pr-checkmate 3.0.3 → 3.1.0

package/dist/esm/core/checks/security/diff-security.js

@@ -0,0 +1,354 @@
+import { DIFF_SECURITY_IGNORE_DEFAULTS } from '../../../config/index.js';
+import { logger } from '../../../utils/index.js';
+import { skip } from '../../types.js';
+import { clientFindingOptions, emptyBuckets, mergeSeverityBuckets, reportSeverityBuckets, scanDiffPatterns, reviewLines, DEFAULT_DATAFLOW_WINDOW, } from '../findings.js';
+const MD5_LABEL = 'MD5 (weak hash — use sha256 or stronger)';
+const SHA1_LABEL = 'SHA-1 (weak hash — use sha256 or stronger)';
+const SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*dangerouslySetInnerHTML\s*=/,
+        label: 'dangerouslySetInnerHTML (XSS risk)',
+        view: 'code',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\.innerHTML\s*=/,
+        label: 'innerHTML assignment (XSS risk)',
+        view: 'code',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*document\.write\s*\(/,
+        label: 'document.write() (XSS risk)',
+        view: 'code',
+        severity: 'error',
+    },
+    {
+        // Matched against the string-blanked view, so unrelated quoting on the line
+        // cannot disable the rule. The old lookahead `(?![^'"`]*['"`])` meant "no
+        // quote anywhere ahead", which silently skipped `eval(x + "y")` and
+        // ``eval(`${p}`)`` — see ticket 058.
+        pattern: /^\+(?!\+).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+        view: 'code',
+    },
+    {
+        pattern: /^\+(?!\+).*\bnew\s+Function\s*\(/,
+        label: 'new Function() (code injection risk)',
+        severity: 'error',
+        view: 'code',
+    },
+    {
+        // Both the property form (`o.__proto__ =`, `{ __proto__: … }`) and the
+        // computed form (`o['__proto__'] =`). The latter is the one that survives a
+        // grep for `.__proto__`, and the one an attacker-supplied key arrives through.
+        // The rule matches its own source, hence the opt-out on the line itself.
+        pattern: /^\+(?!\+).*(?:__proto__\s*[=:[]|\[\s*['"]__proto__['"]\s*\])/, // pr-checkmate-ignore
+        label: '__proto__ mutation (prototype pollution)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(?:\.constructor\.prototype\b|\[\s*['"]constructor['"]\s*\]\s*\[\s*['"]prototype['"]\s*\])/,
+        label: 'constructor.prototype access (prototype pollution)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]md5['"]/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*createHash\s*\(\s*['"]sha1['"]/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateDecipher\s*\(/,
+        label: 'deprecated createDecipher() — use createDecipheriv()',
+        view: 'code',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bcreateCipher\s*\(/,
+        label: 'deprecated createCipher() — use createCipheriv()',
+        view: 'code',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*cors\s*\(\s*\{[^}]*origin\s*:\s*['"]\*['"]/,
+        label: "CORS wildcard origin: '*' (allows any domain)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/,
+        label: "Access-Control-Allow-Origin: '*' header (CORS wildcard)",
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(fetch|axios\.get|axios\.post|axios\.put|axios\.delete|http\.get|http\.request)\s*\(\s*['"]http:\/\//,
+        label: 'Insecure HTTP (non-HTTPS) in external call',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync|spawn|spawnSync)\s*\(\s*`[^`]*\$\{/,
+        label: 'exec/spawn with template literal (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*(exec|execSync)\s*\(\s*['"][^'"]*['"\s]*\+/,
+        label: 'exec/spawn with string concatenation (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(query|execute|raw)\s*\(\s*`[^`]*\$\{/,
+        label: 'SQL query with template literal interpolation (SQL injection risk)',
+        severity: 'error',
+    },
+    {
+        // A quoted string that contains a whole SQL keyword, concatenated with a
+        // variable — the real injection shape. Word boundaries + the quote context
+        // stop identifiers like `insertions + deletions` from false-positiving.
