f => re.test(f.path)),
-    find: (re) => files.filter(f => re.test(f.path)),
-    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|sql|prisma)$/) =>
-      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
-  };
+  // has/find/grep run over the tests-excluded files; exists/read/isIgnored keep
+  // delegating to the underlying repo (disk-backed on the root scan), so a check
+  // can still ask about a file that was filtered here. Built through makeView so
+  // it carries the same capability set as every other view - the previous
+  // {...repo} spread inherited those three by luck, which is the drift this
+  // consolidation removes.
+  return makeView({
+    files, root: repo.root,
+    read: repo.read, exists: repo.exists, isIgnored: repo.isIgnored,
+  });
 }
 
 // Some facts live at the repo root and nowhere else - the lockfile, the CI

package/src/detect.mjs

@@ -1,8 +1,15 @@
-// Profile detection. Every fact carries evidence and a confidence level.
-// LOW confidence never produces a `fail` — the gate turns it into a question.
+// Profile detection. Every fact carries a value and the evidence for it.
+//
+// There used to be a third field, `confidence`, and a comment promising "LOW
+// confidence never produces a fail - the gate turns it into a question". The
+// gate never read it: the mechanism was described but never wired, so the field
+// was dead data on every fact and the comment described behaviour that did not
+// exist. Removed. The confidence argument is still ACCEPTED at the ~90 call
+// sites (harmless positional documentation of how sure the detector is) but is
+// no longer stored, so nothing can come to depend on a value nothing computes.
 import { readPackageJson, allDeps, stripComments, isWorkspaceRoot } from './fs-scan.mjs';
 
-const fact = (value, confidence, evidence = []) => ({ value, confidence, evidence });
+const fact = (value, _confidence, evidence = []) => ({ value, evidence });
 const dep  = (deps, ...names) => names.find(n => deps[n] !== undefined);
 
 // ---------- stack ----------

package/src/fs-scan.mjs

@@ -105,8 +105,19 @@ export function buildIgnore(rootAbs, sources) {
   };
 }
 
-// Every .gitignore from the git root down to the scan root, plus .git/info/exclude.
-export function ignoreChain(root) {
+// Every .gitignore from the git root down to the scan root, plus
+// .git/info/exclude, plus any .gitignore found INSIDE the tree.
+//
+// The ancestors alone were not enough. A .gitignore written in a subdirectory -
+// config/.gitignore, apps/web/.gitignore - was never read, so a .env it
+// correctly excluded was reported by SEC-001 as a leaked credential. Nesting
+// one is ordinary practice and it is the natural place for it in a monorepo.
+//
+// `inner` is appended AFTER the ancestors on purpose: buildIgnore is
+// last-match-wins and scopes each rule to the directory it was written in, so
+// appending gives the deeper file precedence, which is what git does. A nested
+// `!keep.env` therefore beats a root `.env*`.
+export function ignoreChain(root, inner = []) {
   const rootAbs = resolve(root);
   const gr = gitRoot(rootAbs);
   const dirs = [];
@@ -123,11 +134,37 @@ export function ignoreChain(root) {
     const t = readAt(gr, join('.git', 'info', 'exclude'));
     if (t !== null) sources.push({ dir: gr, text: t });
   }
-  return buildIgnore(rootAbs, sources);
+  return buildIgnore(rootAbs, [...sources, ...inner]);
+}
+
+// The ONE repo-view constructor. Every "repo" object a check receives - the
+// whole-repo scan, a workspace slice, the tests-excluded view - is built here,
+// so all three expose the SAME capabilities. Three hand-rolled versions is
+// exactly how isIgnored went missing from the workspace view and SEC-001 cried
+// wolf on every monorepo. Add a capability here and it exists in every view, or
+// the omission is a one-line default rather than a silent gap.
+//
+// has/find/grep always read the `files` array. The file accessors
+// (exists/read/isIgnored) are injected because they genuinely differ: the root
+// scan answers from disk, a slice answers from its own files. Injecting them
+// keeps that difference explicit instead of accidentally absent.
+const GREP_CODE = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|sql|prisma)$/;
+export function makeView({ files, root, isIgnored, read, exists, grepDefault = GREP_CODE }) {
+  return {
+    root, files,
+    has:  (re) => files.some(f => re.test(f.path)),
+    find: (re) => files.filter(f => re.test(f.path)),
+    grep: (re, pathRe = grepDefault) =>
+      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+    exists: exists   || ((rel) => files.some(f => f.path === rel)),
+    read:   read     || ((rel) => files.find(f => f.path === rel)?.text ?? null),
+    isIgnored: isIgnored || (() => false),
+  };
 }
 
