prodlint 0.9.0 → 0.9.2

package/README.md

@@ -6,18 +6,18 @@
 
 Production readiness for vibe-coded apps.
 
-Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules, under 100ms.
+Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.
 
 ```bash
 npx prodlint
 ```
 
 ```
-  prodlint v0.9.0
-  Scanned 148 files · 3 critical · 5 warnings
+  prodlint v0.9.2
+  Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts
-    12:1  CRIT  No rate limiting — anyone could spam this endpoint and run up your API costs  rate-limiting
+    12:1  INFO  No rate limiting — anyone could spam this endpoint and run up your API costs  rate-limiting
     28:5  WARN  Empty catch block silently swallows error  shallow-catch
 
   src/actions/submit.ts
@@ -35,7 +35,7 @@ npx prodlint
 
   Overall: 82/100 (weighted)
 
-  3 critical · 5 warnings · 3 info
+  2 critical · 5 warnings · 4 info
 ```
 
 ## Why?
@@ -50,6 +50,11 @@ prodlint checks what TypeScript and ESLint don't: **whether your vibe-coded app
 npx prodlint                              # Run directly (no install)
 npx prodlint ./my-app                     # Scan specific path
 npx prodlint --json                       # JSON output for CI
+npx prodlint --sarif                      # SARIF 2.1.0 for GitHub Code Scanning
+npx prodlint --summary                    # Quick pass/fail + top 3 blockers
+npx prodlint --profile startup            # Only critical findings
+npx prodlint --profile strict             # All findings including info
+npx prodlint --baseline .prodlint-baseline.json   # Only new findings
 npx prodlint --ignore "*.test.ts"         # Ignore patterns
 npx prodlint --min-severity warning       # Only warnings and criticals
 npx prodlint --quiet                      # Suppress badge output
@@ -196,13 +201,40 @@ Posts a score breakdown as a PR comment and fails the build if below threshold.
 | `score` | Overall score (0-100) |
 | `critical` | Number of critical findings |
 
+### SARIF + GitHub Code Scanning
+
+Upload prodlint results to GitHub's Security tab:
+
+```yaml
+- name: Run prodlint
+  run: npx prodlint --sarif > prodlint.sarif
+
+- name: Upload SARIF
+  uses: github/codeql-action/upload-sarif@v4
+  with:
+    sarif_file: prodlint.sarif
+    category: prodlint
+```
+
+### Baseline for Existing Projects
+
+Adopt prodlint gradually without drowning in pre-existing findings:
+
+```bash
+# Save current state as baseline
+npx prodlint --baseline-save .prodlint-baseline.json
+
+# CI only fails on NEW findings
+npx prodlint --baseline .prodlint-baseline.json
+```
+
 ## MCP Server
 
 Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:
 
 **Claude Code:**
 ```bash
-claude mcp add prodlint npx prodlint-mcp
+claude mcp add prodlint -- npx -y prodlint-mcp
 ```
 
 **Cursor / Windsurf:**

package/dist/cli.js

@@ -2,6 +2,7 @@
 
 // src/cli.ts
 import { parseArgs } from "util";
+import { readFileSync as readFileSync2, writeFileSync, existsSync } from "fs";
 
 // src/utils/file-walker.ts
 import fg from "fast-glob";
@@ -715,8 +716,8 @@ function summarizeFindings(findings) {
 
 // src/rules/secrets.ts
 var SECRET_PATTERNS = [
-  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{20,}/ },
-  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{20,}/ },
+  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{8,}/ },
+  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{8,}/ },
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/ },
   { name: "AWS secret key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/ },
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
@@ -1250,7 +1251,7 @@ var corsConfigRule = {
 };
 