+        pattern: /^\+(?!\+).*['"`][^'"`]*\b(SELECT|INSERT|UPDATE|DELETE|WHERE)\b[^'"`]*['"`]\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+/** Python-specific dangerous constructs, scanned in *.py diffs. */
+const PYTHON_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\beval\s*\(/,
+        label: 'eval() (code injection risk)',
+        severity: 'error',
+        view: 'code',
+    },
+    {
+        pattern: /^\+(?!\+).*\bexec\s*\(/,
+        label: 'exec() (code injection risk)',
+        severity: 'error',
+        view: 'code',
+    },
+    {
+        pattern: /^\+(?!\+).*\bos\.system\s*\(/,
+        label: 'os.system() (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bsubprocess\.\w+\([^)]*shell\s*=\s*True/,
+        label: 'subprocess with shell=True (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bpickle\.loads?\s*\(/,
+        label: 'pickle load (insecure deserialization)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\byaml\.load\s*\((?![^)]*Safe)/,
+        label: 'yaml.load without SafeLoader (unsafe deserialization)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bhashlib\.md5\s*\(/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bhashlib\.sha1\s*\(/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bverify\s*=\s*False\b/,
+        label: 'TLS verification disabled (verify=False)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*['"][^'"]*\b(SELECT|INSERT|UPDATE|DELETE)\b[^'"]*['"]\s*%\s*/i,
+        label: 'SQL string formatting (SQL injection risk)',
+        severity: 'error',
+    },
+];
+/** Go-specific dangerous constructs, scanned in *.go diffs. */
+const GO_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\bmd5\.New\s*\(/,
+        label: MD5_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bsha1\.New\s*\(/,
+        label: SHA1_LABEL,
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*InsecureSkipVerify\s*:\s*true/,
+        label: 'InsecureSkipVerify: true (TLS verification disabled)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bexec\.Command\s*\([^)]*\+/,
+        label: 'exec.Command with string concatenation (command injection risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bfmt\.Sprintf\s*\([^)]*\b(SELECT|INSERT|UPDATE|DELETE)\b/i,
+        label: 'SQL built with fmt.Sprintf (SQL injection risk)',
+        severity: 'warn',
+    },
+    { pattern: /^\+(?!\+).*"crypto\/des"/, label: 'DES (weak cipher)', severity: 'warn' },
+];
+/** Kotlin/Java-specific dangerous constructs, scanned in *.kt/*.kts/*.java diffs. */
+const KOTLIN_SECURITY_PATTERNS = [
+    {
+        pattern: /^\+(?!\+).*\bRuntime\.getRuntime\(\)\.exec\s*\(/,
+        label: 'Runtime.exec() (command injection risk)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bMessageDigest\.getInstance\s*\(\s*"(MD5|SHA-1)"/,
+        label: 'weak hash (MD5/SHA-1 via MessageDigest — use SHA-256+)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\bCipher\.getInstance\s*\(\s*"(DES|.*ECB)/,
+        label: 'weak cipher (DES / ECB mode)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*ALLOW_ALL_HOSTNAME_VERIFIER/,
+        label: 'ALLOW_ALL_HOSTNAME_VERIFIER (TLS hostname verification disabled)',
+        severity: 'error',
+    },
+    {
+        pattern: /^\+(?!\+).*\bObjectInputStream\b/,
+        label: 'ObjectInputStream (insecure deserialization risk)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*"[^"]*\b(SELECT|INSERT|UPDATE|DELETE)\b[^"]*"\s*\+\s*\w/i,
+        label: 'SQL string concatenation (SQL injection risk)',
+        severity: 'error',
+    },
+];
+const JS_GLOBS = ['*.ts', '*.tsx', '*.js', '*.jsx', '*.mjs', '*.cjs'];
+/**
+ * Compile the client's `extraPatterns` into the same shape as the built-ins, so
+ * a project rule gets identical treatment: comment stripping, the code/raw view,
+ * grouping, sampling and severity.
+ *
+ * A malformed regex is reported and dropped rather than thrown: one bad entry in
+ * a config file must not take down the whole security scan.
