reaproof 0.0.0-stage → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Junhan2
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,155 @@
-# Temporary Holding Version
+# Reaproof
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+One command that rates how exposed your shipped app is to AI reverse-engineering agents, and closes what can be closed.
+
+Tools such as [rea](https://github.com/morluto/rea) let a coding agent inspect a shipped app without its source, explain how a feature works and rebuild it. Reaproof checks what you ship for the things that make that easy, rates the risk, explains each finding in plain language, and fixes the ones that are safe to fix automatically.
+
+It is written for people who have never dealt with security before. There is nothing to install and nothing to configure. It needs Node.js 18.3 or later.
+
+## Three ways to use it
+
+### Yourself
+
+```bash
+npx reaproof
+```
+
+Run it in your project folder. It rates the risk, lists what it found, and when there is something it can close, it shows the list and asks before doing it. If nothing is built yet, it offers to run your build first.
+
+Nothing stays installed. `npx` comes with Node.js and fetches the package when you run it; the first time, it asks `Ok to proceed? (y)` before downloading. Answer `y`.
+
+To check a live site instead, give it the address:
+
+```bash
+npx reaproof https://your-site.example
+```
+
+### With an AI agent
+
+Say this to any coding agent that can run commands:
+
+> Run `npx reaproof --json` and fix what it reports.
+
+The JSON carries the risk level and, for every kind of finding, what it means and what to do, so the agent needs no setup. Paths, file names and addresses inside the findings are copied from the scanned files: characters a reader cannot see are removed, long text is cut, and every JSON answer opens by saying that this text is data to report, not instructions to follow.
+
+To make the agent reach for it by itself, install the skill once:
+
+```bash
+npx skills add Junhan2/reaproof
+```
+
+That works for Claude Code, Codex, Cursor, Gemini CLI and other agents. In Claude Code you can also install it as a plugin:
+
+```
+/plugin install reaproof --marketplace Junhan2/reaproof
+```
+
+On Claude Code older than 2.1.275, run `/plugin marketplace add Junhan2/reaproof` and then `/plugin install reaproof@reaproof`.
+
+### Automatically
+
+`npx reaproof` exits with 1 when something critical or high would ship, so it can stop a release. Add it after your build step.
+
+## Reading the result
+
+Every report starts with the risk.
+
+| rea risk | What it means |
+| --- | --- |
+| very high | A tool like rea can take your original source or your secret values as they are |
+| high | Near-secret values, data, or the inside of the running app are exposed |
+| moderate | The names and structure of your code read easily |
+| baseline | No leak was found. Minified code, server addresses and screen structure are still readable, as in any shipped app |
+
+There is no "safe" level, because there is no such state: see "What it cannot do".
+
+Below the risk, the report counts kinds of leak, each at its worst severity. Three hundred exposed maps are the same mistake as one. Notes are not counted.
+
+Exit codes: 0 when nothing critical or high was found, 1 when something was, 2 for a usage error.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `reaproof [path]` | Rates the risk of the build output, reports, and offers the fix |
+| `reaproof <https://your-site>` | Checks whether a deployed site serves its source maps |
+| `reaproof fix [path]` | Takes source map files out of the output, after showing the list and asking |
+| `reaproof undo [path]` | Puts back what the last fix took out |
+| `reaproof measure [path]` | Runs the real rea on the output and counts what it reads |
+
+Options: `--json` for machine-readable output, `--yes` to skip the question in `fix` and `measure`, `--lang ko|en` for the report language. Questions are asked only at a terminal; with `--json`, in a pipe or in CI nothing is asked and nothing is changed.
+
+The path can be a project folder, a build output folder, an Electron `.asar` archive or a packaged app. In a project folder Reaproof looks for `.next/static`, `out`, `dist`, `build`, `release` and `.output/public`.
