safetyvibe-connect 0.2.1 → 0.3.0

package/AGENTS.md

@@ -1,78 +1,96 @@
-# Instructions for cautious AI coding agents
+# SafetyVibe Connect instructions
 
-Reports dependency inventory and, if used, the Supabase project URL + public key to SafetyVibe. Requires Node >=18; no dependencies or package install scripts.
+SafetyVibe Connect reads package.json, the lockfile, and client-exposed Supabase config (client-prefixed env vars and the client Supabase file). It reports your package list so we can warn you about vulnerable dependencies. The JSON body sends exactly: v, optional name, url, platform and environment, lockfile, versions_source, source, packages, optional truncated, and supabase (null, or project_ref and host with key_kind and key_fingerprint, or secret_key_exposed_client_side). It never sends Supabase keys, secrets or file contents. Requires Node >=18; no dependencies or package install scripts.
+
+Full source: https://safetyvibe.eu/connect/source/0.3.0
 
 ## Run without installing
 
 Get a claim token from the dashboard, then run:
 
 ```sh
-npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+npx -y safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 # pnpm
-pnpm dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+pnpm dlx safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 # bun
-bunx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+bunx safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 # yarn
-yarn dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+yarn dlx safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 ```
 
 Add `--url <published URL>` if known. Without a token, setup prints a claim link.
 On Replit/pnpm projects, `npm install` can fail with "Cannot read properties of null (reading 'isDescendantOf')".
 Use `pnpm add -D safetyvibe-connect`, or run without installing:
-`npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>`.
+`npx -y safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>`.
 Optional installation commands: `npm install -D safetyvibe-connect`, `pnpm add -D safetyvibe-connect`, `bun add -d safetyvibe-connect`, `yarn add -D safetyvibe-connect`.
 
 ## Exactly what is sent
 
-For cautious AI coding agents: inspect the report before sending it:
+Preview the report before sending it:
 
 ```sh
-npx -y safetyvibe-connect@0.2.1 setup --dry-run --url https://notes.example.com
+npx -y safetyvibe-connect@0.3.0 setup --dry-run --url https://notes.example.com
 ```
 
-stdout is exactly the JSON body; stderr lists destination and header names with values hidden, plus safety warnings (also under --quiet). Dry-run makes no requests and writes no files.
+By default dry-run stdout is exactly the pretty JSON body plus a newline. Its stderr carries five summary lines: Platform, Lockfile (package and dev-only counts), Supabase (fingerprint or exposed-secret flag only), Keys sent: 0, and Dry run: nothing sent. The summary is under 400 characters. It is followed by a plain explanation, destination and header names with values hidden, then one-line warnings (including any "Dropped <field>: it looked like a key." notices). Dry-run makes no requests. With --dry-run --out report.json, the body is written to that file without sending; otherwise JSON goes to stdout and the summary to stderr.
+
+Real runs print the summary on stdout, ending with Connected: and the dashboard or validated claim link (printed once). --quiet suppresses success chatter, but safety warnings always appear on stderr, including during dry runs. Accepted reports show the Connected line even if saving local config or installing the hook fails; warnings and errors follow the summary. Rejected or unreachable reports have no Connected line.
+
+--summary prints only the summary on stdout in dry and real runs, with warnings on stderr and no JSON or follow-up chatter. --out <file.json> (also --out=file.json) writes the exact JSON body plus newline instead of printing JSON; in dry runs stdout stays empty and the summary stays on stderr unless --summary is also used. It works for real runs too. The file must be new, end in .json, and resolve inside the project root with an existing parent directory; parent symlink escapes are refused. It uses exclusive creation and never overwrites files. Connector config filenames and package.json are reserved so later setup writes cannot replace the exported body. Invalid output paths exit 2 for setup/dry run; scan always exits 0 with an error on stderr.
 Example (optional `truncated` appears only when the inventory exceeds 5000):
 
 ```json
 {
   "v": 1,
-  "name": "notes",
+  "name": "notes.example.com",
   "url": "https://notes.example.com",
-  "platform": "Lovable",
   "environment": "production",
   "lockfile": "package-lock.json",
+  "versions_source": "lockfile",
+  "source": "connector",
   "packages": [{ "ecosystem": "npm", "name": "vite", "version": "6.0.0", "dev": true }],
-  "supabase": { "url": "https://example.supabase.co", "key": "sb_publishable_abc123def456", "kind": "publishable" }
+  "supabase": { "project_ref": "abcdefghijklmnopqrst", "host": "abcdefghijklmnopqrst.supabase.co", "key_kind": "anon", "key_fingerprint": "12ab34cd" }
 }
 ```
 
 - `v`: report format version.
-- `name`: explicit name, package name, URL host or folder name, skipping template and key-like names; limited to 80 letters, digits, spaces, @ / . _ -; otherwise empty.
-- `url`: HTTP(S) origin and path only, without credentials, query or fragment; paths are kept only with up to eight safe ASCII segments of at most 40 characters, excluding sb_, svk_ and eyJ markers; otherwise empty.