+ */
+function compileExtraPatterns(ctx) {
+    const extra = ctx.config.diffSecurity?.extraPatterns ?? [];
+    return extra.flatMap(rule => {
+        try {
+            // `g`/`y` are stripped: both carry lastIndex state across .test() calls,
+            // which would make a rule match every other line.
+            const flags = (rule.flags ?? '').replace(/[gy]/g, '');
+            return [
+                {
+                    // Anchored on the added-line marker the same way the built-ins are, so
+                    // a client writes the body of the rule, not the diff plumbing.
+                    pattern: new RegExp(`^\\+(?!\\+).*(?:${rule.pattern})`, flags),
+                    label: rule.label,
+                    severity: rule.severity ?? 'warn',
+                    view: rule.view ?? 'raw',
+                },
+            ];
+        }
+        catch (err) {
+            logger.warn(`[Diff Security]: ⚠️ ignoring extraPattern "${rule.label}" — invalid regex: ${err}`);
+            return [];
+        }
+    });
+}
+/**
+ * Built-ins minus anything the client switched off by label. `disablePatterns`
+ * differs from `ignore`: the rule never runs at all, rather than running and
+ * having its findings dropped afterwards.
+ */
+function activePatterns(patterns, disabled) {
+    if (disabled.length === 0)
+        return patterns;
+    const lowered = disabled.map(d => d.toLowerCase());
+    return patterns.filter(p => !lowered.some(d => p.label.toLowerCase().includes(d)));
+}
+export const diffSecurityCheck = {
+    name: 'Diff Security',
+    phase: 'informational',
+    // No `requiresDiff`: a dangerous call is dangerous whether it arrived in this
+    // PR or three years ago, so with no diff range the whole tree is reviewed
+    // instead of the check dropping out (ticket 067).
+    applies(ctx) {
+        return ctx.config.diffSecurity?.enabled !== false;
+    },
+    async run(ctx) {
+        try {
+            const cfg = ctx.config.diffSecurity ?? {};
+            const found = emptyBuckets();
+            const scanOpts = {
+                comments: cfg.commentHandling ?? 'language',
+                // Setting `ignorePaths` REPLACES the test-path defaults rather than adding
+                // to them, matching `duplicate.ignore` and `deadCode.ignoreFiles`. A client
+                // who wants their tests scanned says so by listing something else here.
+                ignorePaths: cfg.ignorePaths ?? DIFF_SECURITY_IGNORE_DEFAULTS,
+                // This check owns the cross-line heuristic, so it is the one that turns it
+                // on. `0` from the client switches it off.
+                dataflowWindow: cfg.dataflowWindow ?? DEFAULT_DATAFLOW_WINDOW,
+            };
+            const extra = compileExtraPatterns(ctx);
+            const disabled = cfg.disablePatterns ?? [];
+            const scanInto = (stdout, patterns) => {
+                mergeSeverityBuckets(found, scanDiffPatterns(stdout, activePatterns(patterns, disabled), scanOpts));
+            };
+            /**
+             * Feed one language's sources through the patterns, from the diff when
+             * there is one and from the files themselves otherwise.
+             *
+             * Through {@link reviewLines}, like the four other checks that need both
+             * modes. This used to be its body copied inline, on the assumption that a
+             * closure was needed to carry `patterns` — it is not, that is what `onChunk`
+             * is for, and the copy meant `fullScanBehaviour` and the `null`/`[]`
+             * distinction lived in two places, one of them a blocking security check
+             * (ticket 079).
+             */
+            const review = (globs, patterns) => reviewLines(ctx, globs, stdout => scanInto(stdout, patterns));
+            // JS/TS patterns always run; language-specific sets scan their own globs
+            // only when that language is present, so a Python repo gets Python rules.
+            // Client `extraPatterns` run against every scanned language, since a
+            // project rule is not tied to the built-in language split.