 export function scanRepo(root, { maxFiles = 6000 } = {}) {
   const files = [];
+  const nested = [];          // .gitignore files found inside the tree
   const rootAbs = resolve(root);
   const walk = (dir) => {
     if (files.length >= maxFiles) return;
@@ -135,6 +172,15 @@ export function scanRepo(root, { maxFiles = 6000 } = {}) {
     try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
     for (const e of entries) {
       if (files.length >= maxFiles) return;
+      // Read before the dotfile skip below, and deliberately NOT added to
+      // `files` - this is input to the ignore matcher, not part of the scan.
+      // The one at the scan root is already covered by the ancestor chain.
+      if (e.name === '.gitignore') {
+        if (dir !== rootAbs) {
+          try { nested.push({ dir, text: readFileSync(join(dir, e.name), 'utf8') }); } catch {}
+        }
+        continue;
+      }
       if (e.name.startsWith('.') && !e.name.startsWith('.env') && e.name !== '.github') continue;
       const full = join(dir, e.name);
 
@@ -157,17 +203,16 @@ export function scanRepo(root, { maxFiles = 6000 } = {}) {
     }
   };
   walk(root);
-  return {
-    root,
-    files,
-    has: (re) => files.some(f => re.test(f.path)),
-    find: (re) => files.filter(f => re.test(f.path)),
-    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb|sql|prisma|ya?ml)$|(^|\/)(Gemfile|manage\.py|artisan)$/) =>
-      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+  // The root scan answers exists/read from disk (so a check can ask about a file
+  // that was not walked into `files`, e.g. a large or binary one), greps a wider
+  // set of file types than a slice does, and carries the full .gitignore chain.
+  return makeView({
+    files, root,
+    grepDefault: /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb|sql|prisma|ya?ml)$|(^|\/)(Gemfile|manage\.py|artisan)$/,
     exists: (rel) => existsSync(join(root, rel)),
-    read: (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
-    isIgnored: ignoreChain(root),
-  };
+    read:   (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
+    isIgnored: ignoreChain(root, nested),
+  });
 }
 
 export function readPackageJson(repo) {

package/src/index.mjs

@@ -5,11 +5,17 @@ import { detectProfile, toGateProfile } from './detect.mjs';
 import { gate, missingFacts } from './gate.mjs';
 import { runChecks, runRootChecks, CHECKS } from './checks.mjs';
 import { render } from './report.mjs';
+import { askQuestions, confirm } from './interactive.mjs';
+import { questionFor } from './questions.mjs';
 import { existsSync, statSync } from 'node:fs';
 
 const args = process.argv.slice(2);
 const target = args.find(a => !a.startsWith('-')) || process.cwd();
 const asJson = args.includes('--json');
+// Opt out of the terminal Q&A: --yes (take defaults, ask nothing) or the
+// explicit --no-interactive. It is also skipped automatically when there is no
+// TTY, so a pipe or a CI job never blocks waiting on a keypress.
+const noInteractive = args.includes('--yes') || args.includes('--no-interactive');
 