-- `platform`: detected project builder/hosting label; otherwise empty.
-- `environment`: `SAFETYVIBE_ENV`, or production when `NODE_ENV=production`; limited to 20 letters, digits, underscores or hyphens; otherwise empty.
-- `lockfile`: selected lockfile filename, `node_modules`, or `none`. Parent locks and node_modules are used only at workspace roots when the project matches a workspace glob in package.json workspaces (array or workspaces.packages) or the pnpm-workspace.yaml packages list. Literal paths, * and ** are supported; negated globs exclude matching paths from membership. Search stops at .git or six parent levels.
-- `packages`: registry package names and versions, npm ecosystem, and optional `dev: true` for dev-only dependencies when recorded in the lockfile. Workspace entries are excluded; incompatible optional npm binaries are excluded.
+- `name`: explicit or rc name, then URL host (first label for platform hosts), then package name, skipping template and key-like names; limited to 80 letters, digits, spaces, @ / . _ -; omitted when unknown.
+- `url`: HTTP(S) origin and path only, without credentials, query or fragment; paths are kept only with up to eight safe ASCII segments of at most 40 characters, excluding sb_, svk_ and eyJ markers; key-like hostnames are rejected; omitted when unknown.
+- `platform`: detected project builder/hosting label; omitted when unknown.
+- `environment`: `SAFETYVIBE_ENV`, or production when `NODE_ENV=production`; limited to 20 letters, digits, underscores or hyphens; omitted when unknown.
+- `lockfile`: selected lockfile filename, or `none` when no readable lockfile exists. Parent locks are used only at workspace roots when the project matches a workspace glob in package.json workspaces (array or workspaces.packages) or the pnpm-workspace.yaml packages list. Literal paths, * and ** are supported; negated globs exclude matching paths from membership. Search stops at .git or six parent levels.
+- `packages`: registry package names and versions, npm ecosystem, and optional `dev: true` for dev-only dependencies when recorded in the lockfile. Workspace entries are excluded; incompatible optional npm binaries are excluded. Names that a lockfile declares with a git/tarball/file/link spec are excluded, including hoisted entries. Recognized empty or fully excluded locks remain authoritative. Supported formats are npm v1/v2/v3, Yarn v1/Berry, pnpm v5.4/v6/v9 and text bun.lock; installed node_modules folders are never read. Without a readable lockfile (none, only binary bun.lockb, or an unparseable one) no packages are sent, `lockfile` is `none` (the dashboard keeps the last known list) and the CLI prints: "No readable lockfile found (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock); dependency check unavailable." For bun.lockb run `bun install --save-text-lockfile` to create bun.lock.
 - `truncated`: optional boolean; only the first 5000 packages are sent.
-- `supabase`: public project URL, strictly validated public key and kind (`publishable` or `anon`); otherwise null.
+- `versions_source`: always `lockfile`; `source`: always `connector`.
+- `supabase`: null unless a validated URL and public key are found, or a client-exposed secret is detected. Public keys yield only `project_ref`, `host`, `key_kind` (`anon` or `publishable`) and `key_fingerprint` (first eight lowercase hex characters of SHA-256 of the UTF-8 key). `host` is the URL host only; `project_ref` is the lowercase 20-character alphanumeric ref of a .supabase.co host, otherwise null. An exposed secret always wins: only `{ "project_ref": null, "host": null, "secret_key_exposed_client_side": true }` is sent, with project_ref/host filled when a validated URL is known. No key kind, fingerprint or length is sent for secrets.
 
-Never sent: source code, file paths (except the folder-name fallback for the app name), full lockfiles, .env files, Supabase secret/service keys, URL credentials or query strings.
-The request headers x-safetyvibe-site, x-safetyvibe-key and x-safetyvibe-claim-token carry the site ID, validated report key and validated one-shot claim token when available; these are not in the JSON body. The server also refuses non-public Supabase keys and deletes stored non-public keys during cleanup.
-Public keys are found in supported environment variables/.env files or a Supabase client file. Local secret-key warnings name only the variable.
+All report strings are screened before sending or printing: key-like values (including encoded and Unicode-disguised keys) are dropped, with a local warning naming only the field. A key-like URL is dropped entirely.
 
-Review the entire implementation in `cli.mjs` and `lib.mjs` (approximately 485 lines total). There are no dependencies and no install scripts in this package itself.
+Never sent: source code, file paths, full lockfiles, .env files, Supabase keys (including anon/publishable), secrets, URL credentials or query strings.
+The request headers x-safetyvibe-site, x-safetyvibe-key and x-safetyvibe-claim-token carry the validated UUID site ID, validated report key and validated one-shot claim token when available; these are not in the JSON body. The server validates public keys too for older clients; this connector sends no Supabase keys.