 // src/rules/ai-smells.ts
-var CONSOLE_LOG_THRESHOLD = 5;
+var CONSOLE_LOG_THRESHOLD = 3;
 var ANY_TYPE_THRESHOLD = 5;
 var COMMENTED_CODE_THRESHOLD = 3;
 var aiSmellsRule = {
@@ -3290,6 +3291,7 @@ var useClientOveruseRule = {
 // src/rules/env-fallback-secret.ts
 var SENSITIVE_ENV = /process\.env\.(JWT_SECRET|SECRET_KEY|AUTH_SECRET|SESSION_SECRET|ENCRYPTION_KEY|API_SECRET|PRIVATE_KEY|SIGNING_KEY|NEXTAUTH_SECRET|TOKEN_SECRET|APP_SECRET|COOKIE_SECRET|HASH_SECRET)\s*(?:\|\||&&|\?\?)\s*['"`]/i;
 var ENV_FALLBACK = /process\.env\.\w*(SECRET|KEY|PASSWORD|TOKEN)\w*\s*(?:\|\||\?\?)\s*['"`]/i;
+var CONN_STRING_FALLBACK = /process\.env\.\w+\s*(?:\|\||\?\?)\s*['"`](?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\//i;
 var envFallbackSecretRule = {
   id: "env-fallback-secret",
   name: "Secret with Fallback Value",
@@ -3317,6 +3319,20 @@ var envFallbackSecretRule = {
         });
         continue;
       }
+      const connMatch = CONN_STRING_FALLBACK.exec(line);
+      if (connMatch) {
+        findings.push({
+          ruleId: "env-fallback-secret",
+          file: file.relativePath,
+          line: i + 1,
+          column: connMatch.index + 1,
+          message: "Connection string with credentials used as fallback \u2014 hardcoded DB/service URL becomes the production connection when env var is missing",
+          severity: "warning",
+          category: "security",
+          fix: "Fail fast when required env vars are missing instead of falling back to a default value"
+        });
+        continue;
+      }
       const genericMatch = ENV_FALLBACK.exec(line);
       if (genericMatch && !isConfigFile(file.relativePath)) {
         findings.push({
@@ -4577,6 +4593,99 @@ function reportPretty(result, opts = {}) {
 function reportJson(result) {
   return JSON.stringify(result, null, 2);
 }
+function reportSummary(result) {
+  const lines = [];
+  const { critical, warning, info } = result.summary;
+  const hasCritical = critical > 0;
+  const verdict = hasCritical ? pc.red(pc.bold("FAIL")) : pc.green(pc.bold("PASS"));
+  const scorePart = scoreColor(result.overallScore)(`${result.overallScore}/100`);
+  const countParts = [];
+  if (critical > 0) countParts.push(`${critical} critical`);
+  if (warning > 0) countParts.push(`${warning} warning`);
+  if (info > 0) countParts.push(`${info} info`);
+  lines.push("");
+  if (countParts.length > 0) {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} ${countParts.join(", ")} ${pc.dim(`(score: ${scorePart})`)}`);
+  } else {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} no issues ${pc.dim(`(score: ${scorePart})`)}`);
+  }
+  const topFindings = result.findings.filter((f) => f.severity === "critical" || f.severity === "warning").slice(0, 3);
+  if (topFindings.length > 0) {
+    for (let i = 0; i < topFindings.length; i++) {
+      const f = topFindings[i];
+      const color = SEVERITY_COLORS[f.severity];
+      const label = SEVERITY_LABELS[f.severity];
+      lines.push(`  ${pc.dim(`${i + 1}.`)} ${f.file}:${f.line} ${pc.dim("\u2014")} ${color(label)} ${f.message} ${pc.dim(f.ruleId)}`);
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+var SARIF_SEVERITY_MAP = {
+  critical: "error",
+  warning: "warning",
+  info: "note"
+};
+function reportSarif(result) {
+  const ruleMap = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    ruleMap.set(r.id, r);
+  }
+  const usedRuleIds = new Set(result.findings.map((f) => f.ruleId));
+  const sarifRules = [...usedRuleIds].map((id) => {
+    const rule = ruleMap.get(id);
+    return {
+      id,
+      name: rule?.name ?? id,
+      shortDescription: { text: rule?.description ?? id },
+      defaultConfiguration: {
+        level: SARIF_SEVERITY_MAP[rule?.severity ?? "info"] ?? "note"
+      },
+      helpUri: `https://prodlint.com/rules/${id}`
+    };
+  });
+  const sarifResults = result.findings.map((f) => {
+    const sarifResult = {
+      ruleId: f.ruleId,
+      level: SARIF_SEVERITY_MAP[f.severity] ?? "note",
+      message: { text: f.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: f.file.replace(/\\/g, "/") },
+            region: { startLine: f.line, startColumn: f.column }
+          }
+        }
+      ]
+    };
+    if (f.fix) {
+      sarifResult.fixes = [
+        {
+          description: { text: f.fix }
+        }
+      ];
+    }
+    return sarifResult;
+  });
+  const sarif = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "prodlint",
+            version: getVersion(),
+            informationUri: "https://prodlint.com",
+            rules: sarifRules
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
 function renderBar(score) {
   const width = 20;
   const filled = Math.round(score / 100 * width);
@@ -4876,13 +4985,26 @@ async function runWebScan(targetUrl) {
 