 // --fail-on <severity>: the CI gate. Findings at or above the threshold turn
 // the exit code to 1 so a pipeline can stop the deploy. Opt-in on purpose —
@@ -45,12 +51,10 @@ const packages = splitWorkspaces(repo);
 //
 // The scanner works most things out from the code, but some facts are simply
 // not in the code — where the users live, whether the AI is allowed to act,
-// how many people are expected. Those checks were skipped and the report said
-// "Correct it and the checks adjust", which was false: there was no way to
-// correct anything. This is that way.
-//
-// Reading a file the user wrote is still read-only. Nothing is written.
-const stated = (() => {
+// how many people are expected. Those come either from a launchprep.json the
+// user wrote, or from the terminal Q&A below. Reading a file the user wrote is
+// still read-only, and the Q&A only reads the keyboard: nothing is written.
+const fileStated = (() => {
   const raw = repo.read('launchprep.json');
   if (raw === null) return null;
   try {
@@ -67,7 +71,7 @@ const stated = (() => {
 
 // Merge one level deep so { "stack": { "auth": "clerk" } } overrides only auth
 // and leaves the detected framework and database alone.
-const applyStated = (profile) => {
+const applyStated = (profile, stated) => {
   if (!stated) return profile;
   const out = { ...profile };
   for (const [k, v] of Object.entries(stated)) {
@@ -78,77 +82,137 @@ const applyStated = (profile) => {
   return out;
 };
 
-// Profile and gate every app in the repo. Libraries are profiled too - they
-// simply match very few rules, which is the correct outcome, not a bug.
-const scanned = packages.map(w => {
-  const full = detectProfile(w.view, { root: repo });
-  const profile = applyStated(toGateProfile(full));
-  const g = gate(profile);
-  const applicableIds = new Set(g.evaluated.map(r => r.id));
-  const findings = runChecks(w.view, profile, applicableIds)
-    .map(f => ({ ...f, file: w.prefix ? `${w.prefix}/${f.file}` : f.file }));
-  return { name: w.name, full, profile, gate: g, findings };
-});
-
-// The app most representative of this repo leads the report.
-const apps = scanned.filter(s => s.profile.surface !== 'library');
-const lead = apps.sort((a, b) => b.gate.evaluated.length - a.gate.evaluated.length)[0] || scanned[0];
-
-// Root-scoped checks see the whole repo, once, regardless of how many
-// workspaces it contains. Gated by the lead app's profile.
-const rootIds = new Set(lead.gate.evaluated.map(r => r.id));
-const rootFindings = runRootChecks(repo, lead.profile, rootIds);
-
-const allFindings = [...scanned.flatMap(s => s.findings), ...rootFindings];
-const seen = new Set();
-// Each workspace sorts its own findings, but concatenating several workspaces
-// and the root-scoped checks destroys that order - a monorepo would show a LOW
-// from apps/web above a CRITICAL from apps/api. Sort once, at the end.
 const RANK = { critical: 0, high: 1, medium: 2, low: 3 };
-const findings = allFindings
-  .filter(f => {
-    const k = `${f.id}:${f.file}:${f.line}`;
-    if (seen.has(k)) return false;
-    seen.add(k); return true;
-  })
-  .sort((a, b) => RANK[a.severity] - RANK[b.severity]);
-
-// Eleven tier-2 rules have a cheap static approximation that ships free. When
-// one of those finds nothing that is NOT a pass - a pattern cannot see an
-// ownership check that lives in middleware. Reporting it as clean would tell
-// someone they are safe when the check simply could not look. Say so instead.
-const firedIds = new Set(findings.map(f => f.id));
-const shallow = lead.gate.evaluated
-  .filter(r => r.has_static_approximation && !firedIds.has(r.id));
-
-const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
-
-// "51 checks apply to this app" counted 17 that nothing examined — tier-2 rules
-// that need the deep scan. Counting them as applying is a silent pass on a
-// third of the headline number, which is the one thing this scanner must never
-// do. It also threw away the sentence that sells the paid tier: those 17 are
-// not a gap, they are the product.
 const implemented = new Set(CHECKS.map(c => c.id));
-const coverage = {
-  ran:       lead.gate.evaluated.filter(r => implemented.has(r.id)).length,
-  needsDeep: lead.gate.evaluated.filter(r => !implemented.has(r.id)).length,
-};
+const keyOf = (f) => `${f.id}:${f.file}:${f.line}`;
+
+// One scan pass, given whatever the user has stated so far. Called once for the
+// initial report and again after the terminal Q&A, so the answers can unlock
+// more checks without asking the user to touch a file.
+function analyze(stated) {
+  // Profile and gate every app in the repo. Libraries are profiled too - they
+  // simply match very few rules, which is the correct outcome, not a bug.
+  const scanned = packages.map(w => {
+    const full = detectProfile(w.view, { root: repo });
+    const profile = applyStated(toGateProfile(full), stated);
+    const g = gate(profile);
+    const applicableIds = new Set(g.evaluated.map(r => r.id));
+    const findings = runChecks(w.view, profile, applicableIds)
+      .map(f => ({ ...f, file: w.prefix ? `${w.prefix}/${f.file}` : f.file }));
+    return { name: w.name, full, profile, gate: g, findings };
+  });
+
+  // The app most representative of this repo leads the report.
+  const apps = scanned.filter(s => s.profile.surface !== 'library');
+  const lead = apps.sort((a, b) => b.gate.evaluated.length - a.gate.evaluated.length)[0] || scanned[0];
+
+  // Root-scoped checks see the whole repo, once, regardless of how many
+  // workspaces it contains. Gated by the lead app's profile.
+  const rootIds = new Set(lead.gate.evaluated.map(r => r.id));
+  const rootFindings = runRootChecks(repo, lead.profile, rootIds);
+
+  const allFindings = [...scanned.flatMap(s => s.findings), ...rootFindings];
+  const seen = new Set();
+  // Concatenating several workspaces and the root-scoped checks destroys each
+  // one's own order - a monorepo would show a LOW from apps/web above a
+  // CRITICAL from apps/api. Sort once, at the end.
+  const findings = allFindings
+    .filter(f => { const k = keyOf(f); if (seen.has(k)) return false; seen.add(k); return true; })
+    .sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+
+  // Eleven tier-2 rules have a cheap static approximation that ships free. When
+  // one of those finds nothing that is NOT a pass - a pattern cannot see an
+  // ownership check that lives in middleware. Reporting it as clean would tell
+  // someone they are safe when the check simply could not look. Say so instead.
+  const firedIds = new Set(findings.map(f => f.id));
+  const shallow = lead.gate.evaluated.filter(r => r.has_static_approximation && !firedIds.has(r.id));
+
+  const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
+
+  // "51 checks apply" counted tier-2 rules that nothing examined - a silent pass
+  // on a third of the headline number. Split them: what actually ran, and what
+  // still needs the deep scan (which is the product, not a gap).
+  const coverage = {
+    ran:       lead.gate.evaluated.filter(r => implemented.has(r.id)).length,
+    needsDeep: lead.gate.evaluated.filter(r => !implemented.has(r.id)).length,
+  };
+
+  return { scanned, lead, findings, shallow, questions, coverage };
+}
+
+let stated = fileStated;
+let r = analyze(stated);
 