+
+## What it checks
+
+| Finding | Severity | Automatic fix |
+| --- | --- | --- |
+| Settings files (`.env`), a `.git` folder, key stores, database files and debug symbols mixed into the output | Critical or high | No, delete them and stop them being copied in |
+| Server-only keys in shipped code: Stripe secret and restricted keys, Supabase secret and `service_role` keys, GitHub tokens, AWS access keys, private keys, AI service keys, database addresses that carry a password | Critical or high | No, revoke the key and move it to a server |
+| A secret value from the project's own `.env` that appears word for word in shipped code | Critical or high | No, change the value and move it to a server |
+| Source map files that contain your original source text | Critical | Yes |
+| Source maps embedded inside code files | Critical | No, turn it off in the build settings |
+| A macOS app signed with the development entitlement `get-task-allow` | High | No, leave it out of release signing |
+| Source map files that list file names without the source text | Medium | Yes |
+| A macOS app signed without the Hardened Runtime | Medium | No, turn it on when signing |
+| A packaged Electron app with development fuses left on (`runAsNode`, `nodeOptions`, `nodeCliInspect`) | Medium | No, turn them off with `@electron/fuses` |
+| Source and test files packed into the app or output | Medium | No, take them out of the packaging list |
+| Long text in client code that looks like an AI prompt | Medium, a guess | No, keep prompts on a server |
+| Code that is not minified | Medium | No, turn on minification |
+| Server addresses named in the code | Note | Cannot be hidden; a list to review |
+| Electron `.asar` archives, which anyone can unpack | Note | No |
+
+Keys that are meant for browsers, such as Stripe publishable keys and Supabase `anon` and publishable keys, are not reported. Secrets are never printed in full, and values from `.env` are reported by variable name only.
+
+For the `.env` comparison, variables with a prefix their framework documents as public (`NEXT_PUBLIC_`, `VITE_`, `REACT_APP_`, `PUBLIC_`, `EXPO_PUBLIC_`) are expected in the output, unless the name itself says `SECRET`, `PRIVATE`, `PASSWORD` or `SERVICE_ROLE`.
+
+## What it cannot do
+
+Reaproof does not make an app impossible to copy. Nothing can.
+
+- Screen structure and the server addresses your app calls stay readable, because they have to reach the user's device.
+- Minified code stays readable in structure, and its numbers and strings stay as they are.
+- The only logic nobody can read is logic that runs on your server. Reaproof says so in every report.
+
+## How the fix works
+
+The fix moves standalone `.map` files out of the build output into `~/.reaproof/backups/`, outside your project, so a backup is never deployed by accident. It never edits your code files, because changing them would break integrity hashes. `reaproof undo` moves the files back.
+
+The next build creates the maps again unless you turn them off. The report tells you which setting to change for Next.js, Vite and Create React App.
+
+If a hosting platform builds your project from the repository, a local fix does not reach what gets deployed. Change the build setting, deploy, and check the deployed site.
+
+## Checking a deployed site
+
+`npx reaproof https://your-site.example` reads one page and the code files that page loads from its own address, at most 60 of them, one after another. For each code file it looks for a map where the file or the server says one is, and beside the file, where a "hidden" map is written. Nothing fetched is saved.
+
+If the address you type redirects, to `www` or to `https` for example, the place it ends up is the site that gets checked. A code file that redirects to another site is not followed, and a file that names many maps is asked for the last one only, so what a page serves cannot send the check anywhere else.
+
+It checks source maps only. Looking for keys and stray files is done on the build output, by someone who holds the files. Code that the page loads later or from another address is not checked, and the report says how many files were left out. Use it on sites you run.
+
+## Measuring with the real rea
+
+`reaproof measure` downloads the `rea-agents` package with `npx` and runs its static JavaScript analysis on your build output only, with install scripts disabled. rea is someone else's program, so the command asks before it does that; in a script or with an AI agent, pass `--yes`. It reports how many readable source maps, original file names, server addresses, request sites and functions rea recovered. Run it before and after the fix to see the difference.
