leakfix 0.1.0 → 0.2.0

package/README.md

@@ -5,6 +5,10 @@
 
 **Leaked a secret? leakfix replaces it without taking your app down.**
 
+![leakfix finds committed secrets, rolls back a failed rotation, then rotates them with zero downtime](docs/demo.gif)
+
+<sub>Recorded against simulated MongoDB Atlas and Vercel APIs (<a href="scripts/demo.ts">scripts/demo.ts</a>); the first deploy fails on purpose to show the rollback.</sub>
+
 Finding a leaked `.env` is the easy part. GitHub and others will tell you about
 it, and some providers revoke the key on the spot, which takes your app down.
 The hard part is the cleanup: mint a new credential, update the deployment,
@@ -48,17 +52,20 @@ to finish by hand.
 
 Every step is written to `leakfix-audit.jsonl`. The log never contains secret values.
 
-## Supported (v0.1)
+## Supported
 
 | Secret | Rotation |
 |---|---|
 | MongoDB Atlas connection string | ✅ new database user, same roles; old user deleted |
 | JWT signing secrets | ✅ new random secret (users sign in again) |
-| Deployment | ✅ Vercel (env vars + production redeploy) |
 | SMTP passwords, other API keys | 📝 detected, with instructions to rotate by hand |
 
-Planned: Render and Railway deployments, Stripe, SendGrid and Resend keys, a GitHub App that
-reacts to pushes and opens the clean-up PR, and an approval mode ("rotate?" → one click).
+| Deployment | |
+|---|---|
+| Vercel | ✅ env vars + production redeploy (used on a real production app) |
+| Render | 🧪 env vars + deploy (tested against a simulated API; reports from real use welcome) |
+
+See the [roadmap](#roadmap) for what's next.
 
 ## Setup
 
@@ -104,11 +111,14 @@ The config it writes looks like this, if you'd rather write it yourself:
 }
 ```
 
+On Render, use `"render": { "serviceId": "srv-..." }` instead of `"vercel"`.
+
 Credentials come only from the environment, never from the repo:
 
 | Variable | Where to get it | Needs |
 |---|---|---|
 | `LEAKFIX_VERCEL_TOKEN` | vercel.com/account/tokens | access to the project's team |
+| `LEAKFIX_RENDER_API_KEY` | dashboard.render.com → Account Settings → API Keys | the service (instead of the Vercel token) |
 | `LEAKFIX_ATLAS_CLIENT_ID` / `LEAKFIX_ATLAS_CLIENT_SECRET` | Atlas → Organization → Access Manager → Service Accounts | permission to manage database users in the project |
 
 Then:
@@ -126,6 +136,32 @@ line, or `leakfix:allow-file` in the first lines of a file full of test fixtures
 `fix-repo` doesn't rewrite history. The old file stays in past commits,
 which is why rotating is what actually protects you.
 
+## Roadmap
+
+Ordered by how often each one leaks and how much damage it does. Want one sooner,
+or want to build one? Open an issue, or read [CONTRIBUTING.md](CONTRIBUTING.md):
+a new deployment platform is one file.
+
+**Deployments**
+- [x] Vercel
+- [x] Render
+- [ ] Railway
+- [ ] Netlify
+- [ ] Fly.io
+
+**Secrets**
+- [x] MongoDB Atlas users
+- [x] JWT signing secrets
+- [ ] Stripe secret keys (Stripe can roll a key with an expiry for the old one)
+- [ ] Resend / SendGrid API keys
+- [ ] Postgres users on Neon and Supabase
+- [ ] AWS access keys (IAM)
+
+**Workflow**
+- [ ] GitHub App: notices a pushed secret, asks "rotate?", then opens the clean-up PR
+- [ ] Approval mode for teams: plan in a PR comment, rotate on approval
+- [ ] Rotate several deployments that share a secret (e.g. API on Render, web on Vercel)
+
 ## Block leaks in pull requests
 
 Add leakfix to any repo's CI. The check fails when a secret is committed, before it
@@ -150,6 +186,11 @@ docker build -t leakfix https://github.com/safayet404/leakfix.git
 docker run --rm -v "$PWD:/repo" leakfix scan /repo
 ```
 
