launchprep 0.5.5 → 0.5.6

package/README.md

@@ -1,6 +1,39 @@
 # launchprep
 
-Reads your code and tells you what will break before your users find out.
+**Is your AI-built app safe to launch?** Launchprep reads your codebase, works
+out what you actually built, and reports what will break when real users arrive
+— leaked keys, an exposed database, runaway AI spend, GDPR gaps. Every finding
+names the consequence in plain English, with a file, a line, and the fix.
+
+```bash
+npx launchprep
+```
+
+No signup, no dashboard, nothing added to your repo. The free scan runs entirely
+on your machine and uploads nothing.
+
+## Built with Cursor, Claude, Lovable, v0, Bolt or Replit?
+
+That is who this is for. The code works — that is not the same as being safe to
+put in front of people. Launchprep is the pre-launch check for founders who are
+not security engineers: it detects your stack (Next.js, Django, Rails, Express,
+Supabase, Postgres), runs only the checks that can apply to it, and tells you
+what it skipped and why.
+
+## A finding looks like this
+
+```
+CRITICAL  Server-only secret exposed to the client bundle
+apps/web/.env.local:4
+    The NEXT_PUBLIC_ prefix makes this key PUBLIC — it ships in the
+    JavaScript every visitor downloads. The name reads like it is
+    protected. It is not.
+    Fix  Rename it without the prefix and read it only on the server.
+```
+
+Not "missing authorization predicate". The consequence, the file, the line, the fix.
+
+## Commands
 
 ```bash
 npx launchprep            # the free checks — runs here, uploads nothing
@@ -9,11 +42,9 @@ npx launchprep deep       # the paid scan — asks before sending anything
 npx launchprep whoami     # scans remaining
 ```
 
-No signup. No dashboard. Nothing added to your repo.
-
 ## What it does
 
-289 checks — but it works out what you built **before** running any of them, so
+290 checks — but it works out what you built **before** running any of them, so
 you are not told about problems you cannot have. A static site is asked 48
 questions; a multi-tenant SaaS with payments and AI is asked 158.
 
@@ -103,6 +134,14 @@ fail the build. On a deep scan, checks that did not complete fail it too — a
 check that could not run has not passed. A path that does not exist always
 exits 2: a scan of nothing must never look like a clean scan of something.
 
+## Mapped to published standards
+
+Every check carries its place in the **OWASP Top 10**, the **OWASP API Security
+Top 10**, the **OWASP Top 10 for LLM Applications**, **ASVS** chapters and
+**CWE** — and to the privacy law that reaches your users (**GDPR**, UK GDPR,
+**CCPA**). Not name-dropped: the mapping is per rule, and a build step fails if
+any rule is unmapped.
+
 ## Free and paid
 
 Everything above is free, unlimited, forever — every check a program can make on
@@ -118,3 +157,14 @@ delete. See <https://launchprep.dev>.
 Proprietary — see the LICENSE file. Run it on anything you are authorised to
 scan; the rules and checks may not be copied into other products. Versions
 0.1.0 and 0.2.0 were published under MIT and remain so.
+
+---
+
+**Scan your app before your users do:**
+
+```bash
+npx launchprep
+```
+
+Docs and the full check catalogue: <https://launchprep.dev> ·
+Questions: <https://launchprep.dev/faq>

package/net/client.mjs

@@ -2,7 +2,7 @@
 import { BRAND } from '../src/brand.mjs';
 const BASE = process.env.LAUNCHPREP_API || BRAND.api;
 
-async function call(path, { key, body, method = 'POST' } = {}) {
+async function call(path, { key, body, method = 'POST', timeoutMs } = {}) {
   let res;
   try {
     res = await fetch(BASE + path, {
@@ -15,7 +15,7 @@ async function call(path, { key, body, method = 'POST' } = {}) {
       // A deep scan is minutes of model time, not seconds. But it is not
       // forever either - API-010, our own rule: nothing outbound should be able
       // to hang indefinitely.
-      signal: AbortSignal.timeout(Number(process.env.LAUNCHPREP_TIMEOUT_MS || 900_000)),
+      signal: AbortSignal.timeout(timeoutMs || Number(process.env.LAUNCHPREP_TIMEOUT_MS || 900_000)),
     });
   } catch (e) {
     if (e.name === 'TimeoutError') throw new Error('launchprep.dev did not answer in time');
@@ -31,6 +31,13 @@ export const validate = (key) => call('/v1/validate', { key });
 