+Public keys are read only from client-exposed variables (prefixes VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, PUBLIC_, REACT_APP_, NUXT_PUBLIC_; from the environment or .env files) or a client-side Supabase source file (src/integrations/supabase/client.*, src/lib/supabase.*, lib/supabase.ts, utils/supabase.ts). Files that import or require server-only, start with "use server", are named *.server.*, or sit under server/, api/, app/api/, pages/api/, functions/, supabase/functions/, netlify/functions/ or are middleware.* are skipped. Server-only names such as SUPABASE_URL or SUPABASE_ANON_KEY are not read. Every client-prefixed variable in process env and .env/.env.local/.env.production/.env.production.local is checked for exposed secrets, as is every quoted string in the scanned client files. Server-only names remain unflagged. Local warnings name only the variable or relative client file, never the value, and tell you to rotate exposed secrets in Supabase.
+
+Review the entire implementation in `cli.mjs` and `lib.mjs` (approximately 633 lines total). There are no dependencies and no install scripts in this package itself.
 By default reports go only to `https://dashboard.safetyvibe.eu/connect/api/v1/report`. The committed rc cannot change the destination.
 An explicit `SAFETYVIBE_API` environment override supports HTTPS, or HTTP on localhost/127.0.0.1/[::1] for local testing. Redirects are refused.
 
+## Changes
+
+0.3.0 never sends Supabase keys: it reports public-key fingerprints or exposed-secret flags, adds a five-line summary, --summary and safe --out JSON export, and ships MIT licensing and security contact details. 0.2.3 prints a one-line summary first (dry run: package count, Supabase yes/no, destination; setup/scan: result and the dashboard link, printed once) so terminals that cut off long output still show it; in a dry run the full JSON follows. 0.2.2 improves response deadlines, registry-only inventory, project selection and app labels, restores flag-only setup, and rejects ambiguous JWT payloads. It reads pnpm v5.4 locks and no longer reads installed node_modules folders: without a readable lockfile no packages are sent. 0.2.1 fixed a bug where a key on a commented .env line could be included; upgrade from 0.2.0.
+
+[Documentation](https://safetyvibe.eu/connect) and [changelog / what is sent](https://safetyvibe.eu/connect/changelog).
+
 ## Files written and removal
 
-Before a setup/scan request, legacy credentials are migrated best-effort into the local file, the committed api field is dropped and its URL normalized. Dry-run, status and help never write. After a successful report:
+Before a setup/scan request, legacy credentials are migrated best-effort into the local file, the committed api field is dropped and its URL normalized. Dry-run writes only an explicitly requested --out file; status and help never write. After a successful report:
 
 - `.safetyviberc.json`: app ID, normalized public URL, optional name and `hook: false`.
 - `.safetyviberc.local.json`: report key and optional fallback claim token; never commit this file. The token is removed once used or rejected as expired/used. Only stored credentials require the local file and ignore entry. The ignore entry is attempted first, then this file is written with mode 0600. An ignore failure warns and fails setup; scan still exits 0. Empty local credentials are removed.
 - `.gitignore`: adds the local config filename.
 - `package.json`: setup normally adds a postinstall report hook. `--no-hook` leaves package.json untouched and persists this preference. Existing unsafe shell scripts are left untouched with a manual instruction.
 
+The project directory is cwd. INIT_CWD is used only when its own package.json lists the connector or its postinstall hook and it is not a workspace root. Scan at an npm/Yarn workspace root (package.json workspaces) or pnpm workspace root (pnpm-workspace.yaml with a packages list) that has no app ID in .safetyviberc.json is skipped without network or writes; run setup in the app directory. A root that was linked by running setup there is treated like any app: it reports and updates its rc files. Dry-run still previews the selected directory. An unlinked scan without a key or claim token skips projects without the connector dependency. Requests have one deadline of at most 10 seconds, including the response body, capped at 64 KiB. Failed responses keep the token unless the server reports it expired or already used, and do not install a hook.
+
 The postinstall hook runs `safetyvibe-connect scan --quiet || exit 0`: it re-sends the current inventory and public Supabase details using the local report key, suppresses success chatter but keeps safety warnings on stderr, and never fails installation. Without a local key it skips reporting for a linked app unless SAFETYVIBE_KEY or a claim token is supplied.
 
 Without terminal access, first add `.safetyviberc.local.json` to `.gitignore`, then write `{"claimToken": "<TOKEN>"}` into `.safetyviberc.local.json` and configure the dependency and postinstall hook. Never put the token in the committed `.safetyviberc.json`.
@@ -85,10 +103,12 @@ Remove the connector dependency if installed, its postinstall command, both rc f
 | Command | Effect |
 |---|---|
 | `setup [--claim-token T] [--url URL] [--name NAME] [--no-hook]` | Send report, save config, optionally add hook |
-| `setup --dry-run` | Print exact report without network or writes |
+| `setup --dry-run` or `--dry-run` | Print exact report without network; only --out writes a file |
 | `scan [--quiet]` | Re-report; always exits 0 for install hooks |
 | `status` | Show local link state |
 | `help`, `--help`, `-h`, no arguments | Usage only |
 | `--version`, `-v` | Package version only |
 
+Flags without a command imply setup. Unknown name, URL, platform and environment fields are omitted, never empty strings.