+            const sets = [[JS_GLOBS, [...SECURITY_PATTERNS, ...extra]]];
+            if (ctx.languages.includes('python')) {
+                sets.push([['*.py'], [...PYTHON_SECURITY_PATTERNS, ...extra]]);
+            }
+            if (ctx.languages.includes('go')) {
+                sets.push([['*.go'], [...GO_SECURITY_PATTERNS, ...extra]]);
+            }
+            if (ctx.languages.includes('kotlin')) {
+                sets.push([
+                    ['*.kt', '*.kts', '*.java'],
+                    [...KOTLIN_SECURITY_PATTERNS, ...extra],
+                ]);
+            }
+            for (const [globs, patterns] of sets) {
+                // One failed set fails the check. A partial answer is worse than none
+                // here: three of five language sets scanned, reported as a pass, reads
+                // as a clean repository (ticket 072).
+                if (!(await review(globs, patterns)))
+                    return skip('git unavailable');
+            }
+            return reportSeverityBuckets(found.errors, found.warnings, {
+                prefix: 'Diff Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                ...clientFindingOptions(ctx, cfg),
+            });
+        }
+        catch (err) {
+            logger.warn(`[Diff Security]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/security/dockerfile-security.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const dockerfileSecurityCheck: Check;

package/dist/esm/core/checks/security/dockerfile-security.js

@@ -0,0 +1,98 @@
+import { execa } from '../../../utils/execa.js';
+import { logger, matchesAnyGlob } from '../../../utils/index.js';
+import { resolveTargetFiles } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { clientFindingOptions, reportSeverityBuckets, scanDiffPatterns, scanTrackedFiles, } from '../findings.js';
+const DOCKERFILE_GLOBS = ['**/Dockerfile', '**/Dockerfile.*', '**/*.Dockerfile'];
+/** Common Dockerfile security smells, matched on added diff lines. */
+const DOCKER_PATTERNS = [
+    {
+        pattern: /^\+(?!\+)\s*FROM\s+\S+:latest\b/i,
+        label: 'FROM …:latest (pin the base image to a version/digest)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*USER\s+root\b/i,
+        label: 'USER root (run the container as a non-root user)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:sh|bash)\b/i,
+        label: 'piping a download straight to a shell (curl/wget … | sh)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*ADD\s+https?:\/\//i,
+        label: 'ADD from a URL (prefer COPY, or verify a checksum)',
+        severity: 'warn',
+    },
+    {
+        // The `_FILE`/`_PATH` exclusion is not a loophole, it is the thing this rule
+        // is trying to steer people towards: `ENV DB_PASSWORD_FILE=/run/secrets/db`
+        // names a location, holds no secret, and is how Docker and Kubernetes tell
+        // you to do it. Flagging the correct practice alongside the wrong one is how
+        // a rule gets switched off — and it teaches obscuring the variable name,
+        // which makes the next real secret harder to spot, not easier.
+        pattern: /^\+(?!\+)\s*(?:ENV|ARG)\s+\w*(?:PASSWORD|SECRET|TOKEN|API_?KEY|ACCESS_KEY)\w*(?<!_FILE)(?<!_PATH)(?<!_FILEPATH)\s*[=\s]/i,
+        label: 'secret baked into ENV/ARG (use build secrets / runtime injection)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+).*(?:--no-check-certificate|--insecure)\b/,
+        label: 'insecure download flag (--insecure / --no-check-certificate)',
+        severity: 'warn',
+    },
+    {
+        pattern: /^\+(?!\+)\s*RUN\s+.*\bsudo\b/,
+        label: 'sudo inside RUN (unnecessary and risky in a container build)',
+        severity: 'warn',
+    },
+];
+export const dockerfileSecurityCheck = {
+    name: 'Dockerfile Security',
+    phase: 'informational',
+    // No `requiresDiff`: a secret baked into an ENV line is baked in whether the
+    // line is new or inherited (ticket 067).