 // src/cli.ts
 var SEVERITY_RANK = { critical: 3, warning: 2, info: 1 };
+var PROFILE_SEVERITY = {
+  startup: "critical",
+  balanced: "warning",
+  strict: "info"
+};
+function fingerprintFinding(f) {
+  return `${f.ruleId}::${f.file}::${f.line}`;
+}
 async function main() {
   const { values, positionals } = parseArgs({
     allowPositionals: true,
     options: {
       json: { type: "boolean", default: false },
+      sarif: { type: "boolean", default: false },
+      summary: { type: "boolean", default: false },
       ignore: { type: "string", multiple: true, default: [] },
       "min-severity": { type: "string", default: "info" },
+      profile: { type: "string" },
+      baseline: { type: "string" },
+      "baseline-save": { type: "string" },
       quiet: { type: "boolean", default: false },
       web: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false },
@@ -4907,15 +5029,66 @@ async function main() {
     return;
   }
   const targetPath = positionals[0] ?? ".";
-  const minSeverity = values["min-severity"] ?? "info";
+  let minSeverity;
+  if (values.profile) {
+    const profileName = values.profile;
+    if (!(profileName in PROFILE_SEVERITY)) {
+      console.error(`Unknown profile: ${profileName}. Available: startup, balanced, strict`);
+      process.exit(2);
+    }
+    minSeverity = PROFILE_SEVERITY[profileName];
+  } else {
+    minSeverity = values["min-severity"] ?? "info";
+  }
   const result = await scan({
     path: targetPath,
     ignore: values.ignore
   });
   const minRank = SEVERITY_RANK[minSeverity] ?? 1;
   result.findings = result.findings.filter((f) => SEVERITY_RANK[f.severity] >= minRank);
-  if (values.json) {
+  result.summary = {
+    critical: result.findings.filter((f) => f.severity === "critical").length,
+    warning: result.findings.filter((f) => f.severity === "warning").length,
+    info: result.findings.filter((f) => f.severity === "info").length
+  };
+  if (values["baseline-save"]) {
+    const baselinePath = values["baseline-save"];
+    const entries = result.findings.map((f) => ({
+      ruleId: f.ruleId,
+      file: f.file,
+      line: f.line,
+      message: f.message
+    }));
+    writeFileSync(baselinePath, JSON.stringify(entries, null, 2));
+    console.log(`Baseline saved: ${entries.length} findings written to ${baselinePath}`);
+    return;
+  }
+  if (values.baseline) {
+    const baselinePath = values.baseline;
+    if (!existsSync(baselinePath)) {
+      console.error(`Baseline file not found: ${baselinePath}`);
+      console.error("Run with --baseline-save first to create a baseline.");
+      process.exit(2);
+    }
+    const baselineData = JSON.parse(readFileSync2(baselinePath, "utf8"));
+    const baselineFingerprints = new Set(
+      baselineData.map((e) => `${e.ruleId}::${e.file}::${e.line}`)
+    );
+    result.findings = result.findings.filter(
+      (f) => !baselineFingerprints.has(fingerprintFinding(f))
+    );
+    result.summary = {
+      critical: result.findings.filter((f) => f.severity === "critical").length,
+      warning: result.findings.filter((f) => f.severity === "warning").length,
+      info: result.findings.filter((f) => f.severity === "info").length
+    };
+  }
+  if (values.sarif) {
+    console.log(reportSarif(result));
+  } else if (values.json) {
     console.log(reportJson(result));
+  } else if (values.summary) {
+    console.log(reportSummary(result));
   } else {
     console.log(reportPretty(result, { quiet: values.quiet }));
   }
@@ -4953,22 +5126,32 @@ function printHelp() {
 