+## Contributing
+
+Issues and pull requests are welcome. [CONTRIBUTING.md](CONTRIBUTING.md) explains how
+to add a deployment platform or a secret type, and how to test it without real accounts.
+
 ## Development
 
 ```bash

package/dist/cli.js

@@ -2,13 +2,13 @@
 // leakfix: rotate leaked secrets without downtime.
 //
 //   leakfix scan [dir]                  find secrets and whether git tracks them
-//   leakfix init [dir]                  find the Vercel/Atlas projects, check access, write the config
+//   leakfix init [dir]                  find the deployment and Atlas project, check access, write the config
 //   leakfix rotate [dir]                show the rotation plan (dry run)
 //   leakfix rotate [dir] --yes          run it
 //   leakfix fix-repo [dir]              untrack .env files, ignore them, add .env.example
 //
 // Credentials come from the environment, never from the repo:
-//   LEAKFIX_VERCEL_TOKEN, LEAKFIX_ATLAS_CLIENT_ID, LEAKFIX_ATLAS_CLIENT_SECRET
+//   LEAKFIX_VERCEL_TOKEN or LEAKFIX_RENDER_API_KEY, LEAKFIX_ATLAS_CLIENT_ID, LEAKFIX_ATLAS_CLIENT_SECRET
 // Project settings live in leakfix.config.json (see README).
 import { execFileSync } from "node:child_process";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
@@ -42,6 +42,7 @@ function gitRepo(root) {
 }
 const credentials = () => ({
     vercelToken: process.env.LEAKFIX_VERCEL_TOKEN,
+    renderApiKey: process.env.LEAKFIX_RENDER_API_KEY,
     atlasClientId: process.env.LEAKFIX_ATLAS_CLIENT_ID,
     atlasClientSecret: process.env.LEAKFIX_ATLAS_CLIENT_SECRET,
 });

package/dist/engine/init.js

@@ -4,6 +4,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { AtlasClient, parseMongoUri } from "../providers/atlas.js";
 import { HttpError, request } from "../providers/http.js";
+import { RenderClient } from "../providers/render.js";
 import { VercelClient } from "../providers/vercel.js";
 const HEALTH_PATHS = ["/health", "/api/health", "/healthz", "/api/healthz"];
 export async function init(input) {
@@ -18,7 +19,12 @@ export async function init(input) {
         return done();
     }
     checks.push({ status: "ok", label: `Committed secrets to rotate: ${keys.join(", ")}` });
-    await checkVercel(checks, config, keys, input, fetchImpl);
+    // Render when it's configured, or when only a Render key is available; Vercel otherwise.
+    const render = config.render || (!config.vercel && creds.renderApiKey && !creds.vercelToken);
+    if (render)
+        await checkRender(checks, config, keys, input, fetchImpl);
+    else
+        await checkVercel(checks, config, keys, input, fetchImpl);
     if (mongo)
         await checkAtlas(checks, config, mongo, creds, fetchImpl);
     return done();
@@ -31,6 +37,7 @@ async function checkVercel(checks, config, keys, input, fetchImpl) {
             fix: [
                 "Create one at https://vercel.com/account/settings/tokens (an expiry of 1 day is enough).",
                 `Then, in this terminal: ${hiddenExport("LEAKFIX_VERCEL_TOKEN")}`,
+                `Deployed on Render instead? Create an API key at https://dashboard.render.com/u/settings#api-keys, then: ${hiddenExport("LEAKFIX_RENDER_API_KEY")}`,
             ],
         });
         return;
@@ -85,7 +92,75 @@ async function checkVercel(checks, config, keys, input, fetchImpl) {
         checks.push({ status: "todo", label: `Cannot read ${project}'s environment variables (${errText(err)})`, fix: ["Check the project name and that the token can access its team."] });
         return;
     }
-    // A health URL lets leakfix notice a broken deploy before revoking the old credential.
+    let domains = [];
+    if (!config.healthUrl)
+        try {
+            domains = await vercel.domains(project);
+        }
+        catch { /* fall through to the warning */ }
+    await checkHealth(checks, config, domains, fetchImpl);
+}
+async function checkRender(checks, config, keys, input, fetchImpl) {
+    const { creds, gitRepo } = input;
+    if (!creds.renderApiKey) {
+        checks.push({
+            status: "todo", label: "No Render API key (LEAKFIX_RENDER_API_KEY)",
+            fix: [
+                "Create one at https://dashboard.render.com/u/settings#api-keys",
+                `Then, in this terminal: ${hiddenExport("LEAKFIX_RENDER_API_KEY")}`,
+            ],
+        });
+        return;
+    }
+    const render = new RenderClient(creds.renderApiKey, fetchImpl);
+    // Which service? Config first, then the one that deploys this repo.
+    let services;
+    try {
+        services = await render.services();
