safelaunch 1.0.32 → 1.0.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safelaunch",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "description": "Backend Reliability Infrastructure - catch what breaks production before it breaks",
   "main": "index.js",
   "bin": {

package/src/scan.js

@@ -63,11 +63,31 @@ const IMPACTS = {
     impact: "Different tools read different copies. Behaviour is unpredictable — one service may use the wrong value.",
     fix:    `Remove the duplicate ${name} entry from your .env file.`,
   }),
+  ENV_NOT_GITIGNORED: () => ({
+    title:  ".env is not in .gitignore",
+    impact: "Your .env file could be committed to git, exposing secrets to anyone with repo access.",
+    fix:    "Add .env to your .gitignore file immediately.",
+  }),
+  NODE_MODULES_STALE: () => ({
+    title:  "node_modules may be out of date",
+    impact: "package.json was modified after node_modules was last updated. You may be running old or missing dependencies.",
+    fix:    "Run npm install to sync your dependencies.",
+  }),
   MISSING_NODE_MODULES: () => ({
     title:  "node_modules is missing",
     impact: "The app won't start. Nothing is installed.",
     fix:    "Run npm install.",
   }),
+  AUDIT_HIGH: (count) => ({
+    title:  `${count} high-severity vulnerability${count > 1 ? "ies" : "y"} in dependencies`,
+    impact: "Known vulnerabilities exist that could be exploited. These should be fixed before deploying.",
+    fix:    "Run npm audit fix or check npm audit for manual fixes.",
+  }),
+  AUDIT_HIGH: (count) => ({
+    title:  `${count} high-severity vulnerability${count > 1 ? "ies" : "y"} in dependencies`,
+    impact: "Known vulnerabilities exist that could be exploited. These should be fixed before deploying.",
+    fix:    "Run npm audit fix or check npm audit for manual fixes.",
+  }),
   AUDIT_CRITICAL: (count) => ({
     title:  `${count} critical vulnerability${count > 1 ? "ies" : "y"} in dependencies`,
     impact: "Known exploits exist for these packages. Shipping them puts your users and infrastructure at risk.",
@@ -200,12 +220,21 @@ function checkNodeModules(cwd) {
   if (!fileExists(pkgPath)) return issues;
   try {
     const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-    const deps = Object.keys(pkg.dependencies || {});
+    const deps = Object.keys({ ...pkg.dependencies, ...pkg.devDependencies });
     if (deps.length === 0) return issues;
   } catch { return issues; }
-  if (!fileExists(path.join(cwd, "node_modules"))) {
+  const nmPath = path.join(cwd, "node_modules");
+  if (!fileExists(nmPath)) {
     issues.push({ severity: "block", ...IMPACTS.MISSING_NODE_MODULES() });
+    return issues;
   }
+  try {
+    const pkgStat = fs.statSync(pkgPath);
+    const nmStat  = fs.statSync(nmPath);
+    if (pkgStat.mtimeMs > nmStat.mtimeMs) {
+      issues.push({ severity: "warn", ...IMPACTS.NODE_MODULES_STALE() });
+    }
+  } catch {}
   return issues;
 }
 
@@ -213,12 +242,15 @@ function checkNpmAudit(cwd) {
   const issues = [];
   if (!fileExists(path.join(cwd, "package.json"))) return issues;
   try {
-    execSync("npm audit --audit-level=critical --json", { cwd, encoding: "utf8", stdio: ["pipe","pipe","pipe"] });
+    execSync("npm audit --json", { cwd, encoding: "utf8", stdio: ["pipe","pipe","pipe"] });
   } catch (e) {
     try {
       const data = JSON.parse(e.stdout || "");
-      const critCount = (data.metadata && data.metadata.vulnerabilities && data.metadata.vulnerabilities.critical) || 0;
-      if (critCount > 0) issues.push({ severity: "warn", ...IMPACTS.AUDIT_CRITICAL(critCount) });
+      const vulns = (data.metadata && data.metadata.vulnerabilities) || {};
+      const critCount = vulns.critical || 0;
+      const highCount = vulns.high || 0;
+      if (critCount > 0) issues.push({ severity: "block", ...IMPACTS.AUDIT_CRITICAL(critCount) });
+      if (highCount > 0) issues.push({ severity: "warn", ...IMPACTS.AUDIT_HIGH(highCount) });
     } catch {}
   }
   return issues;
@@ -367,6 +399,22 @@ function renderInteractiveOutput(blockers, warnings, infos, elapsed) {
   return lines.join("\n");
 }
 
+
+function checkEnvGitignored(cwd) {
+  const issues = [];
+  if (!fileExists(path.join(cwd, ".env"))) return issues;
+  const gitignore = readFileSafe(path.join(cwd, ".gitignore"));
+  if (!gitignore) {
+    issues.push({ severity: "block", ...IMPACTS.ENV_NOT_GITIGNORED() });
+    return issues;
+  }
+  const lines = gitignore.split("\n").map(l => l.trim());
+  const ignored = lines.some(l => l === ".env" || l === "*.env" || l === ".env*");
+  if (!ignored) {
+    issues.push({ severity: "block", ...IMPACTS.ENV_NOT_GITIGNORED() });
+  }
+  return issues;
+}
 async function runScan(options = {}) {
   const { hookMode = false, quiet = false, cwd = process.cwd() } = options;
   const start = Date.now();
@@ -381,6 +429,7 @@ async function runScan(options = {}) {
     ...checkLockfileSync(cwd),
     ...checkTypeScript(cwd),
     ...checkNpmAudit(cwd),
+    ...checkEnvGitignored(cwd),
     ...checkNodeVersion(cwd),
     ...checkPythonVersion(cwd),
   ];