+
+It runs one fixed release of rea, 6.4.0, the one this version was tested against. A published release cannot change afterwards. Newer releases are adopted here after they have been tested.
+
+## Not covered yet
+
+- Android apps. There was no real APK to test a check against, so none was written.
+- Electron fuses of Linux builds. macOS apps and Windows `.exe` files are read.
+- iOS apps and symbol stripping in native binaries.
+- Public-variable prefixes of frameworks other than the five listed above.
+- Files larger than 30 MB. They are not read, and the report counts them as skipped, so a source map that large goes unrated.
+
+## Development
+
+```bash
+npm test
+```
+
+No dependencies. Node.js 18.3 or later. The macOS signing test runs only on a Mac with `clang` and `codesign`; it builds and signs throwaway bundles and never starts them.
+
+## License
+
+MIT

package/bin/reaproof.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import { createInterface } from 'node:readline/promises';
+import { main } from '../src/cli.mjs';
+
+// Questions are asked only when a person is at both ends of the terminal.
+const isAttended = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+
+process.exitCode = await main(process.argv.slice(2), {
+  print: (text) => console.log(text),
+  printError: (text) => console.error(text),
+  ask: isAttended ? askYesOrNo : null,
+  runBuild: ([program, ...args], directory) =>
+    spawnSync(program, args, { cwd: directory, stdio: 'inherit', shell: process.platform === 'win32' }).status === 0,
+});
+
+async function askYesOrNo(question) {
+  const readline = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return /^y(es)?$/i.test((await readline.question(question)).trim());
+  } catch {
+    // Ctrl+D or an input that closed mid-question is a "no", not a crash.
+    console.log('');
+    return false;
+  } finally {
+    readline.close();
+  }
+}

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "reaproof",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "description": "One command that shows what AI reverse-engineering agents can read from your shipped app, and closes what can be closed.",
+  "keywords": [
+    "security",
+    "source-maps",
+    "secrets",
+    "reverse-engineering",
+    "rea",
+    "electron",
+    "cli"
+  ],
+  "homepage": "https://github.com/Junhan2/reaproof#readme",
+  "bugs": {
+    "url": "https://github.com/Junhan2/reaproof/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Junhan2/reaproof.git"
+  },
+  "license": "MIT",
+  "author": "Junhan2",
+  "type": "module",
+  "bin": {
+    "reaproof": "bin/reaproof.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "skills",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.3"
+  },
+  "scripts": {
+    "test": "node --test"
+  }
+}

package/skills/reaproof/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: reaproof
+description: Checks what AI reverse-engineering agents such as rea can read from a shipped web, Electron or macOS build, and closes what can be closed. Use when the user asks to protect their app from being cloned or reverse engineered, mentions rea, or asks before a release whether source maps, secret keys or stray files are exposed.
+---
+
+# Reaproof
+
+The user may have no security background. Explain every finding by its effect on them, in plain words, before changing anything. Use this only on software and sites the user owns.
+
+## Steps
+
+1. Check that a build output exists. If it does not, ask before running the project's build command.
+2. Run `npx reaproof --json` in the project folder. In the result, `risk` is the overall level (`very-high`, `high`, `moderate` or `baseline`), `leaks` counts kinds of leak by severity, `findings` lists each one with its `rule`, and `explain` says in words what the risk and each rule mean and whether `reaproof fix --yes` closes it.
+3. Tell the user the risk level first, then what is exposed, why it matters and what you propose to change. Start with critical and high findings.
+4. After the user agrees, apply the fixes below.
+5. Rebuild and run `npx reaproof` again to confirm.
+6. After deploying, run `npx reaproof https://their-site` to confirm the deployed site no longer serves source maps. A local fix does not reach a site that a hosting platform builds from the repository.
+
+## Fixes by finding
+
+- `sourcemap-sources`, `sourcemap-names`: run `npx reaproof fix --yes`. It moves standalone map files into a backup outside the project; `npx reaproof undo` reverses it. Then make it last by changing the build setting:
+  - Next.js: remove `productionBrowserSourceMaps: true` from `next.config`.