+    applies(ctx) {
+        return ctx.config.dockerfileSecurity?.enabled !== false;
+    },
+    async run(ctx) {
+        const files = await resolveTargetFiles(ctx, ['*']);
+        if (files === null)
+            return skip('git unavailable');
+        const dockerfiles = files.filter(f => matchesAnyGlob(f, DOCKERFILE_GLOBS));
+        if (dockerfiles.length === 0)
+            return pass();
+        try {
+            const cfg = ctx.config.dockerfileSecurity ?? {};
+            let stdout = '';
+            if (ctx.baseSha) {
+                stdout = (await execa('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...dockerfiles], { cwd: ctx.cwd })).stdout;
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                await scanTrackedFiles(ctx, dockerfiles, asDiff => {
+                    stdout += `${asDiff}\n`;
+                });
+            }
+            // This check runs `git diff` itself rather than going through
+            // `diffAddedLines`, so the `pr-checkmate-ignore` opt-out is applied here.
+            const { errors, warnings } = scanDiffPatterns(stdout, DOCKER_PATTERNS, {
+                skipIgnored: true,
+                // Dockerfiles have no extension to key off, and `#` is their comment
+                // marker — the `hash` reading, not the language-detected one.
+                comments: 'legacy',
+                ignorePaths: cfg.ignorePaths,
+            });
+            return reportSeverityBuckets(errors, warnings, {
+                prefix: 'Dockerfile Security',
+                errorSummary: n => `${n} issue(s)`,
+                warningSummary: n => `${n} warning(s)`,
+                ...clientFindingOptions(ctx, cfg),
+            });
+        }
+        catch (err) {
+            logger.warn(`[Dockerfile Security]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/security/migration-safety.d.ts

@@ -0,0 +1,2 @@
+import { Check } from '../../types.js';
+export declare const migrationSafetyCheck: Check;

package/dist/esm/core/checks/security/migration-safety.js

@@ -0,0 +1,137 @@
+import { execa } from '../../../utils/execa.js';
+import { logger, matchesAnyGlob } from '../../../utils/index.js';
+import { resolveTargetFiles } from '../../targets.js';
+import { pass, skip } from '../../types.js';
+import { bucketTotal, reportCountedFindings, scanTrackedFiles, stripInlineComment, } from '../findings.js';
+/**
+ * Paths treated as database migrations. A client overrides via
+ * `migrationSafety.paths` (REPLACES this list).
+ */
+const DEFAULT_MIGRATION_GLOBS = [
+    '**/migrations/**',
+    '**/migrate/**',
+    '**/db/migrate/**', // Rails
+    '**/versions/**', // Alembic
+    '**/*.sql',
+];
+/** Destructive / locking operations, matched on added diff lines. */
+const DDL_PATTERNS = [
+    { pattern: /^\+(?!\+).*\bDROP\s+TABLE\b/i, label: 'DROP TABLE — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bDROP\s+COLUMN\b/i, label: 'DROP COLUMN — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bTRUNCATE\b/i, label: 'TRUNCATE — irreversible data loss' },
+    {
+        pattern: /^\+(?!\+).*\bRENAME\s+(?:COLUMN|TABLE)\b/i,
+        label: 'RENAME — breaks code still reading the old name',
+    },
+    { pattern: /^\+(?!\+).*\bDROP\s+(?:CONSTRAINT|INDEX)\b/i, label: 'DROP CONSTRAINT/INDEX' },
+    {
+        pattern: /^\+(?!\+).*\bALTER\s+COLUMN\b.*\bSET\s+NOT\s+NULL\b/i,
+        label: 'SET NOT NULL — locks the table, rejects existing NULL rows',
+    },
+    // Alembic (Python) operations.
+    { pattern: /^\+(?!\+).*\bop\.drop_column\b/, label: 'op.drop_column — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bop\.drop_table\b/, label: 'op.drop_table — irreversible data loss' },
+    { pattern: /^\+(?!\+).*\bop\.drop_constraint\b/, label: 'op.drop_constraint' },
+];
+const NOT_NULL_NO_DEFAULT = 'ADD COLUMN … NOT NULL without DEFAULT — fails/locks on a non-empty table';
+/**
+ * A new NOT NULL column with no DEFAULT: the classic migration that breaks on a
+ * populated table. Split out because it's a conjunction (ADD COLUMN + NOT NULL,
+ * and NO DEFAULT on the line), not a single keyword.
