safelaunch 1.0.33 → 1.0.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safelaunch",
-  "version": "1.0.33",
+  "version": "1.0.34",
   "description": "Backend Reliability Infrastructure - catch what breaks production before it breaks",
   "main": "index.js",
   "bin": {

package/src/scan.js

@@ -63,6 +63,11 @@ const IMPACTS = {
     impact: "Different tools read different copies. Behaviour is unpredictable — one service may use the wrong value.",
     fix:    `Remove the duplicate ${name} entry from your .env file.`,
   }),
+  ENV_NOT_GITIGNORED: () => ({
+    title:  ".env is not in .gitignore",
+    impact: "Your .env file could be committed to git, exposing secrets to anyone with repo access.",
+    fix:    "Add .env to your .gitignore file immediately.",
+  }),
   NODE_MODULES_STALE: () => ({
     title:  "node_modules may be out of date",
     impact: "package.json was modified after node_modules was last updated. You may be running old or missing dependencies.",
@@ -394,6 +399,22 @@ function renderInteractiveOutput(blockers, warnings, infos, elapsed) {
   return lines.join("\n");
 }
 
+
+function checkEnvGitignored(cwd) {
+  const issues = [];
+  if (!fileExists(path.join(cwd, ".env"))) return issues;
+  const gitignore = readFileSafe(path.join(cwd, ".gitignore"));
+  if (!gitignore) {
+    issues.push({ severity: "block", ...IMPACTS.ENV_NOT_GITIGNORED() });
+    return issues;
+  }
+  const lines = gitignore.split("\n").map(l => l.trim());
+  const ignored = lines.some(l => l === ".env" || l === "*.env" || l === ".env*");
+  if (!ignored) {
+    issues.push({ severity: "block", ...IMPACTS.ENV_NOT_GITIGNORED() });
+  }
+  return issues;
+}
 async function runScan(options = {}) {
   const { hookMode = false, quiet = false, cwd = process.cwd() } = options;
   const start = Date.now();
@@ -408,6 +429,7 @@ async function runScan(options = {}) {
     ...checkLockfileSync(cwd),
     ...checkTypeScript(cwd),
     ...checkNpmAudit(cwd),
+    ...checkEnvGitignored(cwd),
     ...checkNodeVersion(cwd),
     ...checkPythonVersion(cwd),
   ];