+  - Vite: set `build.sourcemap` to `false`. `'hidden'` still writes the map files into the output.
+  - Create React App: build with `GENERATE_SOURCEMAP=false`.
+  - If an error tracker needs the maps, upload them there and delete them from the output afterwards.
+- `sourcemap-inline`: only the build setting fixes it.
+- `stray-file`: delete the file from the output and find what copies it in, usually a `public` folder or a packaging file list.
+- `secret`, `env-value`: see "Secret values" below.
+- `unshipped-source`, `unminified-code`: adjust the packaging file list and turn on minification.
+- `electron-fuse`: turn the listed fuses off at package time with `@electron/fuses`.
+- `macos-entitlement`, `macos-runtime`: sign the release without `get-task-allow` and with the Hardened Runtime.
+- `prompt-candidate`: a guess. If it is a prompt, move it to a server.
+- `endpoint`: a list, not a leak. Review with the user that each address checks who is calling.
+
+## Secret values
+
+A `secret` or `env-value` finding means a server-only value is inside code that reaches users. Removing it from the code is not enough, because the shipped copies already contain it.
+
+1. Tell the user to revoke or change the value where it was issued.
+2. Move the call that needs it to the user's server, for example a route handler or a serverless function, and read the value from a server environment variable without a public prefix.
+3. Rebuild and run the check again.
+
+## Showing the effect
+
+`npx reaproof measure` downloads the `rea-agents` package and runs it on the build output to count what the real tool reads. Ask before running it, because it downloads and runs a third-party package. Run it before and after the fix when the user wants to see the difference.
+
+## Limits to state plainly
+
+Never tell the user the app can no longer be copied. The lowest risk level is `baseline`, not "safe": it means no leak was found, nothing more. Screen structure, server addresses and the logic inside minified code stay readable. Logic that must not be copied, such as pricing or permission checks, belongs on a server.

package/src/asar.mjs

@@ -0,0 +1,78 @@
+import { closeSync, fstatSync, openSync } from 'node:fs';
+import { readAt } from './bytes.mjs';
+
+const SIZE_PICKLE_BYTES = 8;
+const MAX_HEADER_BYTES = 64 * 1024 * 1024;
+
+/**
+ * @typedef {{ path: string, name: string, isDirectory: false, size: number, offset: number }} AsarFile
+ * @typedef {{ path: string, name: string, isDirectory: true, node: object }} AsarDirectory
+ *   `node` is the directory's own part of the header, kept for `list`
+ */
+
+/**
+ * Opens an Electron ASAR archive for reading without unpacking it.
+ *
+ * Layout (electron/asar README): | UInt32: header_size | String: header | Bytes: file1 | ... |
+ * Both leading fields are Chromium Pickle objects: a UInt32 payload length, then the payload.
+ * File offsets in the header are decimal strings counted from the end of the header.
+ *
+ * @param {string} archivePath
+ * @returns {{
+ *   root: AsarDirectory,
+ *   fileCount: number,
+ *   list(directory: AsarDirectory): (AsarFile | AsarDirectory)[],
+ *   read(file: AsarFile): Buffer,
+ *   close(): void,
+ * }}
+ */
+export function openAsar(archivePath) {
+  const fd = openSync(archivePath, 'r');
+  try {
+    const archiveBytes = fstatSync(fd).size;
+    const headerPickleBytes = readAt(fd, 0, SIZE_PICKLE_BYTES).readUInt32LE(4);
+    const isPlausibleHeader =
+      headerPickleBytes >= 8 &&
+      headerPickleBytes <= MAX_HEADER_BYTES &&
+      SIZE_PICKLE_BYTES + headerPickleBytes <= archiveBytes;
+    if (!isPlausibleHeader) throw new Error('not a readable ASAR archive');
+
+    const headerPickle = readAt(fd, SIZE_PICKLE_BYTES, headerPickleBytes);
+    const jsonBytes = headerPickle.readUInt32LE(4);
+    const header = JSON.parse(headerPickle.toString('utf8', 8, 8 + jsonBytes));
+    const dataStart = SIZE_PICKLE_BYTES + headerPickleBytes;
+
+    const root = { path: '', name: '', isDirectory: true, node: header };
+    return {
+      root,
+      // Counting goes through the whole header, so a malformed one fails here, before a caller reports anything.