+
 Value flags accept `--flag=value` or `--flag value`, including values starting with a dash. In the space form, a known flag (also with `=...`) is treated as a missing value. Unknown commands/flags and missing values exit 2, except scan exits 0.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SafetyVibe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,78 +1,96 @@
 # safetyvibe-connect
 
-Reports dependency inventory and, if used, the Supabase project URL + public key to SafetyVibe. Requires Node >=18; no dependencies or package install scripts.
+SafetyVibe Connect reads package.json, the lockfile, and client-exposed Supabase config (client-prefixed env vars and the client Supabase file). It reports your package list so we can warn you about vulnerable dependencies. The JSON body sends exactly: v, optional name, url, platform and environment, lockfile, versions_source, source, packages, optional truncated, and supabase (null, or project_ref and host with key_kind and key_fingerprint, or secret_key_exposed_client_side). It never sends Supabase keys, secrets or file contents. Requires Node >=18; no dependencies or package install scripts.
+
+Full source: https://safetyvibe.eu/connect/source/0.3.0
 
 ## Run without installing
 
 Get a claim token from the dashboard, then run:
 
 ```sh
-npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+npx -y safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 # pnpm
-pnpm dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+pnpm dlx safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 # bun
-bunx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+bunx safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 # yarn
-yarn dlx safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>
+yarn dlx safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>
 ```
 
 Add `--url <published URL>` if known. Without a token, setup prints a claim link.
 On Replit/pnpm projects, `npm install` can fail with "Cannot read properties of null (reading 'isDescendantOf')".
 Use `pnpm add -D safetyvibe-connect`, or run without installing:
-`npx -y safetyvibe-connect@0.2.1 setup --no-hook --claim-token <TOKEN>`.
+`npx -y safetyvibe-connect@0.3.0 setup --no-hook --claim-token <TOKEN>`.
 Optional installation commands: `npm install -D safetyvibe-connect`, `pnpm add -D safetyvibe-connect`, `bun add -d safetyvibe-connect`, `yarn add -D safetyvibe-connect`.
 
 ## Exactly what is sent
 
-For cautious AI coding agents: inspect the report before sending it:
+Preview the report before sending it:
 
 ```sh
-npx -y safetyvibe-connect@0.2.1 setup --dry-run --url https://notes.example.com
+npx -y safetyvibe-connect@0.3.0 setup --dry-run --url https://notes.example.com
 ```
 
-stdout is exactly the JSON body; stderr lists destination and header names with values hidden, plus safety warnings (also under --quiet). Dry-run makes no requests and writes no files.
+By default dry-run stdout is exactly the pretty JSON body plus a newline. Its stderr carries five summary lines: Platform, Lockfile (package and dev-only counts), Supabase (fingerprint or exposed-secret flag only), Keys sent: 0, and Dry run: nothing sent. The summary is under 400 characters. It is followed by a plain explanation, destination and header names with values hidden, then one-line warnings (including any "Dropped <field>: it looked like a key." notices). Dry-run makes no requests. With --dry-run --out report.json, the body is written to that file without sending; otherwise JSON goes to stdout and the summary to stderr.
+
+Real runs print the summary on stdout, ending with Connected: and the dashboard or validated claim link (printed once). --quiet suppresses success chatter, but safety warnings always appear on stderr, including during dry runs. Accepted reports show the Connected line even if saving local config or installing the hook fails; warnings and errors follow the summary. Rejected or unreachable reports have no Connected line.
+
+--summary prints only the summary on stdout in dry and real runs, with warnings on stderr and no JSON or follow-up chatter. --out <file.json> (also --out=file.json) writes the exact JSON body plus newline instead of printing JSON; in dry runs stdout stays empty and the summary stays on stderr unless --summary is also used. It works for real runs too. The file must be new, end in .json, and resolve inside the project root with an existing parent directory; parent symlink escapes are refused. It uses exclusive creation and never overwrites files. Connector config filenames and package.json are reserved so later setup writes cannot replace the exported body. Invalid output paths exit 2 for setup/dry run; scan always exits 0 with an error on stderr.
 Example (optional `truncated` appears only when the inventory exceeds 5000):
 
 ```json
 {
   "v": 1,
-  "name": "notes",
+  "name": "notes.example.com",
   "url": "https://notes.example.com",
-  "platform": "Lovable",
   "environment": "production",
   "lockfile": "package-lock.json",
+  "versions_source": "lockfile",
+  "source": "connector",
   "packages": [{ "ecosystem": "npm", "name": "vite", "version": "6.0.0", "dev": true }],
-  "supabase": { "url": "https://example.supabase.co", "key": "sb_publishable_abc123def456", "kind": "publishable" }
+  "supabase": { "project_ref": "abcdefghijklmnopqrst", "host": "abcdefghijklmnopqrst.supabase.co", "key_kind": "anon", "key_fingerprint": "12ab34cd" }
 }
 ```
 
 - `v`: report format version.
-- `name`: explicit name, package name, URL host or folder name, skipping template and key-like names; limited to 80 letters, digits, spaces, @ / . _ -; otherwise empty.