   Options:
     --json                    Output results as JSON
+    --sarif                   Output results as SARIF 2.1.0 (for GitHub Code Scanning)
+    --summary                 Quick pass/fail verdict with top 3 findings
     --ignore <pattern>        Glob patterns to ignore (can be repeated)
-    --min-severity <level>    Minimum severity to show: critical, warning, info (default: info)
+    --min-severity <level>    Minimum severity: critical, warning, info (default: info)
+    --profile <name>          Preset: startup (criticals only), balanced (warnings+), strict (all)
+    --baseline <file>         Only show findings not in baseline file
+    --baseline-save <file>    Save current findings as baseline snapshot
     --quiet                   Suppress badge and summary
     --web                     Get your site's prodlint score (14 AI agent checks)
     -h, --help                Show this help message
     -v, --version             Show version
 
   Examples:
-    npx prodlint                              Scan current directory
-    npx prodlint ./my-app                     Scan specific path
-    npx prodlint --json                       JSON output
-    npx prodlint --ignore "*.test"            Ignore test files
-    npx prodlint --min-severity warning       Only warnings and criticals
-    npx prodlint --quiet                      No badge output
-    npx prodlint --web example.com            Site score
-    npx prodlint --web example.com --json     Site score with JSON output
+    npx prodlint                                  Scan current directory
+    npx prodlint ./my-app                         Scan specific path
+    npx prodlint --json                           JSON output
+    npx prodlint --sarif                          SARIF output for CI integration
+    npx prodlint --summary                        Quick pass/fail + top blockers
+    npx prodlint --profile startup                Only critical findings
+    npx prodlint --baseline .prodlint-baseline.json   Only new findings
+    npx prodlint --baseline-save .prodlint-baseline.json   Save baseline
+    npx prodlint --ignore "*.test"                Ignore test files
+    npx prodlint --min-severity warning           Only warnings and criticals
+    npx prodlint --quiet                          No badge output
+    npx prodlint --web example.com                Site score
+    npx prodlint --web example.com --json         Site score with JSON output
 `);
 }
 main().catch((err) => {

package/dist/index.d.ts

@@ -73,6 +73,14 @@ declare function scan(options: ScanOptions): Promise<ScanResult>;
 
 declare const rules: Rule[];
 
+interface ReportOptions {
+    quiet?: boolean;
+}
+declare function reportPretty(result: ScanResult, opts?: ReportOptions): string;
+declare function reportJson(result: ScanResult): string;
+declare function reportSummary(result: ScanResult): string;
+declare function reportSarif(result: ScanResult): string;
+
 type CheckStatus = "pass" | "fail" | "warn" | "info";
 type CheckSeverity = "critical" | "high" | "medium" | "low";
 interface ScanCheck {
@@ -116,4 +124,4 @@ interface WebScanResult {
 
 declare function runWebScan(targetUrl: string): Promise<WebScanResult>;
 
-export { type Category, type CategoryScore, type FileContext, type Finding, type ProjectContext, type Rule, type ScanOptions, type ScanResult, type Severity, type CheckContext as WebCheckContext, type ScanCheck as WebScanCheck, type WebScanResult, rules, runWebScan, scan };
+export { type Category, type CategoryScore, type FileContext, type Finding, type ProjectContext, type Rule, type ScanOptions, type ScanResult, type Severity, type CheckContext as WebCheckContext, type ScanCheck as WebScanCheck, type WebScanResult, reportJson, reportPretty, reportSarif, reportSummary, rules, runWebScan, scan };

package/dist/index.js

@@ -710,8 +710,8 @@ function summarizeFindings(findings) {
 
 // src/rules/secrets.ts
 var SECRET_PATTERNS = [
-  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{20,}/ },
-  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{20,}/ },
+  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{8,}/ },
+  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{8,}/ },
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/ },
   { name: "AWS secret key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/ },
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
@@ -1245,7 +1245,7 @@ var corsConfigRule = {
 };
 