+      fileCount: countFiles(root),
+      list: listEntries,
+      read: (file) => readAt(fd, dataStart + file.offset, file.size),
+      close: () => closeSync(fd),
+    };
+  } catch (error) {
+    closeSync(fd);
+    throw error;
+  }
+}
+
+/** What sits directly inside one directory, of the things stored in the archive itself. */
+function listEntries({ path: directoryPath, node }) {
+  const entries = [];
+  for (const [name, entry] of Object.entries(node.files ?? {})) {
+    const path = directoryPath ? `${directoryPath}/${name}` : name;
+    if (entry.files) entries.push({ path, name, isDirectory: true, node: entry });
+    // Symlinks have no bytes; unpacked entries live next to the archive, not in it.
+    else if (entry.link === undefined && !entry.unpacked) {
+      entries.push({ path, name, isDirectory: false, size: entry.size, offset: Number(entry.offset) });
+    }
+  }
+  return entries;
+}
+
+function countFiles(directory) {
+  let count = 0;
+  for (const entry of listEntries(directory)) count += entry.isDirectory ? countFiles(entry) : 1;
+  return count;
+}

package/src/bytes.mjs

@@ -0,0 +1,9 @@
+import { readSync } from 'node:fs';
+
+/** Reads exactly `length` bytes at `position`; a file that ends sooner is not what the caller took it for. */
+export function readAt(fd, position, length) {
+  const buffer = Buffer.alloc(length);
+  const bytesRead = readSync(fd, buffer, 0, length, position);
+  if (bytesRead !== length) throw new Error('unexpected end of file');
+  return buffer;
+}

package/src/checks/content.mjs

@@ -0,0 +1,116 @@
+// Checks on what a code file says, beyond maps and keys.
+
+// Hand-written code averages a few dozen characters a line; minified output runs to thousands.
+// A file of a few lines says too little either way.
+const MIN_HANDWRITTEN_LINES = 10;
+const MAX_HANDWRITTEN_LINE_LENGTH = 200;
+
+const ABSOLUTE_ADDRESS = /https?:\/\/[A-Za-z0-9.-]{1,253}(?::\d{1,5})?(?:\/[A-Za-z0-9_\-./%:@~+]{0,200})?/g;
+const RELATIVE_API_PATH = /["'`](\/(?:api|graphql|rest|rpc)\b[A-Za-z0-9_\-./:[\]{}$]{0,120})/g;
+const API_HOST = /^api[.-]|[.-]api[.-]/i;
+const API_PATH = /(?:^|\/)(?:api|graphql|rest|rpc|v\d{1,2})(?:\/|$)/i;
+const MAX_ADDRESSES_PER_FILE = 50;
+
+// A prompt assigns a role and then gives orders. Library warnings ("You are using an outdated
+// version...") do the first half only, so both halves are required.
+const PROMPT_OPENING = /You are (?:an?|the) |Your task is |당신은 |너는 /g;
+const PROMPT_DIRECTIVE = /\b(?:always|never|must|do not|don't|should)\b|반드시|절대|하지 마|해야/i;
+const QUOTES = ['"', "'", '`'];
+const MIN_PROMPT_LENGTH = 160;
+const MAX_PROMPT_LENGTH = 6000;
+const MIN_PROMPT_SPACES = 20;
+const PROMPT_PREVIEW_LENGTH = 60;
+
+/** Code that kept its names and line breaks reads as written. */
+export function checkUnminifiedCode(path, text) {
+  const lineCount = countLines(text);
+  const averageLineLength = Math.round(text.length / lineCount);
+  if (lineCount < MIN_HANDWRITTEN_LINES || averageLineLength >= MAX_HANDWRITTEN_LINE_LENGTH) return [];
+  return [{ rule: 'unminified-code', severity: 'medium', path, detail: { averageLineLength } }];
+}
+
+/**
+ * Lists the server addresses a code file names. They cannot be hidden, so this is a note
+ * for the owner to review, not a leak.