 if (asJson) {
   console.log(JSON.stringify({
-    packages: scanned.map(s => ({
+    packages: r.scanned.map(s => ({
       name: s.name, profile: s.profile,
       evaluated: s.gate.evaluated.length, skipped: s.gate.skipped.length, unknown: s.gate.unknown.length,
     })),
-    findings, questions, coverage, stated,
-    shallow: shallow.map(r => ({ id: r.id, title: r.title, severity: r.severity })),
+    findings: r.findings, questions: r.questions, coverage: r.coverage, stated,
+    shallow: r.shallow.map(s => ({ id: s.id, title: s.title, severity: s.severity })),
   }, null, 2));
 } else {
-  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow, coverage, stated }));
+  process.stdout.write(render({ repo: target, ...r, stated }));
+
+  // The Q&A. Only in a real terminal, only when there is something to unlock,
+  // and never when the caller opted out - so a pipe, --json or a CI job is
+  // untouched. Answers are held in memory and merged; no file is written.
+  if (!noInteractive && process.stdin.isTTY && process.stdout.isTTY && r.questions.length) {
+    const unlocks = r.questions.reduce((n, [, c]) => n + c, 0);
+    const yes = await confirm(
+      `\n  \x1b[36mAnswer ${r.questions.length} quick question${r.questions.length === 1 ? '' : 's'}` +
+      ` to unlock up to ${unlocks} more checks?\x1b[0m \x1b[2m[Y/n]\x1b[0m `);
+    if (yes) {
+      const answers = await askQuestions(r.questions.map(([fact]) => fact));
+      if (Object.keys(answers).length) {
+        const before = new Set(r.findings.map(keyOf));
+        const ranBefore = r.coverage.ran;
+        stated = { ...(fileStated || {}), ...answers };
+        r = analyze(stated);
+        const fresh = r.findings.filter(f => !before.has(keyOf(f)));
+        printDelta(fresh, r.coverage.ran - ranBefore);
+      } else {
+        process.stdout.write(`\n  \x1b[2mNothing answered — the report above is unchanged.\x1b[0m\n\n`);
+      }
+    }
+  }
 }
 