 // src/rules/ai-smells.ts
-var CONSOLE_LOG_THRESHOLD = 5;
+var CONSOLE_LOG_THRESHOLD = 3;
 var ANY_TYPE_THRESHOLD = 5;
 var COMMENTED_CODE_THRESHOLD = 3;
 var aiSmellsRule = {
@@ -3285,6 +3285,7 @@ var useClientOveruseRule = {
 // src/rules/env-fallback-secret.ts
 var SENSITIVE_ENV = /process\.env\.(JWT_SECRET|SECRET_KEY|AUTH_SECRET|SESSION_SECRET|ENCRYPTION_KEY|API_SECRET|PRIVATE_KEY|SIGNING_KEY|NEXTAUTH_SECRET|TOKEN_SECRET|APP_SECRET|COOKIE_SECRET|HASH_SECRET)\s*(?:\|\||&&|\?\?)\s*['"`]/i;
 var ENV_FALLBACK = /process\.env\.\w*(SECRET|KEY|PASSWORD|TOKEN)\w*\s*(?:\|\||\?\?)\s*['"`]/i;
+var CONN_STRING_FALLBACK = /process\.env\.\w+\s*(?:\|\||\?\?)\s*['"`](?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\//i;
 var envFallbackSecretRule = {
   id: "env-fallback-secret",
   name: "Secret with Fallback Value",
@@ -3312,6 +3313,20 @@ var envFallbackSecretRule = {
         });
         continue;
       }
+      const connMatch = CONN_STRING_FALLBACK.exec(line);
+      if (connMatch) {
+        findings.push({
+          ruleId: "env-fallback-secret",
+          file: file.relativePath,
+          line: i + 1,
+          column: connMatch.index + 1,
+          message: "Connection string with credentials used as fallback \u2014 hardcoded DB/service URL becomes the production connection when env var is missing",
+          severity: "warning",
+          category: "security",
+          fix: "Fail fast when required env vars are missing instead of falling back to a default value"
+        });
+        continue;
+      }
       const genericMatch = ENV_FALLBACK.exec(line);
       if (genericMatch && !isConfigFile(file.relativePath)) {
         findings.push({
@@ -4486,6 +4501,199 @@ async function scan(options) {
   };
 }
 