+ */
+export function checkEndpoints(path, text) {
+  const addresses = new Set();
+  for (const [address] of text.matchAll(ABSOLUTE_ADDRESS)) {
+    if (looksLikeApi(address)) addresses.add(address);
+  }
+  for (const [, apiPath] of text.matchAll(RELATIVE_API_PATH)) addresses.add(apiPath);
+  if (addresses.size === 0) return [];
+  const listed = [...addresses].slice(0, MAX_ADDRESSES_PER_FILE);
+  return [{ rule: 'endpoint', severity: 'info', path, detail: { addresses: listed } }];
+}
+
+/**
+ * Finds long instruction-like strings, the shape of a prompt written into client code.
+ * It is a guess from wording, so it is reported as a candidate.
+ */
+export function checkPromptCandidates(path, text) {
+  const findings = [];
+  const reportedStarts = new Set();
+  for (const { index } of text.matchAll(PROMPT_OPENING)) {
+    const literal = enclosingStringLiteral(text, index);
+    if (!literal || reportedStarts.has(literal.start) || !PROMPT_DIRECTIVE.test(literal.text)) continue;
+    reportedStarts.add(literal.start);
+    const preview = literal.text.slice(0, PROMPT_PREVIEW_LENGTH).replace(/\s+/g, ' ');
+    findings.push({ rule: 'prompt-candidate', severity: 'medium', path, detail: { preview, length: literal.text.length } });
+  }
+  return findings;
+}
+
+function countLines(text) {
+  let lines = 1;
+  for (let index = text.indexOf('\n'); index !== -1; index = text.indexOf('\n', index + 1)) lines += 1;
+  return lines;
+}
+
+function looksLikeApi(address) {
+  try {
+    const { hostname, pathname } = new URL(address);
+    return API_HOST.test(hostname) || API_PATH.test(pathname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The longest prose-like string literal around a position. Each quote style is tried,
+ * because an apostrophe inside the prose would otherwise end the literal early.
+ */
+function enclosingStringLiteral(text, position) {
+  let best = null;
+  for (const quote of QUOTES) {
+    const start = previousUnescaped(text, quote, position);
+    if (start === -1) continue;
+    const end = nextUnescaped(text, quote, position);
+    if (end === -1) continue;
+    const literal = text.slice(start + 1, end);
+    const isProse = literal.length >= MIN_PROMPT_LENGTH && literal.split(' ').length > MIN_PROMPT_SPACES;
+    if (isProse && (!best || literal.length > best.text.length)) best = { start, text: literal };
+  }
+  return best;
+}
+
+// Both searches stay inside a window of MAX_PROMPT_LENGTH characters and use the built-in
+// search, so a window without the quote costs one short search, not a step per character.
+function previousUnescaped(text, quote, position) {
+  const earliest = Math.max(0, position - MAX_PROMPT_LENGTH);
+  const before = text.slice(earliest, position);
+  for (let index = before.lastIndexOf(quote); index !== -1; index = before.lastIndexOf(quote, index - 1)) {
+    if (text[earliest + index - 1] !== '\\') return earliest + index;
+    // `lastIndexOf` treats a start below zero as zero and would find this same quote again.
+    if (index === 0) break;
+  }
+  return -1;
+}
+
+function nextUnescaped(text, quote, position) {
+  const after = text.slice(position, position + MAX_PROMPT_LENGTH);
+  for (let index = after.indexOf(quote); index !== -1; index = after.indexOf(quote, index + 1)) {
+    if (text[position + index - 1] !== '\\') return position + index;
+  }
+  return -1;
+}

package/src/checks/paths.mjs

@@ -0,0 +1,70 @@
+// Checks that need only a name, so they also cover files too large or too binary to read.