 export const deepScan = ({ key, digest, profile, ruleIds, appName, idempotencyKey }) =>
   call('/v1/scan', { key, body: {
+    // Ask for a job rather than an answer. A deep scan takes minutes and a
+    // hosting proxy will cut a request long before it finishes - which is
+    // exactly what happened: the scan ran, the money was spent, and the customer
+    // got a 502. The server now replies with an id in under a second and we ask
+    // for the result afterwards. Older servers ignore this field and answer the
+    // old way, so this is safe to send at any of them.
+    async: true,
     digest: digest.text,
     profile,
     rule_ids: ruleIds,
@@ -45,4 +52,9 @@ export const deepScan = ({ key, digest, profile, ruleIds, appName, idempotencyKe
     files_skipped: digest.coverage?.filesSkipped ?? null,
   }});
 
+// One poll. Short timeout on purpose: this is a small GET, and if it fails we
+// simply ask again on the next tick rather than giving up on the whole scan.
+export const scanStatus = ({ key, scanId }) =>
+  call(`/v1/scan/${scanId}`, { key, method: 'GET', timeoutMs: 30_000 });
+
 export { BASE };

package/net/commands.mjs

@@ -6,11 +6,16 @@ import { basename, resolve } from 'node:path';
 import { BRAND } from '../src/brand.mjs';
 import { scanRepo } from '../src/fs-scan.mjs';
 import { detectProfile, toGateProfile } from '../src/detect.mjs';
-import { gate } from '../src/gate.mjs';
+import { gate, allRules } from '../src/gate.mjs';
 import { buildDigest } from '../src/digest.mjs';
 import { save, load, clear, FILE } from './credentials.mjs';
 import { confirmUpload } from './consent.mjs';
-import { validate, deepScan, BASE } from './client.mjs';
+import { validate, deepScan, scanStatus, BASE } from './client.mjs';
+
+// Waiting between polls. setTimeout only - the read-only guard forbids the
+// scanner opening anything, and this file is the paid half where a network
+// call is allowed, but a timer is all this needs.
+const sleep = (ms) => new Promise(done => setTimeout(done, ms));
 
 const C = { b:'\x1b[1m', d:'\x1b[2m', g:'\x1b[90m', o:'\x1b[38;5;209m',
             grn:'\x1b[32m', red:'\x1b[31m', yel:'\x1b[33m', off:'\x1b[0m' };
@@ -80,7 +85,11 @@ async function deep(args) {
   const digest = buildDigest(repo, { maxTokens: 150_000, profile });
 
   console.log(`  ${C.g}what it is  ${C.off}${profile.surface} · ${[profile.stack.framework, profile.stack.database, profile.stack.host].filter(Boolean).join(' · ') || '—'}`);
-  console.log(`  ${C.g}deep checks ${C.off}${tier2.length} of ${g.evaluated.length + g.skipped.length} apply`);
+  // The denominator must be the DEEP total. evaluated+skipped mixes tier 1 and
+  // tier 2 and printed "76 of 250" - a number matching nothing the customer has
+  // been told (290 total, 173 deep, 117 free).
+  const deepTotal = allRules().filter(r => r.tier === 2).length;
+  console.log(`  ${C.g}deep checks ${C.off}${tier2.length} of ${deepTotal} apply`);
 
   const okToSend = await confirmUpload({ digest, host: new URL(BASE).host, assumeYes: flag(args, 'yes') });
   if (!okToSend) process.exit(1);
@@ -92,9 +101,48 @@ async function deep(args) {
     .update(digest.text).update(tier2.map(r => r.id).join(',')).digest('hex').slice(0, 32);
 
   console.log(`  ${C.d}scanning — this takes a few minutes${C.off}`);
-  const r = await deepScan({ key: c.key, digest, profile,
+  let r = await deepScan({ key: c.key, digest, profile,
     ruleIds: tier2.map(x => x.id), appName: basename(target), idempotencyKey: idem });
 