+// src/reporter.ts
+import pc from "picocolors";
+var SEVERITY_COLORS = {
+  critical: pc.red,
+  warning: pc.yellow,
+  info: pc.blue
+};
+var SEVERITY_LABELS = {
+  critical: "CRIT",
+  warning: "WARN",
+  info: "INFO"
+};
+function scoreColor(score) {
+  if (score >= 80) return pc.green;
+  if (score >= 50) return pc.yellow;
+  return pc.red;
+}
+function groupByFile(findings) {
+  const map = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    const group = map.get(f.file) ?? [];
+    group.push(f);
+    map.set(f.file, group);
+  }
+  return map;
+}
+function reportPretty(result, opts = {}) {
+  const lines = [];
+  const { critical, warning, info } = result.summary;
+  lines.push("");
+  lines.push(pc.bold("  prodlint") + pc.dim(` v${result.version}`));
+  const headerParts = [`Scanned ${result.filesScanned} files`];
+  if (critical > 0) headerParts.push(`${critical} critical`);
+  if (warning > 0) headerParts.push(`${warning} warnings`);
+  if (info > 0) headerParts.push(`${info} info`);
+  lines.push(pc.dim(`  ${headerParts.join(" \xB7 ")}`));
+  lines.push("");
+  if (result.findings.length > 0) {
+    const grouped = groupByFile(result.findings);
+    for (const [file, findings] of grouped) {
+      lines.push(pc.underline(file));
+      for (const f of findings) {
+        const color = SEVERITY_COLORS[f.severity];
+        const label = SEVERITY_LABELS[f.severity];
+        lines.push(
+          `  ${pc.dim(`${f.line}:${f.column}`)}  ${color(label)}  ${f.message}  ${pc.dim(f.ruleId)}`
+        );
+        if (f.fix) {
+          lines.push(`  ${pc.dim(`      \u21B3 ${f.fix}`)}`);
+        }
+      }
+      lines.push("");
+    }
+  }
+  lines.push(pc.bold("  Scores"));
+  for (const cs of result.categoryScores) {
+    const color = scoreColor(cs.score);
+    const bar = renderBar(cs.score);
+    lines.push(`  ${cs.category.padEnd(14)} ${color(String(cs.score).padStart(3))} ${bar}  ${pc.dim(`(${cs.findingCount} issues)`)}`);
+  }
+  lines.push("");
+  const overallColor = scoreColor(result.overallScore);
+  lines.push(pc.bold(`  Overall: ${overallColor(String(result.overallScore))}/100`));
+  lines.push("");
+  const summaryParts = [];
+  if (critical > 0) summaryParts.push(pc.red(`${critical} critical`));
+  if (warning > 0) summaryParts.push(pc.yellow(`${warning} warnings`));
+  if (info > 0) summaryParts.push(pc.blue(`${info} info`));
+  if (summaryParts.length === 0) {
+    lines.push(pc.green("  No issues found!"));
+  } else {
+    lines.push(`  ${summaryParts.join(pc.dim(" \xB7 "))}`);
+  }
+  lines.push("");
+  if (!opts.quiet) {
+    const badgeColor = result.overallScore >= 80 ? "brightgreen" : result.overallScore >= 60 ? "yellow" : "red";
+    const badgeUrl = `https://img.shields.io/badge/prodlint-${result.overallScore}%2F100-${badgeColor}`;
+    lines.push(pc.dim("  Add to your README:"));
+    lines.push(pc.dim(`  [![prodlint](${badgeUrl})](https://prodlint.com)`));
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function reportJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+function reportSummary(result) {
+  const lines = [];
+  const { critical, warning, info } = result.summary;
+  const hasCritical = critical > 0;
+  const verdict = hasCritical ? pc.red(pc.bold("FAIL")) : pc.green(pc.bold("PASS"));
+  const scorePart = scoreColor(result.overallScore)(`${result.overallScore}/100`);
+  const countParts = [];
+  if (critical > 0) countParts.push(`${critical} critical`);
+  if (warning > 0) countParts.push(`${warning} warning`);
+  if (info > 0) countParts.push(`${info} info`);
+  lines.push("");
+  if (countParts.length > 0) {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} ${countParts.join(", ")} ${pc.dim(`(score: ${scorePart})`)}`);
+  } else {
+    lines.push(`  ${verdict} ${pc.dim("\u2014")} no issues ${pc.dim(`(score: ${scorePart})`)}`);
+  }
+  const topFindings = result.findings.filter((f) => f.severity === "critical" || f.severity === "warning").slice(0, 3);
+  if (topFindings.length > 0) {
+    for (let i = 0; i < topFindings.length; i++) {
+      const f = topFindings[i];
+      const color = SEVERITY_COLORS[f.severity];
+      const label = SEVERITY_LABELS[f.severity];
+      lines.push(`  ${pc.dim(`${i + 1}.`)} ${f.file}:${f.line} ${pc.dim("\u2014")} ${color(label)} ${f.message} ${pc.dim(f.ruleId)}`);
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+var SARIF_SEVERITY_MAP = {
+  critical: "error",
+  warning: "warning",
+  info: "note"
+};
+function reportSarif(result) {
+  const ruleMap = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    ruleMap.set(r.id, r);
+  }
+  const usedRuleIds = new Set(result.findings.map((f) => f.ruleId));
+  const sarifRules = [...usedRuleIds].map((id) => {
+    const rule = ruleMap.get(id);
+    return {
+      id,
+      name: rule?.name ?? id,
+      shortDescription: { text: rule?.description ?? id },
+      defaultConfiguration: {
+        level: SARIF_SEVERITY_MAP[rule?.severity ?? "info"] ?? "note"
+      },
+      helpUri: `https://prodlint.com/rules/${id}`
+    };
+  });
+  const sarifResults = result.findings.map((f) => {
+    const sarifResult = {
+      ruleId: f.ruleId,
+      level: SARIF_SEVERITY_MAP[f.severity] ?? "note",
+      message: { text: f.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: f.file.replace(/\\/g, "/") },
+            region: { startLine: f.line, startColumn: f.column }
+          }
+        }
+      ]
+    };
+    if (f.fix) {
+      sarifResult.fixes = [
+        {
+          description: { text: f.fix }
+        }
+      ];
+    }
+    return sarifResult;
+  });
+  const sarif = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "prodlint",
+            version: getVersion(),
+            informationUri: "https://prodlint.com",
+            rules: sarifRules
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+function renderBar(score) {
+  const width = 20;
+  const filled = Math.round(score / 100 * width);
+  const empty = width - filled;
+  const color = scoreColor(score);
+  return color("\u2588".repeat(filled)) + pc.dim("\u2591".repeat(empty));
+}
+var STATUS_ICONS = {
+  pass: pc.green,
+  fail: pc.red,
+  warn: pc.yellow,
+  info: pc.blue
+};
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4726,6 +4934,10 @@ async function runWebScan(targetUrl) {
   };
 }
 export {
+  reportJson,
+  reportPretty,
+  reportSarif,
+  reportSummary,
   rules,
   runWebScan,
   scan