-// The gate, after the full report has printed: the human still sees
-// everything, and the pipeline sees the verdict it asked for.
-if (failOn && findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
+// The gate, after everything has printed: the human sees the whole report, the
+// pipeline sees the verdict it asked for. Uses the final findings, so an answer
+// that unlocked a critical still fails the build.
+if (failOn && r.findings.some(f => RANK[f.severity] <= RANK_GATE[failOn])) {
   process.exit(1);
 }
+
+// The extra findings the answers unlocked, grouped the same way the main report
+// groups: one line per rule with a count, so a check that fired on many files
+// does not bury the rest.
+function printDelta(fresh, moreRan) {
+  const C = { d: '\x1b[2m', b: '\x1b[1m', o: '\x1b[0m', grn: '\x1b[32m', gry: '\x1b[90m' };
+  const SEV = { critical: '\x1b[31m', high: '\x1b[33m', medium: '\x1b[34m', low: '\x1b[90m' };
+  const p = (s = '') => process.stdout.write(s + '\n');
+
+  p(`\n  ${C.grn}${moreRan} more check${moreRan === 1 ? '' : 's'} ran with your answers.${C.o}`);
+  if (!fresh.length) {
+    p(`  ${C.d}They all passed — nothing new to fix.${C.o}\n`);
+    return;
+  }
+  const groups = [];
+  const byId = new Map();
+  for (const f of fresh) {
+    if (byId.has(f.id)) byId.get(f.id).push(f);
+    else { const arr = [f]; byId.set(f.id, arr); groups.push(arr); }
+  }
+  p(`  ${C.d}${fresh.length} new finding${fresh.length === 1 ? '' : 's'}:${C.o}`);
+  for (const g of groups) {
+    const f = g[0];
+    const more = g.length - 1;
+    p(`\n  ${SEV[f.severity]}${C.b}${f.severity.toUpperCase()}${C.o}  ${f.title}${more ? `${C.d}  · ${g.length} places${C.o}` : ''}`);
+    p(`  ${C.gry}${f.file}:${f.line}${C.o}`);
+    p(`      ${f.detail}`);
+    p(`      ${C.grn}Fix${C.o}  ${f.fix}`);
+  }
+  p('');
+}