-- `url`: HTTP(S) origin and path only, without credentials, query or fragment; paths are kept only with up to eight safe ASCII segments of at most 40 characters, excluding sb_, svk_ and eyJ markers; otherwise empty.
-- `platform`: detected project builder/hosting label; otherwise empty.
-- `environment`: `SAFETYVIBE_ENV`, or production when `NODE_ENV=production`; limited to 20 letters, digits, underscores or hyphens; otherwise empty.
-- `lockfile`: selected lockfile filename, `node_modules`, or `none`. Parent locks and node_modules are used only at workspace roots when the project matches a workspace glob in package.json workspaces (array or workspaces.packages) or the pnpm-workspace.yaml packages list. Literal paths, * and ** are supported; negated globs exclude matching paths from membership. Search stops at .git or six parent levels.
-- `packages`: registry package names and versions, npm ecosystem, and optional `dev: true` for dev-only dependencies when recorded in the lockfile. Workspace entries are excluded; incompatible optional npm binaries are excluded.
+- `name`: explicit or rc name, then URL host (first label for platform hosts), then package name, skipping template and key-like names; limited to 80 letters, digits, spaces, @ / . _ -; omitted when unknown.
+- `url`: HTTP(S) origin and path only, without credentials, query or fragment; paths are kept only with up to eight safe ASCII segments of at most 40 characters, excluding sb_, svk_ and eyJ markers; key-like hostnames are rejected; omitted when unknown.
+- `platform`: detected project builder/hosting label; omitted when unknown.
+- `environment`: `SAFETYVIBE_ENV`, or production when `NODE_ENV=production`; limited to 20 letters, digits, underscores or hyphens; omitted when unknown.
+- `lockfile`: selected lockfile filename, or `none` when no readable lockfile exists. Parent locks are used only at workspace roots when the project matches a workspace glob in package.json workspaces (array or workspaces.packages) or the pnpm-workspace.yaml packages list. Literal paths, * and ** are supported; negated globs exclude matching paths from membership. Search stops at .git or six parent levels.
+- `packages`: registry package names and versions, npm ecosystem, and optional `dev: true` for dev-only dependencies when recorded in the lockfile. Workspace entries are excluded; incompatible optional npm binaries are excluded. Names that a lockfile declares with a git/tarball/file/link spec are excluded, including hoisted entries. Recognized empty or fully excluded locks remain authoritative. Supported formats are npm v1/v2/v3, Yarn v1/Berry, pnpm v5.4/v6/v9 and text bun.lock; installed node_modules folders are never read. Without a readable lockfile (none, only binary bun.lockb, or an unparseable one) no packages are sent, `lockfile` is `none` (the dashboard keeps the last known list) and the CLI prints: "No readable lockfile found (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock); dependency check unavailable." For bun.lockb run `bun install --save-text-lockfile` to create bun.lock.
 - `truncated`: optional boolean; only the first 5000 packages are sent.
-- `supabase`: public project URL, strictly validated public key and kind (`publishable` or `anon`); otherwise null.
+- `versions_source`: always `lockfile`; `source`: always `connector`.
+- `supabase`: null unless a validated URL and public key are found, or a client-exposed secret is detected. Public keys yield only `project_ref`, `host`, `key_kind` (`anon` or `publishable`) and `key_fingerprint` (first eight lowercase hex characters of SHA-256 of the UTF-8 key). `host` is the URL host only; `project_ref` is the lowercase 20-character alphanumeric ref of a .supabase.co host, otherwise null. An exposed secret always wins: only `{ "project_ref": null, "host": null, "secret_key_exposed_client_side": true }` is sent, with project_ref/host filled when a validated URL is known. No key kind, fingerprint or length is sent for secrets.
 
-Never sent: source code, file paths (except the folder-name fallback for the app name), full lockfiles, .env files, Supabase secret/service keys, URL credentials or query strings.
-The request headers x-safetyvibe-site, x-safetyvibe-key and x-safetyvibe-claim-token carry the site ID, validated report key and validated one-shot claim token when available; these are not in the JSON body. The server also refuses non-public Supabase keys and deletes stored non-public keys during cleanup.
-Public keys are found in supported environment variables/.env files or a Supabase client file. Local secret-key warnings name only the variable.
+All report strings are screened before sending or printing: key-like values (including encoded and Unicode-disguised keys) are dropped, with a local warning naming only the field. A key-like URL is dropped entirely.
 
-Review the entire implementation in `cli.mjs` and `lib.mjs` (approximately 485 lines total). There are no dependencies and no install scripts in this package itself.
+Never sent: source code, file paths, full lockfiles, .env files, Supabase keys (including anon/publishable), secrets, URL credentials or query strings.
+The request headers x-safetyvibe-site, x-safetyvibe-key and x-safetyvibe-claim-token carry the validated UUID site ID, validated report key and validated one-shot claim token when available; these are not in the JSON body. The server validates public keys too for older clients; this connector sends no Supabase keys.