+ */
+function isAddNotNullNoDefault(line) {
+    return (/^\+(?!\+)/.test(line) &&
+        /\bADD\s+COLUMN\b/i.test(line) &&
+        /\bNOT\s+NULL\b/i.test(line) &&
+        !/\bDEFAULT\b/i.test(line));
+}
+/**
+ * Drop the comment from an added migration line, keeping the leading `+` so the
+ * patterns stay anchored on it.
+ *
+ * This check does its own matching rather than going through `scanDiffPatterns`,
+ * and it inherited none of the comment handling — so a commented-out statement
+ * was reported as destructive. `-- DROP TABLE users;` does nothing, and calling
+ * it "irreversible data loss" is noise on the most alarming label the product
+ * prints. Found by ticket 062's corpus.
+ *
+ * Only the two markers that are unambiguous in the files this check looks at:
+ * `--` in SQL and `#` in Python/Ruby migrations. `--` is required to be preceded
+ * by whitespace or the line start, which keeps it away from an identifier like
+ * `a--b` and from most string contents; `stripInlineComment` handles `#` with the
+ * string awareness it already has.
+ */
+function withoutComment(line) {
+    // The diff marker is split off first: `+-- DROP TABLE` puts `--` immediately
+    // after the `+`, where a boundary rule looking for whitespace or line-start
+    // does not see it — which is exactly the shape a commented-out statement takes.
+    const marker = line.startsWith('+') ? '+' : '';
+    const body = stripInlineComment(line.slice(marker.length), 'hash').replace(/(^|\s)--.*$/, '$1');
+    return marker + body;
+}
+/** Bucket dangerous added lines by risk label, honouring the opt-out directive. */
+function scan(stdout, findings) {
+    for (const line of stdout.split('\n')) {
+        if (line.includes('pr-checkmate-ignore'))
+            continue;
+        // The sample keeps the ORIGINAL line: the reader needs to see what was
+        // written, comment and all, even though the match ran on the code.
+        const code = withoutComment(line);
+        const sample = () => line.slice(1).trim().substring(0, 120);
+        for (const { pattern, label } of DDL_PATTERNS) {
+            if (pattern.test(code))
+                (findings[label] ?? (findings[label] = [])).push(sample());
+        }
+        if (isAddNotNullNoDefault(code)) {
+            (findings[NOT_NULL_NO_DEFAULT] ?? (findings[NOT_NULL_NO_DEFAULT] = [])).push(sample());
+        }
+    }
+}
+export const migrationSafetyCheck = {
+    name: 'Migration Safety',
+    phase: 'informational',
+    // No `requiresDiff`: a destructive migration is destructive whenever it was
+    // written (ticket 067). Over a whole repository this becomes an inventory of
+    // the irreversible migrations already in the history, which is worth having.
+    applies(ctx) {
+        return ctx.config.migrationSafety?.enabled !== false;
+    },
+    async run(ctx) {
+        // Not sourcePath-scoped: migrations commonly live outside `src` (db/, alembic/).
+        // ignoreDirs still applies via resolveTargetFiles.
+        const files = await resolveTargetFiles(ctx, ['*']);
+        if (files === null)
+            return skip('git unavailable');
+        const globs = ctx.config.migrationSafety?.paths ?? DEFAULT_MIGRATION_GLOBS;
+        const migrationFiles = files.filter(f => matchesAnyGlob(f, globs));
+        if (migrationFiles.length === 0)
+            return pass();
+        try {
+            let stdout = '';
+            if (ctx.baseSha) {
+                stdout = (await execa('git', ['diff', '--unified=0', ctx.baseSha, ctx.headSha ?? 'HEAD', '--', ...migrationFiles], { cwd: ctx.cwd })).stdout;
+            }
+            else if (ctx.config.run?.fullScanBehaviour !== 'skip') {
+                await scanTrackedFiles(ctx, migrationFiles, asDiff => {
+                    stdout += `${asDiff}\n`;
+                });
+            }
+            const findings = {};
+            scan(stdout, findings);
+            if (bucketTotal(findings) === 0)
+                return pass();
+            return reportCountedFindings(findings, ctx, {
+                prefix: 'Migration Safety',
+                severity: ctx.config.migrationSafety?.severity,
+                sampleLimit: ctx.config.log?.sampleLimit ?? 2,
+                // The labels carry an explanatory tail ("… — rewrites every row"); the
+                // summary is a one-line tally, so only the name of the risk fits.