package/src/interactive.mjs

@@ -0,0 +1,100 @@
+// The optional questions, asked in the terminal instead of made into homework.
+//
+// The report ends with "put these in launchprep.json and run again" - which
+// means writing JSON with keys like "llm_tools_enabled" before the extra checks
+// unlock. For a one-off scan that is friction most people will not pay. This
+// asks the same questions out loud, takes a number or a word, and re-runs with
+// the answers held in memory.
+//
+// READ-ONLY, deliberately. It reads the keyboard and nothing else: no file is
+// written, so launchprep.json is never created behind the user's back and the
+// read-only promise holds. Power users who want the answers saved for CI still
+// write the file themselves - that path is unchanged.
+
+import { createInterface } from 'node:readline';
+import { questionFor } from './questions.mjs';
+
+const C = { d: '\x1b[2m', b: '\x1b[1m', o: '\x1b[0m', c: '\x1b[36m', g: '\x1b[32m' };
+
+// Turn a QUESTION's `answer` example - the exact JSON a user would paste - into
+// the shape of the question: which key it sets, whether it is a yes/no or a
+// choice, and (for a choice) the options. Parsing the example rather than
+// duplicating it keeps one source of truth: questions.mjs.
+export function shapeOf(answerExample) {
+  const dash = answerExample.indexOf('—');
+  const json = (dash >= 0 ? answerExample.slice(0, dash) : answerExample).trim();
+  const rest = dash >= 0 ? answerExample.slice(dash + 1).trim() : '';
+
+  const nested  = json.match(/"([\w-]+)"\s*:\s*\{\s*"([\w-]+)"/);   // "stack": { "auth": ... }
+  const topKey  = json.match(/^"([\w-]+)"/)?.[1] || null;
+  const isArray = /:\s*\[/.test(json);
+  const isBool  = !nested && /:\s*(true|false)\s*$/.test(json) && !rest;
+
+  const choices = isBool
+    ? ['yes', 'no']
+    : rest.replace(/^any of:\s*/i, '').split(',').map(s => s.trim()).filter(Boolean);
+
+  // Fold the chosen value into a stated-shaped object, matching whatever the
+  // example demonstrated: nested (stack.auth), array (jurisdictions), boolean
+  // (has_rag), or a plain string (business_model).
+  const apply = (stated, value) => {
+    if (nested) stated[nested[1]] = { ...(stated[nested[1]] || {}), [nested[2]]: value };
+    else if (isArray) stated[topKey] = [value];
+    else if (isBool)  stated[topKey] = (value === 'yes' || value === true);
+    else stated[topKey] = value;
+    return stated;
+  };
+
+  return { choices, isBool, apply, ok: Boolean(topKey && choices.length) };
+}
+
+const rlQuestion = (rl, q) => new Promise(res => rl.question(q, res));
+
+// Ask up to `facts` in the terminal. Returns a stated-shaped object of the
+// answers given; an empty object if the user answered nothing.
+export async function askQuestions(facts, { input = process.stdin, output = process.stdout, readLine } = {}) {
+  const rl = readLine ? null : createInterface({ input, output });
+  const ask = readLine || ((prompt) => new Promise(res => rl.question(prompt, res)));
+  const stated = {};
+  try {
+    for (const fact of facts) {
+      const q = questionFor(fact);
+      if (!q) continue;
+      const shape = shapeOf(q.answer);
+      if (!shape.ok) continue;
+
+      output.write(`\n  ${C.c}${q.ask}${C.o}\n`);
+      const numbered = shape.choices.map((c, i) => `${C.d}${i + 1})${C.o} ${c}`).join('   ');
+      output.write(`    ${numbered}\n`);
+
+      // Accept a number, the literal value, or blank to skip. Re-ask on garbage
+      // rather than silently dropping it - a wrong answer the user thinks landed
+      // is worse than being asked again.
+      let value = null;
+      while (value === null) {
+        const raw = (await ask(`  ${C.b}›${C.o} `)).trim().toLowerCase();
+        if (raw === '') break;                                  // skip this one
+        const n = Number(raw);
+        if (Number.isInteger(n) && n >= 1 && n <= shape.choices.length) value = shape.choices[n - 1];
+        else if (shape.choices.includes(raw)) value = raw;
+        else output.write(`  ${C.d}pick a number 1–${shape.choices.length}, or press Enter to skip${C.o}\n`);
+      }
+      if (value !== null) shape.apply(stated, value);
+    }
+  } finally {
+    rl?.close();
+  }
+  return stated;
+}
+
+// The yes/no gate before any of it. Returns true only on an explicit yes.
+export async function confirm(prompt, { input = process.stdin, output = process.stdout, readLine } = {}) {
+  const rl = readLine ? null : createInterface({ input, output });
+  const ask = readLine || ((q) => new Promise(res => rl.question(q, res)));
+  try {
+    const raw = (await ask(prompt)).trim().toLowerCase();
+    return raw === '' || raw === 'y' || raw === 'yes';        // default yes
+  } finally {
+    rl?.close();
+  }
+}

package/src/redact.mjs

@@ -28,7 +28,12 @@ const PEM = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?
 