+        checks.push({ status: "ok", label: "Render API key works" });
+    }
+    catch (err) {
+        checks.push({ status: "todo", label: `Render rejected the API key (${errText(err)})`, fix: ["Create a new one at https://dashboard.render.com/u/settings#api-keys"] });
+        return;
+    }
+    let service = config.render ? services.find((s) => s.id === config.render.serviceId) : undefined;
+    if (config.render) {
+        checks.push(service
+            ? { status: "ok", label: `Render service: ${service.name} (from leakfix.config.json)` }
+            : { status: "todo", label: `The API key can't see Render service ${config.render.serviceId}`, fix: ["Check render.serviceId in leakfix.config.json (it starts with srv-)."] });
+        if (!service)
+            return;
+    }
+    else {
+        const repo = (gitRepo ?? "").toLowerCase();
+        const matches = repo ? services.filter((s) => s.repo?.toLowerCase().replace(/\.git$/, "").endsWith(`/${repo}`)) : [];
+        if (matches.length !== 1) {
+            checks.push({
+                status: "todo", label: matches.length ? `Several Render services deploy ${gitRepo}` : "Could not tell which Render service deploys this repo",
+                fix: [`Set "render": { "serviceId": "srv-..." } in leakfix.config.json. Your services: ${(matches.length ? matches : services).map((s) => `${s.name} (${s.id})`).slice(0, 15).join(", ")}`],
+            });
+            return;
+        }
+        service = matches[0];
+        config.render = { serviceId: service.id };
+        checks.push({ status: "ok", label: `Render service: ${service.name} (deploys ${gitRepo})` });
+    }
+    try {
+        const env = await render.listEnv(service.id);
+        const missing = keys.filter((k) => !env.some((e) => e.key === k));
+        checks.push(missing.length
+            ? { status: "todo", label: `Not set on the Render service: ${missing.join(", ")}`, fix: ["leakfix updates the service's own variables. Variables from an environment group must be rotated by hand for now."] }
+            : { status: "ok", label: `Set on the Render service: ${keys.join(", ")}` });
+    }
+    catch (err) {
+        checks.push({ status: "todo", label: `Cannot read the service's environment variables (${errText(err)})` });
+        return;
+    }
+    const host = service.serviceDetails?.url?.replace(/^https?:\/\//, "").replace(/\/$/, "");
+    await checkHealth(checks, config, host ? [host] : [], fetchImpl);
+}
+/** A health URL lets leakfix notice a broken deploy before revoking the old credential. */
+async function checkHealth(checks, config, domains, fetchImpl) {
     if (config.healthUrl) {
         const status = await probe(config.healthUrl, fetchImpl);
         checks.push(status && status < 300
@@ -93,11 +168,6 @@ async function checkVercel(checks, config, keys, input, fetchImpl) {
             : { status: "todo", label: `Health check ${config.healthUrl} answered ${status ?? "nothing"}`, fix: ["Fix the URL in leakfix.config.json, or remove healthUrl."] });
         return;
     }
-    let domains = [];
-    try {
-        domains = await vercel.domains(project);
-    }
-    catch { /* fall through to the warning */ }
     for (const domain of domains) {
         for (const path of HEALTH_PATHS) {
             const url = `https://${domain}${path}`;

package/dist/engine/rotations.js

@@ -11,8 +11,8 @@
 import { randomBytes } from "node:crypto";
 import { mask } from "../detect/scan.js";
 import { AtlasClient, buildMongoUri, parseMongoUri } from "../providers/atlas.js";
+import { renderTarget, vercelTarget } from "../providers/deploy.js";
 import { request } from "../providers/http.js";
-import { VercelClient } from "../providers/vercel.js";
 const MANUAL_HOWTO = {
     "smtp-password": "Create a new app password with your email provider, delete the old one, and update the variable.",
     "vercel-token": "Delete the token at vercel.com/account/tokens and create a new one.",
@@ -64,8 +64,25 @@ function jwtRotation(f) {
         // with the leaked one stop verifying. Users sign in again.
     };
 }
+/** The configured deployment, or why there is none. */
+export function deployTarget(cfg, creds, fetchImpl = fetch) {
+    if (cfg.vercel && cfg.render)
+        return "both vercel and render are configured; leakfix updates one deployment at a time";
+    if (cfg.vercel) {
+        if (!creds.vercelToken)
+            return "LEAKFIX_VERCEL_TOKEN is not set";
+        return vercelTarget(creds.vercelToken, cfg.vercel.project, cfg.vercel.teamId, fetchImpl);
+    }