+  // 202 means the server took the job and is holding the answer for us. Poll for
+  // it rather than keep one request open for ten minutes: a hosting proxy cuts a
+  // long request and returns 502, which cost a real customer a real scan. It also
+  // means the wait is no longer silent - there is a count to show.
+  if (r.status === 202 && r.data?.scanId) {
+    const scanId = r.data.scanId;
+    const started = Date.now();
+    const tty = process.stdout.isTTY;
+    let shown = '';
+    for (;;) {
+      await sleep(4000);
+      const p = await scanStatus({ key: c.key, scanId });
+      // A failed poll is not a failed scan - the scan runs on the server whatever
+      // this one request did. Keep asking, and only give up after a long while.
+      if (!p.ok || !p.data) {
+        if (Date.now() - started > 20 * 60_000) {
+          if (tty && shown) process.stdout.write('\r\x1b[2K');
+          console.error(`\n  ${C.red}Lost contact with the scan.${C.off}`);
+          console.error(`  ${C.d}It may still finish. Run this again in a minute — if it did,${C.off}`);
+          console.error(`  ${C.d}you get its report without spending another scan.${C.off}\n`);
+          process.exit(1);
+        }
+        continue;
+      }
+      const st = p.data.status;
+      if (st === 'running') {
+        const pr = p.data.progress;
+        const line = pr && pr.total
+          ? `  ${C.d}checking — ${pr.done} of ${pr.total} groups done${C.off}`
+          : `  ${C.d}checking — reading your code${C.off}`;
+        if (tty && line !== shown) { process.stdout.write('\r\x1b[2K' + line); shown = line; }
+        continue;
+      }
+      if (tty && shown) process.stdout.write('\r\x1b[2K');
+      r = { status: st === 'done' ? 200 : 500, ok: st === 'done', data: p.data };
+      break;
+    }
+  }
+
   if (r.status === 429) {
     console.error(`\n  ${C.red}Too many requests.${C.off} ${C.d}Try again in ${backoff(r)}. No scan was used.${C.off}\n`);
     process.exit(1);
@@ -127,7 +175,18 @@ async function deep(args) {
   }
   if (!r.ok) {
     console.error(`\n  ${C.red}The scan did not run${C.off} ${C.d}(${r.status})${C.off} ${r.data?.detail || r.data?.error || ''}`);
-    if (r.data?.refunded) console.error(`  ${C.grn}Your scan was not used.${C.off}`);
+    // A proxy 5xx carries NO body, so r.data is undefined and this reassurance
+    // never printed - the customer was left wondering whether one of their five
+    // had just been spent on nothing. Say it either way, and say how to check:
+    // that is the only question they have at this moment.
+    if (r.data?.refunded) {
+      console.error(`  ${C.grn}Your scan was not used.${C.off}`);
+    } else if (r.status >= 500 || r.status === 0) {
+      console.error(`  ${C.d}A scan only counts once it finishes. One that was started${C.off}`);
+      console.error(`  ${C.d}but never returned is released, and comes back to you.${C.off}`);
+      console.error(`  ${C.d}Check with${C.off} npx ${BRAND.slug} whoami${C.d} — and run this${C.off}`);
+      console.error(`  ${C.d}again: if the scan did finish, you get its report free.${C.off}`);
+    }
     console.error('');
     process.exit(1);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "launchprep",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Read-only CLI that scans your AI-built app and reports what will break before real users hit it — auth, tenant isolation, data, payments, GDPR. 117 checks run free on your machine.",
   "type": "module",
   "bin": {