 // 2. Credentials embedded in a connection URL: scheme://user:pass@host.
 //    Keep the scheme and host (useful shape), mask only user:pass.
-const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
+//
+//    http and ssh belong here as much as postgres does. A git remote with a
+//    token in it (https://bot:ghp_live...@github.com), an SMTP URL holding a
+//    provider key, a Grafana or Elasticsearch URL - all were uploaded intact
+//    while the privacy page promised the value never leaves the machine.
+const CONN = /\b((?:postgres|postgresql|mysql|mysql2|mongodb(?:\+srv)?|redis|rediss|amqp|amqps|mssql|mariadb|https?|smtps?|ftps?|sftp|ssh|ldaps?|clickhouse|elasticsearch):\/\/)([^\s:@/]+):([^\s@/]+)@/gi;
 
 // 3. Provider keys by their published shape. pk_ (Stripe publishable) is left
 //    alone on purpose — it is designed to be public, and masking it was one of
@@ -54,7 +59,7 @@ const SHAPES = [
 //    and tokens that have no distinctive shape. It fires only on string
 //    literals, and holds back where the value is plainly not a secret: an env
 //    reference, a template placeholder, an interpolation, an empty string.
-const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
+const SECRET_NAME = /(?:pass(?:word|wd)?|pwd|secret[_-]?key|secret|api[_-]?key|apikey|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|token|credentials?|passphrase|dsn|encryption[_-]?key|signing[_-]?key|session[_-]?secret|db[_-]?pass(?:word)?)/i;
 const ASSIGN = new RegExp(
   '(' + SECRET_NAME.source + '["\'`\\]]?\\s*[:=]\\s*)(["\'`])([^"\'`\\n]{6,}?)\\2',
   'gi',

package/src/report.mjs

@@ -65,14 +65,34 @@ export function render({ repo, scanned, lead, findings, questions, shallow = [],
     const summary = ['critical', 'high', 'medium', 'low']
       .filter(k => counts[k]).map(k => `${counts[k]} ${k}`).join(' · ');
     p(`  ${C.dim}${summary}${C.off}`);
-    for (const f of findings.slice(0, 25)) {
+
+    // Group by rule. One check firing on 43 tables is ONE issue in 43 places,
+    // not 43 issues - listing each pushed the genuinely distinct findings off
+    // the bottom into "and N more", the drowning this tool exists to avoid.
+    // Findings arrive severity-sorted, so first-seen order keeps that order.
+    const groups = [];
+    const byId = new Map();
+    for (const f of findings) {
+      if (byId.has(f.id)) byId.get(f.id).push(f);
+      else { const arr = [f]; byId.set(f.id, arr); groups.push(arr); }
+    }
+    if (groups.length < findings.length)
+      p(`  ${C.dim}${groups.length} distinct, across ${findings.length} places${C.off}`);
+
+    for (const g of groups.slice(0, 25)) {
+      const f = g[0];
       const [col, label] = SEV[f.severity];
-      p(`\n  ${col}${C.bold}${label}${C.off}  ${f.title}`);
+      const more = g.length - 1;
+      p(`\n  ${col}${C.bold}${label}${C.off}  ${f.title}${more ? `${C.dim}  · ${g.length} places${C.off}` : ''}`);
       p(`  ${C.gry}${f.file}:${f.line}${C.off}`);
+      if (more) {
+        const also = g.slice(1, 4).map(x => `${x.file}:${x.line}`).join('  ');
+        p(`  ${C.dim}${also}${more > 3 ? `  + ${more - 3} more` : ''}${C.off}`);
+      }
       p(`      ${f.detail}`);
       p(`      ${C.grn}Fix${C.off}  ${f.fix}`);
     }
-    if (findings.length > 25) p(`\n  ${C.dim}… and ${findings.length - 25} more${C.off}`);
+    if (groups.length > 25) p(`\n  ${C.dim}… and ${groups.length - 25} more issues${C.off}`);
   }
 
   // ---------- checked, but only as far as a program can see ----------