+    if (cfg.render) {
+        if (!creds.renderApiKey)
+            return "LEAKFIX_RENDER_API_KEY is not set";
+        return renderTarget(creds.renderApiKey, cfg.render.serviceId, fetchImpl);
+    }
+    return "no deployment configured (set vercel or render in leakfix.config.json; `leakfix init` can find it)";
+}
 export function buildPlans(findings, cfg, creds, fetchImpl = fetch) {
     const manual = [];
+    const target = deployTarget(cfg, creds, fetchImpl);
     const rotations = [];
     const atlas = creds.atlasClientId && creds.atlasClientSecret
         ? new AtlasClient(creds.atlasClientId, creds.atlasClientSecret, fetchImpl) : undefined;
@@ -80,8 +97,8 @@ export function buildPlans(findings, cfg, creds, fetchImpl = fetch) {
         if (!f.key) {
             manual.push({ finding: f, reason: "secret is written directly in code, not in an environment variable", howTo: `Move it to an environment variable, then: ${howTo}` });
         }
-        else if (!cfg.vercel || !creds.vercelToken) {
-            manual.push({ finding: f, reason: "no deployment configured (set vercel.project and LEAKFIX_VERCEL_TOKEN)", howTo });
+        else if (typeof target === "string") {
+            manual.push({ finding: f, reason: target, howTo });
         }
         else if (f.kind === "mongodb-uri") {
             if (!atlas || !cfg.atlas)
@@ -96,45 +113,40 @@ export function buildPlans(findings, cfg, creds, fetchImpl = fetch) {
             manual.push({ finding: f, reason: `leakfix cannot rotate ${f.kind} credentials automatically yet`, howTo });
         }
     }
-    if (!rotations.length || !cfg.vercel || !creds.vercelToken)
+    if (!rotations.length || typeof target === "string")
         return { plans: [], manual };
-    const project = cfg.vercel.project;
-    const vercel = new VercelClient(creds.vercelToken, cfg.vercel.teamId, fetchImpl);
     const steps = [];
     for (const r of rotations)
         steps.push(r.prepare);
     for (const r of rotations) {
         const previous = [];
         steps.push({
-            title: `Set ${r.envKey} on Vercel project ${project} (production)`,
+            title: `Set ${r.envKey} on ${target.name} (production)`,
             async run() {
-                const entries = await vercel.findEnv(project, r.envKey);
+                const entries = await target.findEnv(r.envKey);
                 if (!entries.length)
-                    throw new Error(`${r.envKey} is not set for production on Vercel project ${project}`);
+                    throw new Error(`${r.envKey} is not set for production on ${target.name}`);
                 // Remember what to restore on rollback. Never restore an empty value:
                 // if the platform hides the current one, use the leaked value from the repo.
                 for (const e of entries) {
                     const value = e.value || r.oldValue;
                     if (!value)
                         throw new Error(`Cannot read the current value of ${r.envKey}; refusing to change it without a way back`);
-                    previous.push({ id: e.id, value });
+                    previous.push({ entry: e, value });
                 }
                 for (const e of entries)
-                    await vercel.setEnv(project, e.id, r.newValue());
+                    await target.setEnv(r.envKey, e, r.newValue());
             },
             async undo() {
                 for (const p of previous)
-                    await vercel.setEnv(project, p.id, p.value);
+                    await target.setEnv(r.envKey, p.entry, p.value);
             },
         });
     }
     let rolledBack = false;
     steps.push({
-        title: `Redeploy ${project} to production and wait until it is ready`,
-        async run() {
-            const d = await vercel.redeploy(project);
-            await vercel.waitUntilReady(d.id);
-        },
+        title: `Redeploy ${target.name} to production and wait until it is ready`,
+        run: () => target.redeploy(),
         // The env was restored by the previous steps' undo, which run after this
         // one; a fresh redeploy is triggered once at the end of the rollback.
         async undo() {
@@ -159,10 +171,8 @@ export function buildPlans(findings, cfg, creds, fetchImpl = fetch) {
     const first = steps[0];
     const originalUndo = first.undo;
     first.undo = async () => {
-        if (rolledBack) {
-            const d = await vercel.redeploy(project);
-            await vercel.waitUntilReady(d.id);
-        }
+        if (rolledBack)