+Public keys are read only from client-exposed variables (prefixes VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, PUBLIC_, REACT_APP_, NUXT_PUBLIC_; from the environment or .env files) or a client-side Supabase source file (src/integrations/supabase/client.*, src/lib/supabase.*, lib/supabase.ts, utils/supabase.ts). Files that import or require server-only, start with "use server", are named *.server.*, or sit under server/, api/, app/api/, pages/api/, functions/, supabase/functions/, netlify/functions/ or are middleware.* are skipped. Server-only names such as SUPABASE_URL or SUPABASE_ANON_KEY are not read. Every client-prefixed variable in process env and .env/.env.local/.env.production/.env.production.local is checked for exposed secrets, as is every quoted string in the scanned client files. Server-only names remain unflagged. Local warnings name only the variable or relative client file, never the value, and tell you to rotate exposed secrets in Supabase.
+
+Review the entire implementation in `cli.mjs` and `lib.mjs` (approximately 633 lines total). There are no dependencies and no install scripts in this package itself.
 By default reports go only to `https://dashboard.safetyvibe.eu/connect/api/v1/report`. The committed rc cannot change the destination.
 An explicit `SAFETYVIBE_API` environment override supports HTTPS, or HTTP on localhost/127.0.0.1/[::1] for local testing. Redirects are refused.
 
+## Changes
+
+0.3.0 never sends Supabase keys: it reports public-key fingerprints or exposed-secret flags, adds a five-line summary, --summary and safe --out JSON export, and ships MIT licensing and security contact details. 0.2.3 prints a one-line summary first (dry run: package count, Supabase yes/no, destination; setup/scan: result and the dashboard link, printed once) so terminals that cut off long output still show it; in a dry run the full JSON follows. 0.2.2 improves response deadlines, registry-only inventory, project selection and app labels, restores flag-only setup, and rejects ambiguous JWT payloads. It reads pnpm v5.4 locks and no longer reads installed node_modules folders: without a readable lockfile no packages are sent. 0.2.1 fixed a bug where a key on a commented .env line could be included; upgrade from 0.2.0.
+
+[Documentation](https://safetyvibe.eu/connect) and [changelog / what is sent](https://safetyvibe.eu/connect/changelog).
+
 ## Files written and removal
 
-Before a setup/scan request, legacy credentials are migrated best-effort into the local file, the committed api field is dropped and its URL normalized. Dry-run, status and help never write. After a successful report:
+Before a setup/scan request, legacy credentials are migrated best-effort into the local file, the committed api field is dropped and its URL normalized. Dry-run writes only an explicitly requested --out file; status and help never write. After a successful report:
 
 - `.safetyviberc.json`: app ID, normalized public URL, optional name and `hook: false`.
 - `.safetyviberc.local.json`: report key and optional fallback claim token; never commit this file. The token is removed once used or rejected as expired/used. Only stored credentials require the local file and ignore entry. The ignore entry is attempted first, then this file is written with mode 0600. An ignore failure warns and fails setup; scan still exits 0. Empty local credentials are removed.
 - `.gitignore`: adds the local config filename.
 - `package.json`: setup normally adds a postinstall report hook. `--no-hook` leaves package.json untouched and persists this preference. Existing unsafe shell scripts are left untouched with a manual instruction.
 
+The project directory is cwd. INIT_CWD is used only when its own package.json lists the connector or its postinstall hook and it is not a workspace root. Scan at an npm/Yarn workspace root (package.json workspaces) or pnpm workspace root (pnpm-workspace.yaml with a packages list) that has no app ID in .safetyviberc.json is skipped without network or writes; run setup in the app directory. A root that was linked by running setup there is treated like any app: it reports and updates its rc files. Dry-run still previews the selected directory. An unlinked scan without a key or claim token skips projects without the connector dependency. Requests have one deadline of at most 10 seconds, including the response body, capped at 64 KiB. Failed responses keep the token unless the server reports it expired or already used, and do not install a hook.
+
 The postinstall hook runs `safetyvibe-connect scan --quiet || exit 0`: it re-sends the current inventory and public Supabase details using the local report key, suppresses success chatter but keeps safety warnings on stderr, and never fails installation. Without a local key it skips reporting for a linked app unless SAFETYVIBE_KEY or a claim token is supplied.
 
 Without terminal access, first add `.safetyviberc.local.json` to `.gitignore`, then write `{"claimToken": "<TOKEN>"}` into `.safetyviberc.local.json` and configure the dependency and postinstall hook. Never put the token in the committed `.safetyviberc.json`.
@@ -85,10 +103,12 @@ Remove the connector dependency if installed, its postinstall command, both rc f
 | Command | Effect |
 |---|---|
 | `setup [--claim-token T] [--url URL] [--name NAME] [--no-hook]` | Send report, save config, optionally add hook |
-| `setup --dry-run` | Print exact report without network or writes |
+| `setup --dry-run` or `--dry-run` | Print exact report without network; only --out writes a file |
 | `scan [--quiet]` | Re-report; always exits 0 for install hooks |
 | `status` | Show local link state |
 | `help`, `--help`, `-h`, no arguments | Usage only |
 | `--version`, `-v` | Package version only |
 
+Flags without a command imply setup. Unknown name, URL, platform and environment fields are omitted, never empty strings.