+
+const ENV_TEMPLATE_SUFFIX = /\.(?:example|sample|template|dist|defaults?)$/i;
+const KEY_FILE_NAMES = new Set(['id_rsa', 'id_dsa', 'id_ecdsa', 'id_ed25519', '.npmrc', '.netrc', '.htpasswd']);
+const KEY_FILE_EXTENSIONS = new Set(['.p12', '.pfx', '.jks', '.keystore']);
+const DATABASE_EXTENSIONS = new Set(['.sql', '.sqlite', '.sqlite3', '.db', '.dump', '.bak']);
+// Windows writes this thumbnail cache next to images; it is not application data.
+const HARMLESS_DATABASE_NAMES = new Set(['Thumbs.db']);
+const STRAY_SEVERITY = { env: 'critical', git: 'critical', 'key-file': 'critical', database: 'high', 'debug-symbols': 'high' };
+
+const ALWAYS_SOURCE_EXTENSIONS = new Set(['.tsx', '.vue', '.svelte']);
+const TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+
+/**
+ * A file that should never be part of what ships: settings with secrets, key stores, data dumps.
+ *
+ * @param {{ path: string, name: string, extension: string }} file
+ */
+export function checkStrayFile({ path, name, extension }) {
+  const kind = strayFileKind(name, extension);
+  return kind ? [strayFinding(path, kind)] : [];
+}
+
+/** A whole directory that should never ship. It is reported once and not looked into. */
+export function checkStrayDirectory({ path, name }) {
+  const kind = strayDirectoryKind(name);
+  return kind ? [strayFinding(path, kind)] : [];
+}
+
+/** @returns {'git' | 'debug-symbols' | null} null for a directory that may ship */
+export function strayDirectoryKind(name) {
+  if (name === '.git') return 'git';
+  if (name.endsWith('.dSYM')) return 'debug-symbols';
+  return null;
+}
+
+/**
+ * Source and test files that a build should have left behind.
+ *
+ * @param {{ path: string, name: string, extension: string, isInsideArchive: boolean }} file
+ */
+export function checkUnshippedSource({ path, name, extension, isInsideArchive }) {
+  const segments = path.split('/');
+  if (TEST_FILE.test(name) || segments.includes('__tests__')) return [sourceFinding(path, 'test')];
+  if (ALWAYS_SOURCE_EXTENSIONS.has(extension)) return [sourceFinding(path, 'source')];
+  // On a website `.ts` is usually a video segment; inside an app or under `src` it is TypeScript.
+  const isTypeScript = extension === '.ts' && !name.endsWith('.d.ts');
+  if (isTypeScript && (isInsideArchive || segments.includes('src'))) return [sourceFinding(path, 'source')];
+  return [];
+}
+
+/** A dotenv file that holds real values, as opposed to a template with the values left blank. */
+export function isEnvFileName(name) {
+  return name === '.env' || (name.startsWith('.env.') && !ENV_TEMPLATE_SUFFIX.test(name));
+}
+
+function strayFileKind(name, extension) {
+  if (isEnvFileName(name)) return 'env';
+  if (KEY_FILE_NAMES.has(name) || KEY_FILE_EXTENSIONS.has(extension)) return 'key-file';
+  if (DATABASE_EXTENSIONS.has(extension) && !HARMLESS_DATABASE_NAMES.has(name)) return 'database';
+  return null;
+}
+
+function strayFinding(path, kind) {
+  return { rule: 'stray-file', severity: STRAY_SEVERITY[kind], path, detail: { kind } };
+}
+
+function sourceFinding(path, kind) {
+  return { rule: 'unshipped-source', severity: 'medium', path, detail: { kind } };
+}