+            await target.redeploy();
         await originalUndo?.();
     };
     const label = rotations.map((r) => r.label).join(", ");

package/dist/providers/deploy.js

@@ -0,0 +1,32 @@
+// Where the app runs. A rotation needs three things from the platform: read the
+// current value of a variable, set a new one, and redeploy once. Adding a
+// platform means implementing DeployTarget (see CONTRIBUTING.md).
+import { RenderClient } from "./render.js";
+import { VercelClient } from "./vercel.js";
+export function vercelTarget(token, project, teamId, fetchImpl) {
+    const vercel = new VercelClient(token, teamId, fetchImpl);
+    return {
+        name: `Vercel project ${project}`,
+        findEnv: (key) => vercel.findEnv(project, key),
+        setEnv: (_key, entry, value) => vercel.setEnv(project, entry.id, value),
+        async redeploy() {
+            const d = await vercel.redeploy(project);
+            await vercel.waitUntilReady(d.id);
+        },
+    };
+}
+export function renderTarget(apiKey, serviceId, fetchImpl) {
+    const render = new RenderClient(apiKey, fetchImpl);
+    return {
+        name: `Render service ${serviceId}`,
+        async findEnv(key) {
+            const env = await render.listEnv(serviceId);
+            return env.filter((e) => e.key === key).map((e) => ({ id: e.key, value: e.value }));
+        },
+        setEnv: (key, _entry, value) => render.setEnv(serviceId, key, value),
+        async redeploy() {
+            const d = await render.deploy(serviceId);
+            await render.waitUntilLive(serviceId, d.id);
+        },
+    };
+}

package/dist/providers/render.js

@@ -0,0 +1,51 @@
+// Render REST API: service environment variables and deploys.
+// Auth: an API key from dashboard.render.com → Account Settings → API Keys.
+import { request, sleep } from "./http.js";
+const BASE = "https://api.render.com/v1";
+const FAILED = ["build_failed", "update_failed", "canceled", "deactivated", "pre_deploy_failed"];
+export class RenderClient {
+    apiKey;
+    fetchImpl;
+    pollMs;
+    constructor(apiKey, fetchImpl = fetch, pollMs = 5000) {
+        this.apiKey = apiKey;
+        this.fetchImpl = fetchImpl;
+        this.pollMs = pollMs;
+    }
+    call(path, init = {}) {
+        return request(this.fetchImpl, "Render", `${BASE}${path}`, {
+            ...init, headers: { Authorization: `Bearer ${this.apiKey}`, Accept: "application/json" },
+        });
+    }
+    async services() {
+        const res = await this.call("/services?limit=100");
+        return res.map((r) => r.service);
+    }
+    async service(serviceId) {
+        return this.call(`/services/${serviceId}`);
+    }
+    /** The service's own variables (not ones inherited from environment groups). */
+    async listEnv(serviceId) {
+        const res = await this.call(`/services/${serviceId}/env-vars?limit=100`);
+        return res.map((r) => r.envVar);
+    }
+    async setEnv(serviceId, key, value) {
+        await this.call(`/services/${serviceId}/env-vars/${encodeURIComponent(key)}`, { method: "PUT", json: { value } });
+    }
+    async deploy(serviceId) {
+        return this.call(`/services/${serviceId}/deploys`, { method: "POST", json: { clearCache: "do_not_clear" } });
+    }
+    async waitUntilLive(serviceId, deployId, timeoutMs = 15 * 60_000) {
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            const d = await this.call(`/services/${serviceId}/deploys/${deployId}`);
+            if (d.status === "live")
+                return;
+            if (FAILED.includes(d.status)) {
+                throw new Error(`Deploy ${deployId} ended as ${d.status}; logs: https://dashboard.render.com/web/${serviceId}/deploys/${deployId}`);
+            }
+            await sleep(this.pollMs);
+        }
+        throw new Error(`Deploy ${deployId} was not live after ${Math.round(timeoutMs / 60000)} min`);
+    }
+}

package/package.json

@@ -1,18 +1,19 @@
 {
   "name": "leakfix",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Rotate leaked secrets automatically: detect, mint a new credential, redeploy, revoke the old one.",
   "keywords": [
-    "secrets",
-    "secret-rotation",
-    "leaked-secrets",
-    "security",
+    "cli",
     "devsecops",
-    "mongodb-atlas",
-    "vercel",
+    "github-action",
     "jwt",
-    "cli",
-    "github-action"
+    "leaked-secrets",
+    "mongodb-atlas",
+    "render",
+    "secret-rotation",
+    "secrets",
+    "security",
+    "vercel"
   ],
   "author": "Safayet Hossain",
   "homepage": "https://github.com/safayet404/leakfix#readme",