+
 Value flags accept `--flag=value` or `--flag value`, including values starting with a dash. In the space form, a known flag (also with `=...`) is treated as a missing value. Unknown commands/flags and missing values exit 2, except scan exits 0.

package/SECURITY.md

@@ -0,0 +1,9 @@
+# Security
+
+Report vulnerabilities privately to safetyvibe@advertis.ee.
+See https://safetyvibe.eu/.well-known/security.txt.
+
+The package reads package.json, lockfiles and client-exposed Supabase config,
+and sends app metadata, registry package versions and Supabase project identity
+with a public-key fingerprint or an exposed-secret flag, never Supabase keys,
+secrets or file contents.

package/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { readFileSync, writeFileSync, chmodSync, unlinkSync } from 'node:fs';
-import { join } from 'node:path';
-import { buildReport, findSupabase, normPublicUrl, urlNeedsCleaning, withHook, HOOK, packageManager, readPackages } from './lib.mjs';
+import { readFileSync, writeFileSync, chmodSync, unlinkSync, realpathSync } from 'node:fs';
+import { join, resolve, relative, dirname, isAbsolute, sep } from 'node:path';
+import { buildReport, findSupabase, normPublicUrl, urlNeedsCleaning, withHook, HOOK, packageManager, readPackages, screenString, secretLike, takeScreenWarnings } from './lib.mjs';
 
 const RC = '.safetyviberc.json';
 const LOCAL = '.safetyviberc.local.json';
@@ -9,7 +9,7 @@ const DEFAULT_API = 'https://dashboard.safetyvibe.eu/connect/api/v1';
 const REPORT_KEY = /^svk_[A-Za-z0-9_-]{32}$/;
 const CLAIM_TOKEN = /^[A-Za-z0-9_-]{16,64}$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const USAGE = 'Usage: safetyvibe-connect setup|scan|status|help [--claim-token TOKEN] [--url URL] [--name NAME] [--dry-run] [--quiet] [--no-hook] [--help/-h] [--version/-v]';
+const USAGE = 'Usage: safetyvibe-connect setup|scan|status|help [--claim-token TOKEN] [--url URL] [--name NAME] [--dry-run] [--summary] [--out FILE.json] [--quiet] [--no-hook] [--help/-h] [--version/-v]\n--dry-run: summary on stderr, JSON on stdout; --out FILE.json writes the body without sending.';
 const argv = process.argv.slice(2);
 const flags = {};
 let cmd = ''; let error = '';
@@ -22,11 +22,11 @@ for (let i = 0; i < argv.length; i++) {
   }
   const [raw, ...rest] = arg.split('=');
   const name = ({ '-h': 'help', '-v': 'version' })[raw] || raw.replace(/^--/, '');
-  if (['claim-token', 'url', 'name'].includes(name)) {
+  if (['claim-token', 'url', 'name', 'out'].includes(name)) {
     const value = rest.length ? rest.join('=') : argv[++i];
-    if (!value || (!rest.length && /^(?:--(?:dry-run|quiet|no-hook|help|version|claim-token|url|name)|-h|-v)(?:=|$)/.test(value))) { error = 'Missing value for --' + name + '.'; break; }
+    if (!value || (!rest.length && /^(?:--(?:dry-run|quiet|no-hook|help|version|claim-token|url|name|summary|out)|-h|-v)(?:=|$)/.test(value))) { error = 'Missing value for --' + name + '.'; break; }
     flags[name] = value;
-  } else if (['dry-run', 'quiet', 'no-hook', 'help', 'version'].includes(name) && !rest.length) flags[name] = true;
+  } else if (['dry-run', 'quiet', 'no-hook', 'help', 'version', 'summary'].includes(name) && !rest.length) flags[name] = true;
   else { error = 'Unknown flag.'; break; }
 }
 if (error) {
@@ -35,13 +35,25 @@ if (error) {
   process.exit(scan ? 0 : 2);
 }
 if (!argv.length || cmd === 'help' || flags.help) { console.log(USAGE); process.exit(0); }
-if (!cmd && !flags.version) { console.error(USAGE + '\nA command is required.'); process.exit(2); }
+if (!cmd) cmd = 'setup';
 const VERSION = JSON.parse(readFileSync(new URL('./package.json', import.meta.url), 'utf8')).version;
 if (flags.version) { console.log(VERSION); process.exit(0); }
-const root = process.env.INIT_CWD || process.cwd();
-const say = (...args) => { if (!flags.quiet && !flags['dry-run']) console.log(...args); };
-const alert = (message) => console.error(message);
-const safeText = value => String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, '').slice(0, 300);
+function installed(dir, hook = false) {
+  try { const p = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')); return ['dependencies', 'devDependencies', 'optionalDependencies'].some(k => Object.hasOwn(p[k] || {}, 'safetyvibe-connect')) || (hook && /(?:^|[\s(])safetyvibe-connect\s+scan\b/.test(p.scripts?.postinstall || '')); } catch { return false; }
+}
+function workspaceRoot(dir) {
+  try { const p = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')); if (p.workspaces) return true; } catch {}
+  // pnpm 10 also writes pnpm-workspace.yaml for build settings in single apps: only a packages list counts.