package/src/checks-auth.mjs

@@ -264,9 +264,18 @@ export const AUTH_CHECKS = [
     if (!profile.is_public || !['web-app', 'web-site'].includes(profile.surface)) return [];
     const all = repo.files.filter(f => f.text).map(f => f.text).join('\n');
     const missing = [];
-    if (!/Content-Security-Policy/i.test(all))    missing.push('Content-Security-Policy');
-    if (!/X-Content-Type-Options/i.test(all))     missing.push('X-Content-Type-Options');
-    if (!/(X-Frame-Options|frame-ancestors)/i.test(all)) missing.push('X-Frame-Options');
+    // Match the MIDDLEWARE that sets each header, not only the literal header
+    // string. helmet.noSniff() IS X-Content-Type-Options; helmet.frameguard() IS
+    // X-Frame-Options; a bare helmet() sets all three. Grepping for the literal
+    // only meant this fired on apps that had done it the standard way - i.e. it
+    // misfired precisely on the people who got it right.
+    const helmetAll = /\bhelmet\s*\(\s*\)|\bapp\.use\s*\(\s*helmet\s*[,)]|require\(['"]helmet['"]\)\s*\(\s*\)/i.test(all);
+    if (!/Content-Security-Policy|helmet\.contentSecurityPolicy|CSP_DEFAULT_SRC|content_security_policy/i.test(all) && !helmetAll)
+      missing.push('Content-Security-Policy');
+    if (!/X-Content-Type-Options|helmet\.noSniff|SECURE_CONTENT_TYPE_NOSNIFF|secure_headers/i.test(all) && !helmetAll)
+      missing.push('X-Content-Type-Options');
+    if (!/(X-Frame-Options|frame-ancestors|helmet\.frameguard|X_FRAME_OPTIONS|secure_headers)/i.test(all) && !helmetAll)
+      missing.push('X-Frame-Options');
     if (missing.length < 2) return [];
     const f = repo.files.find(x => /(next\.config|middleware\.[tj]s|server\.[tj]s|vercel\.json|netlify\.toml)/.test(x.path));
     if (!f) return [];

package/src/checks-batch3.mjs

@@ -69,9 +69,22 @@ export const BATCH3_CHECKS = [
     if (!profile.has_migrations || profile.stage !== 'production') return [];
     const out = [];
     const dirs = repo.find(/migrations?\//);
-    const hasDown = dirs.some(f => /down|rollback|revert/i.test(f.path)) ||
-                    repo.grep(/def downgrade|\.down\s*=|DROP.*-- rollback|def self\.down/i, /\.(py|rb|ts|js|sql)$/).length;
-    if (hasDown || !dirs.length) return [];
+    if (!dirs.length) return [];
+    // Django reverses CreateModel/AddField/AlterField itself - there is no
+    // "down" to write, and looking for Alembic's `def downgrade` or Rails'
+    // `def self.down` in a Django project is looking for a convention that
+    // does not exist there. It fired on 100% of Django repos. Only a
+    // RunPython/RunSQL without its reverse is genuinely irreversible.
+    const isDjango = dirs.some(f => /\.py$/.test(f.path));
+    if (isDjango) {
+      const irreversible = repo.grep(
+        /RunPython\((?![^)]*reverse_code)|RunSQL\((?![^)]*reverse_sql)/, /\.py$/).length;
+      if (!irreversible) return [];
+    } else {
+      const hasDown = dirs.some(f => /down|rollback|revert/i.test(f.path)) ||
+                      repo.grep(/def downgrade|\.down\s*=|DROP.*-- rollback|def self\.down/i, /\.(py|rb|ts|js|sql)$/).length;
+      if (hasDown) return [];
+    }
     return [finding('DEP-005', 'Migrations have no rollback path', 'medium',
       dirs[0].path, 1,
       'A migration that fails halfway through production leaves the schema in a state nothing knows how to undo — under pressure, at the worst possible moment.',
@@ -236,8 +249,15 @@ export const BATCH3_CHECKS = [
 { id: 'RU-010', scope: 'root', run(repo, profile) {
     if (!profile.is_public || profile.stage !== 'production') return [];
     if (profile.surface === 'library') return [];
-    const has = repo.grep(/mailto:|support@|help@|contact@|\/contact\b/i,
-                          /\.(tsx|jsx|html|erb|vue|svelte|md|py|rb)$/).length;
+    // A contact route is a contact route. Grepping only for role aliases
+    // (support@/help@/contact@) denied that a project had any way to reach it
+    // while a real address sat in its README - which is how most founders
+    // actually do it, with their own name. Accept any address, a Slack/Discord
+    // invite, or a Support/Contact heading. `git@github.com` is a remote, not a
+    // contact, so it is excluded.
+    const has = repo.grep(
+      /mailto:|(?!git@)[\w.+-]+@[\w-]+\.[a-z]{2,}|slack\.com\/(?:archives|invite)|discord\.gg|\/contact\b|#{1,3}\s*(?:Support|Contact)\b/i,
+      /\.(tsx|jsx|html|erb|vue|svelte|md|py|rb|txt)$/).length;
     if (has) return [];
     return [finding('RU-010', 'No way for a customer to reach you', 'medium',
       'contact details', 1,

