safefix 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Montassar (SafeFix)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,144 @@
-# Temporary Holding Version
+# SafeFix
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Find and fix security holes in apps built with AI tools like Lovable, Bolt, Cursor and Replit.
+
+SafeFix checks your project folder and your Supabase database. It explains each problem in
+plain English and gives you a fix: ready-to-run SQL or code when it is safe to write one.
+
+- **Database:** tables without Row Level Security, rules that let everyone in, risky functions
+  and views, public storage buckets.
+- **Leaked keys:** secret keys in your code, in your website bundle, or in `.env` files saved in git.
+- **App config, Docker, GitHub Actions:** open CORS, weak JWT secrets, debug mode, containers
+  that run as root, actions that are not pinned, and more.
+
+Needs Node.js 22.12 or newer. Full docs: <https://safefix.dev/docs>
+
+## Scan your project
+
+In your project folder:
+
+```sh
+npx safefix scan
+```
+
+To check your Supabase database too, put its connection string in an environment variable
+first (Supabase Dashboard > Connect > Session pooler). Then the password stays out of your
+shell history:
+
+```sh
+# macOS / Linux
+export SAFEFIX_DB_URL="postgresql://postgres.<project-ref>:<password>@<host>:5432/postgres"
+npx safefix scan --path .
+```
+
+```powershell
+# Windows PowerShell
+$env:SAFEFIX_DB_URL = "postgresql://postgres.<project-ref>:<password>@<host>:5432/postgres"
+npx safefix scan --path .
+```
+
+## Let your AI tool fix it
+
+```sh
+npx safefix scan --ai --output fix-prompt.md
+```
+
+Paste `fix-prompt.md` into Cursor, Claude Code, Lovable or Bolt. The prompt lists every
+problem with its fix, and rules for the AI: fix the most serious first, never turn off Row
+Level Security or delete data, never print secrets. Then scan again to prove it worked.
+
+## Use SafeFix inside your AI tool (MCP)
+
+SafeFix is also an MCP server. Your AI tool starts it for you; then just ask
+**"Is my app secure?"**
+
+**Claude Code**
+
+```sh
+claude mcp add safefix -- npx -y safefix mcp
+```
+
+**Cursor** (`.cursor/mcp.json`) and **Windsurf** (its `mcp_config.json`)
+
+```json
+{
+  "mcpServers": {
+    "safefix": { "command": "npx", "args": ["-y", "safefix", "mcp"] }
+  }
+}
+```
+
+**VS Code** (`.vscode/mcp.json`)
+
+```json
+{
+  "servers": {
+    "safefix": { "type": "stdio", "command": "npx", "args": ["-y", "safefix", "mcp"] }
+  }
+}
+```
+
+| Tool | What it does |
+| --- | --- |
+| `safefix_scan` | Scans the open workspace: grade, score, counts and findings (in pages). |
+| `safefix_explain` | One finding: why it matters, step-by-step fix, SQL or code. |
+| `safefix_verify` | Scans again and says which problems are fixed, still open or new. |
+| `safefix_upload` | Sends the last scan to your dashboard. Only when `SAFEFIX_TOKEN` is set. |
+
+The `fix_all` prompt walks your AI tool through fixing everything safely.
+
+- The server only scans inside your workspace, never your home folder or a whole disk. If your
+  AI tool starts it somewhere else, add `"--root", "/path/to/your/project"` to the args.
+- It checks your database only when `SAFEFIX_DB_URL` is in the server's `env` in that config.
+  Never paste a connection string into the chat.
+- On Windows, if your AI tool cannot start `npx`, use `"command": "cmd"` and
+  `"args": ["/c", "npx", "-y", "safefix", "mcp"]`.
+
+## Scan on every push (GitHub Actions)
+
+```sh
+npx safefix ci init
+```
+
+This writes `.github/workflows/safefix.yml`: a scan on every push, pull request and night,
+with a read-only token and actions pinned to commit SHAs. Add `--sarif` to also show the
+findings in GitHub's Security tab. Then save your dashboard token as a secret:
+
+```sh
+gh secret set SAFEFIX_TOKEN
+```
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `safefix scan` | Scan. Main options: `--path <dir>`, `--fail-on <severity>`, `--only <ids>`, `--format pretty\|json\|markdown\|sarif`, `--output <file>`, `--ai`, `--upload`. |
+| `safefix checks` | List every check. |
+| `safefix mcp` | Run the MCP server (stdio). |
+| `safefix ci init` | Write the GitHub Actions workflow. `--sarif`, `--force`. |
+
+Run `safefix <command> --help` for every option.
+
+**Exit codes:** 0 no problems at or above `--fail-on` (default `high`), 1 problems found,
+2 wrong options or the scan could not run, 3 the scan is incomplete (a check did not finish).
+
+## Privacy and safety
+
+- **Read-only.** Every database query runs in a read-only transaction that is rolled back.
+  SafeFix never changes your data or your files.
+- **Nothing leaves your computer** unless you use `--upload` (or `safefix_upload`, which only
+  exists when you set `SAFEFIX_TOKEN`). SafeFix talks only to your own database.
+- **Secrets stay secret.** Reports show keys masked, like `eyJh********abcd`, and never your
+  database password.
+- **Fixes are suggestions.** SafeFix never applies a fix by itself.
+- **Your projects only.** Scan projects you own or are allowed to test.
+
+## Dashboard
+
+Local scans are free and unlimited. To keep a history, get alerts and share reports with your
+team, upload your scans to <https://safefix.dev> with `--upload` and a `SAFEFIX_TOKEN`.
+Set `SAFEFIX_NO_PROMO=1` to hide the one-line reminder at the end of a scan.
+
+## License
+
+MIT. See [LICENSE](LICENSE). The SafeFix dashboard at safefix.dev is a separate, paid service.