+                summaryLabel: label => label.split(' — ')[0],
+            });
+        }
+        catch (err) {
+            logger.warn(`[Migration Safety]: ⚠️ Could not analyze diff\n${err}`);
+            return skip('diff unavailable');
+        }
+    },
+};

package/dist/esm/core/checks/security/security.d.ts

@@ -0,0 +1,63 @@
+import { Check } from '../../types.js';
+/**
+ * A HOME the scanner can actually write to.
+ *
+ * The bundled wrapper caches the gitleaks binary in `os.homedir()/.gitleaks-cache`
+ * and offers no way to move it — the path is hardcoded. So in any environment
+ * where HOME is not writable it crashes before scanning a single commit. That is
+ * not exotic: it is what the container does under `--user "$(id -u):$(id -g)"`,
+ * the invocation our own entrypoint and docs recommend, where HOME is `/`.
+ *
+ * Redirecting to the temp directory costs nothing that was available anyway — if
+ * HOME cannot be written to, there was no `~/.gitconfig` of ours to lose either.
+ */
+/**
+ * How many secrets the scan actually found.
+ *
+ * The row used to read `❌ Security Scan: potential secrets detected` whether the
+ * number was one or thirty-nine, and that is not a cosmetic gap. It is the reason
+ * a real regression nearly shipped: an allowlist entry removed six genuine
+ * `Generic API Key` findings from a client repository, 39 → 33, and the A/B sweep
+ * that compares report rows across 28 repositories saw two identical lines
+ * (ticket 085). A check that finds things has to say how many, or nothing can
+ * tell whether it started finding fewer.
+ *
+ * Read from gitleaks' JSON report rather than counted out of its console output —
+ * the same lesson as ticket 078, where the clone count was parsed from an English
+ * sentence and would have reported zero on a repository full of duplication.
+ *
+ * @returns The count, or `null` when the report could not be read — in which case
+ *   the caller keeps its old wording rather than claiming a number it does not have.
+ */
+export declare function countFindings(reportPath: string): number | null;
+/**
+ * How the outcome names what was found.
+ *
+ * Its own function so both halves are reachable without running the scanner. The
+ * corpus for this check deliberately does not: the wrapper downloads a gitleaks
+ * binary on first use, and a unit suite that reaches the network is the thing the
+ * `installer` seam in `ensure.ts` exists to avoid. What broke here was the wording
+ * — a row that read the same for one secret and for thirty-nine — and the wording
+ * is testable on its own.
+ *
+ * `null` keeps the old sentence rather than inventing a number: a report we could
+ * not read is not a reason to claim a count.
+ */
+export declare function secretsSummary(found: number | null): string;
+/**
+ * Whether the wrapper died instead of reporting, judged from its stderr.
+ *
+ * The wrapper is a Node script, and Node exits **1** on an unhandled exception —
+ * the same code gitleaks itself uses for "secrets found". Left undistinguished,
+ * a scanner that never ran is reported as `potential secrets detected`, pointing
+ * at a report file that was never written. A gate accusing a clean repository is
+ * the same class of failure as one that stays quiet about a real leak, and this
+ * is the only signal available to tell them apart.
+ */
+export declare function looksLikeCrash(stderr: string): boolean;
+/**
+ * Secret scanning via the bundled gitleaks package. Language-agnostic — runs on
+ * every repo (Node, Python, C++, mobile). Secrets found → fail (blocking).
+ * Tooling/infra errors → warn, so a scanner hiccup never blocks an unrelated PR.
+ */
+export declare const securityCheck: Check;