package/src/checks-batch4.mjs

@@ -110,10 +110,25 @@ export const BATCH4_CHECKS = [
       const cols = []; let total = 0, at = null;
       for (const f of sql) {
         let m;
-        const fk = /(?:FOREIGN\s+KEY\s*\(\s*"?([A-Za-z0-9_]+)"?\s*\)|^\s*"?([A-Za-z0-9_]+)"?\s+[A-Za-z]+[^,\n]*\bREFERENCES\b)/gim;
+        // `ALTER TABLE x ADD COLUMN IF NOT EXISTS col uuid REFERENCES y(id)` puts SQL
+        // keywords at the start of the line, so "^\s*(word)" captured ADD and the
+        // finding read "foreign keys ... add, fact_id". Skip the DDL preamble before
+        // taking the column name.
+        // TWO passes, and the order matters. An explicit `FOREIGN KEY (col)` clause is
+        // unambiguous, so take those FIRST and only fall back to the inline
+        // `col type REFERENCES other(id)` form on lines that have no such clause.
+        // Running one combined regex let the inline branch match earlier in the string
+        // and win on Drizzle output - `ALTER TABLE "t" ADD CONSTRAINT "..." FOREIGN KEY
+        // ("org_id") REFERENCES ...` reported the column as "ALTER". Same class of bug
+        // as the ADD COLUMN one: the line starts with SQL keywords, not a column.
+        const fkExplicit = /FOREIGN\s+KEY\s*\(\s*"?([A-Za-z0-9_]+)"?\s*\)/gi;
+        const fkInline   = /^\s*(?:ADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?)?"?([A-Za-z0-9_]+)"?\s+[A-Za-z]+[^,\n]*\bREFERENCES\b/gim;
+        const fk = /FOREIGN\s+KEY\s*\(/i.test(f.text) ? fkExplicit : fkInline;
         while ((m = fk.exec(f.text))) {
           const col = (m[1] || m[2] || '').toLowerCase();
-          if (!col || indexed.has(col) || cols.includes(col)) continue;
+          // belt and braces: a SQL keyword is never a column name
+          const SQL_KW = new Set(['add','column','constraint','table','alter','create','if','not','exists','key','foreign','primary','unique']);
+          if (!col || SQL_KW.has(col) || indexed.has(col) || cols.includes(col)) continue;
           if (!at) at = { path: f.path, line: lineOf(f.text, m.index) };
           total++; cols.push(col);
         }
@@ -241,7 +256,11 @@ export const BATCH4_CHECKS = [
       if (!t || !/\.(ts|tsx|js|jsx|mjs|py|rb|php)$/.test(f.path)) continue;
       const m = t.match(/(?:image\/jpe?g|image\/heic|\.jpe?g['"]|\.heic['"])/i);
       if (!m) continue;
-      if (!/upload|multer|putObject|createReadStream|\.save\(|storage/i.test(t)) continue;
+      // Require evidence of a USER upload, not merely a file that writes jpegs.
+      // `storage` / `.save(` / `createReadStream` matched a video frame writer that
+      // emits f000001.jpg - no user, no upload, no EXIF to leak. Read the context,
+      // not the extension.
+      if (!/\b(?:multer|formidable|busboy|uploadedFile|req\.files?\b|FormData|multipart\/form-data|putObject|presigned|\.upload\s*\()/i.test(t)) continue;
       return [finding('UP-008', 'Photo uploads keep their GPS coordinates', 'medium',
         f.path, lineOf(t, t.indexOf(m[0])),
         'A photo taken on a phone carries the exact place and time it was taken. Stored and served as-is, anyone who downloads a user\'s picture learns where they live.',