package/dist/mcp.js

@@ -719,8 +719,8 @@ function summarizeFindings(findings) {
 
 // src/rules/secrets.ts
 var SECRET_PATTERNS = [
-  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{20,}/ },
-  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{20,}/ },
+  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{8,}/ },
+  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{8,}/ },
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/ },
   { name: "AWS secret key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/ },
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
@@ -1254,7 +1254,7 @@ var corsConfigRule = {
 };
 
 // src/rules/ai-smells.ts
-var CONSOLE_LOG_THRESHOLD = 5;
+var CONSOLE_LOG_THRESHOLD = 3;
 var ANY_TYPE_THRESHOLD = 5;
 var COMMENTED_CODE_THRESHOLD = 3;
 var aiSmellsRule = {
@@ -3294,6 +3294,7 @@ var useClientOveruseRule = {
 // src/rules/env-fallback-secret.ts
 var SENSITIVE_ENV = /process\.env\.(JWT_SECRET|SECRET_KEY|AUTH_SECRET|SESSION_SECRET|ENCRYPTION_KEY|API_SECRET|PRIVATE_KEY|SIGNING_KEY|NEXTAUTH_SECRET|TOKEN_SECRET|APP_SECRET|COOKIE_SECRET|HASH_SECRET)\s*(?:\|\||&&|\?\?)\s*['"`]/i;
 var ENV_FALLBACK = /process\.env\.\w*(SECRET|KEY|PASSWORD|TOKEN)\w*\s*(?:\|\||\?\?)\s*['"`]/i;
+var CONN_STRING_FALLBACK = /process\.env\.\w+\s*(?:\|\||\?\?)\s*['"`](?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\//i;
 var envFallbackSecretRule = {
   id: "env-fallback-secret",
   name: "Secret with Fallback Value",
@@ -3321,6 +3322,20 @@ var envFallbackSecretRule = {
         });
         continue;
       }
+      const connMatch = CONN_STRING_FALLBACK.exec(line);
+      if (connMatch) {
+        findings.push({
+          ruleId: "env-fallback-secret",
+          file: file.relativePath,
+          line: i + 1,
+          column: connMatch.index + 1,
+          message: "Connection string with credentials used as fallback \u2014 hardcoded DB/service URL becomes the production connection when env var is missing",
+          severity: "warning",
+          category: "security",
+          fix: "Fail fast when required env vars are missing instead of falling back to a default value"
+        });
+        continue;
+      }
       const genericMatch = ENV_FALLBACK.exec(line);
       if (genericMatch && !isConfigFile(file.relativePath)) {
         findings.push({
@@ -4796,9 +4811,9 @@ server.tool(
     if (result.findings.length > 0) {
       summary.push("", "### Findings");
       for (const f of result.findings.slice(0, 30)) {
-        summary.push(
-          `- **[${f.severity}]** \`${f.ruleId}\` ${f.file}:${f.line} \u2014 ${f.message}`
-        );
+        const line = `- **[${f.severity}]** \`${f.ruleId}\` ${f.file}:${f.line} \u2014 ${f.message}`;
+        summary.push(f.fix ? `${line}
+  - _Fix: ${f.fix}_` : line);
       }
       if (result.findings.length > 30) {
         summary.push(`- ...and ${result.findings.length - 30} more findings`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prodlint",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
   "license": "MIT",
   "author": "prodlint contributors",
@@ -46,6 +46,7 @@
     "@babel/parser": "^7.29.0",
     "@babel/types": "^7.29.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
+    "@rollup/rollup-win32-x64-msvc": "^4.59.0",
     "fast-glob": "^3.3.3",
     "picocolors": "^1.1.1",
     "zod": "^4.3.6"