package/src/checks-deploy.mjs

@@ -168,18 +168,27 @@ export const DEPLOY_CHECKS = [
 // ---- no body size limit ---------------------------------------------------
 { id: 'DATA-008', run(repo, profile) {
     if (!profile.is_public) return [];
-    const CALL = /express\.json\s*\(|bodyParser\.json\s*\(/;
-    const express = repo.grep(CALL)
+    // `express.json()` and `bodyParser.json()` ALREADY default to 100kb. Flagging
+    // a bare call was wrong on essentially every Express app - and the fix this
+    // check used to suggest, limit: "1mb", LOOSENED the cap tenfold. Advice that
+    // makes a reader less safe is worse than no check.
+    //
+    // The genuinely unbounded sink is a file-upload middleware with no limits:
+    // express-fileupload, multer and busboy all accept an unlimited body unless
+    // told otherwise.
+    const UPLOAD = /\b(?:fileUpload|multer|busboy|Busboy)\s*\(/;
+    const hits = repo.grep(UPLOAD)
       .map(f => ({ ...f, code: codeOnly(f.text) }))
-      .filter(f => CALL.test(f.code));
-    if (!express.length) return [];
-    const limited = express.some(f => /json\s*\(\s*\{[^}]*limit\s*:/.test(f.code));
-    if (limited) return [];
-    const f = express[0];
-    return [finding('DATA-008', 'No limit on request body size', 'medium',
-      f.path, lineOf(f.code, f.code.search(CALL)),
-      'A single request can send a body large enough to exhaust memory. No account needed.',
-      'Pass a limit, e.g. express.json({ limit: "1mb" }).')];
+      .filter(f => UPLOAD.test(f.code));
+    if (!hits.length) return [];
+    // a limits: / fileSize: / maxFileSize option anywhere in the same file
+    const capped = hits.some(f => /\blimits\s*:|\bfileSize\s*:|\bmaxFileSize\s*:/.test(f.code));
+    if (capped) return [];
+    const f = hits[0];
+    return [finding('DATA-008', 'File uploads with no size limit', 'medium',
+      f.path, lineOf(f.code, f.code.search(UPLOAD)),
+      'This upload middleware accepts a body of any size. One request can fill the disk or exhaust memory, and no account is needed to send it.',
+      'Pass a ceiling — multer({ limits: { fileSize: 5 * 1024 * 1024 } }), or fileUpload({ limits: { fileSize: 5e6 } }).')];
   }},
 
 // ---- SQL built by string concatenation -----------------------------------

package/src/checks-injection.mjs

@@ -119,7 +119,13 @@ const usesTainted = (expr, names) => {
 
 // Wrapped in a numeric coercion it cannot carry a quote, a comment marker or a
 // semicolon. Flagging it would be flagging arithmetic.
-const COERCED = /^\s*(Number|parseInt|parseFloat|int|float|Integer\.parseInt|to_i|intval)\s*\(|^\s*\+\s*[A-Za-z_$]/;
+// A value that cannot carry a quote cannot break out of a string. Numeric
+// coercion was already here; hashing belongs with it - md5/sha/digest return
+// hex, and a uuid is hex and dashes. Without this, `${security.hash(req.body
+// .password)}` inside an otherwise-parameterised query reported a CRITICAL
+// SQL injection, which is the most damaging false positive the tool can make:
+// maximum severity, on ordinary code.
+const COERCED = /^\s*(?:Number|parseInt|parseFloat|int|float|Integer\.parseInt|to_i|intval|Boolean|BigInt)\s*\(|^\s*\+\s*[A-Za-z_$]|^\s*[\w.$]*\b(?:hash|md5|sha1|sha256|sha512|sha\d*|digest|hexdigest|hashSync|bcrypt|scrypt|uuid|uuidv4|randomUUID)\w*\s*\(/i;
 
 // Tagged templates that parameterise. These look EXACTLY like the dangerous
 // form and are the reason a naive version of this check would be unusable:

package/src/checks.mjs

@@ -47,10 +47,38 @@ const BASE_CHECKS = [
 { id:'SEC-002', run(repo){
     const gi = repo.read('.gitignore');
     if (gi === null) return [];
-    if (/^\s*\.env/m.test(gi)) return [];
-    return [finding('SEC-002','.env is not in .gitignore','high','.gitignore',1,
+    // Not every project's env file is called ".env". docker-compose `env_file:`
+    // and `--env-file vars.env` are ordinary, and a project keeping secrets in
+    // vars.env - with vars.env correctly ignored - was told to protect a file it
+    // does not have. Work out which env files this project ACTUALLY has, then
+    // check those names. Say nothing when there is no env file at all.
+    const envFiles = repo.find(/(^|\/)[\w.-]*\.env(\.[\w-]+)?$/)
+      .map(f => f.path.split('/').pop())
+      .filter(n => !/\.example$|\.sample$|\.template$/i.test(n));
+    // A correctly-ignored env file is INVISIBLE to us - git never committed it,
+    // so it is not on disk to find. The .gitignore naming one is therefore the
+    // evidence that the project handled this, whatever the file is called.
+    const ignoresSomeEnv = gi.split('\n')
+      .map(l => l.trim())
+      .some(l => l && !l.startsWith('#') && /(^|[\w.*-])\.env(\*|$)|^\*\.env$/.test(l));
+    if (!envFiles.length && ignoresSomeEnv) return [];
+    const names = [...new Set(envFiles.length ? envFiles : ['.env'])];
+    const ignored = (name) => gi.split('\n').some(line => {
+      const l = line.trim();
+      if (!l || l.startsWith('#')) return false;
+      if (l === name) return true;                       // vars.env
+      if (l.replace(/\*/g, '') === '' ) return false;
+      if (/^\.env/.test(l) && /^\.env/.test(name)) return true;   // .env / .env*
+      if (l.endsWith('*') && name.startsWith(l.slice(0, -1))) return true;
+      if (l.startsWith('*') && name.endsWith(l.slice(1))) return true;  // *.env
+      return false;
+    });
+    const exposed = names.filter(n => !ignored(n));
+    if (!exposed.length) return [];
+    const which = exposed[0];
+    return [finding('SEC-002', which + ' is not in .gitignore','high','.gitignore',1,
       'Nothing stops a future commit from publishing your secrets.',
-      'Add a line containing  .env*  to .gitignore')];
+      'Add a line containing  ' + which + '  to .gitignore')];
   }},
 
 { id:'SEC-004', run(repo){

package/src/detect.mjs

@@ -254,7 +254,20 @@ function detectSurface(repo, framework, deps) {
   if (['flutter','react-native'].includes(f))  return fact('mobile-android','low',['cross-platform mobile']);
   if (['django','rails','laravel','symfony','flask'].includes(f))
     return fact('web-app','high',[`${f} application`]);
-  if (['express','fastify','nest','fastapi','sinatra'].includes(f)) return fact('api-only','low',['server framework, no UI framework']);
+  if (['express','fastify','nest','fastapi','sinatra'].includes(f)) {
+    // The evidence said "no UI framework" without ever looking for one. A very
+    // common full-stack shape - Express serving an API next to a Vite/React
+    // client/ folder - was called api-only, which SKIPPED 27 checks including
+    // the UI, privacy and social ones the site actually needs. Look before
+    // asserting: a UI dependency plus real component files means a web app.
+    const uiDep = ['react','react-dom','vue','svelte','preact','solid-js','@angular/core']
+      .some(d => deps[d] || deps['dependencies']?.[d]);
+    const uiFiles = repo.find(/\.(tsx|jsx|vue|svelte)$/).length;
+    const hasHtml = repo.has(/(^|\/)index\.html$/);
+    if (uiDep && (uiFiles >= 3 || hasHtml))
+      return fact('web-app','low',[`${f} api with a browser front end`]);
+    return fact('api-only','low',['server framework, no UI framework']);
+  }
   if (['next','remix','nuxt','sveltekit'].includes(f)) {
     const dynamic = repo.has(/\/(api|actions)\//) || repo.grep(/'use server'/).length;
     return fact(dynamic ? 'web-app' : 'web-site','low',[dynamic?'server routes present':'no server routes found']);