+  try { return /^packages\s*:/m.test(readFileSync(join(dir, 'pnpm-workspace.yaml'), 'utf8')); } catch { return false; }
+}
+const root = process.env.INIT_CWD && process.env.INIT_CWD !== process.cwd() && !workspaceRoot(process.env.INIT_CWD) && installed(process.env.INIT_CWD, true) ? process.env.INIT_CWD : process.cwd();
+const say = (...args) => { if (!flags.quiet && !flags['dry-run'] && !flags.summary) console.log(...args); };
+const warnings = [];
+const alert = message => warnings.push(message);
+const flushWarnings = () => { for (const message of [...takeScreenWarnings(), ...warnings.splice(0)]) console.error(message); };
+const safeText = value => { const text = String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, ''); return (secretLike(text, false, false) ? '[text removed: it looked like a key]' : text).slice(0, 300); };
+// Variable names such as VITE_SUPABASE_SERVICE_ROLE_KEY are printed; only names that carry key material are hidden.
+const safeName = value => { const text = String(value).replace(/[\x00-\x1f\x7f-\x9f]/g, ''); return /^[\w./-]{1,120}$/.test(text) && !secretLike(text.replace(/service_role/gi, ''), false, false) ? text : 'a client-exposed variable'; };
 const readJson = (file) => { try { return JSON.parse(readFileSync(join(root, file), 'utf8')) || {}; } catch { return {}; } };
 function readRc() {
   const pub = readJson(RC); const local = readJson(LOCAL);
@@ -86,31 +98,68 @@ function apiEndpoint() {
   if (u.username || u.password || u.search || u.hash || !(u.protocol === 'https:' || (u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname)))) throw new Error('Invalid SAFETYVIBE_API');
   return u.href.replace(/\/+$/, '') + '/report';
 }
+function summary(body, last) {
+  const label = value => safeText(value).slice(0, 32);
+  const lines = [
+    'Platform: ' + label(body.platform || 'unknown'),
+    `Lockfile: ${label(body.lockfile || 'none')}, ${body.packages.length} package(s) (${body.packages.filter(p => p.dev).length} dev-only)`,
+    'Supabase: ' + (body.supabase?.secret_key_exposed_client_side ? 'SECRET key exposed client-side (flag only)' : body.supabase ? body.supabase.key_kind + ' key (fingerprint only)' : 'none'),
+    'Keys sent: 0', last,
+  ];
+  if (lines.join('\n').length >= 400) lines[4] = 'Connected: open your SafetyVibe dashboard';
+  if (flags['dry-run'] || !flags.quiet) (flags['dry-run'] && !flags.summary ? console.error : console.log)(lines.join('\n'));
+  flushWarnings();
+}
+function writeBody(json) {
+  if (!flags.out) return;
+  const target = resolve(root, flags.out);
+  const inside = (base, path) => { const r = relative(base, path); return r && r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
+  if (!target.endsWith('.json') || !inside(resolve(root), target) || [RC, LOCAL, 'package.json'].some(file => relative(root, target).toLowerCase() === file)) throw new Error('out');
+  const base = realpathSync(root); const parent = realpathSync(dirname(target));
+  if (parent !== base && !inside(base, parent)) throw new Error('out');
+  writeFileSync(target, json, { flag: 'wx', mode: 0o600 });
+}
 async function report() {
   const setup = cmd === 'setup';
+  if (!setup && !flags['dry-run'] && workspaceRoot(root) && !readRc().site) { say('SafetyVibe: workspace root; run setup in an app directory.'); return 0; }
   let destination;
   try { destination = apiEndpoint(); } catch { alert('Invalid SAFETYVIBE_API: use HTTPS or local HTTP.'); return 1; }
   const rc = readRc();
   const rawToken = flags['claim-token'] || rc.claimToken || process.env.SAFETYVIBE_CLAIM_TOKEN || '';
   const token = typeof rawToken === 'string' && CLAIM_TOKEN.test(rawToken) ? rawToken : '';
   if (rawToken && !token) alert('Invalid claim token in --claim-token, SAFETYVIBE_CLAIM_TOKEN or .safetyviberc.local.json/.safetyviberc.json.');
-  const givenUrl = flags.url || rc.url || process.env.SAFETYVIBE_URL || '';
+  const givenUrl = flags.url || process.env.SAFETYVIBE_URL || rc.url || '';
   const url = normPublicUrl(givenUrl);
   if (urlNeedsCleaning(givenUrl)) alert('Removed credentials/query/fragment or unsafe path from URL; only the public URL is stored and sent');
-  const body = buildReport(root, { url, name: flags.name || rc.name });
+  const body = buildReport(root, { url: givenUrl, name: flags.name || rc.name });
   const headers = { 'content-type': 'application/json', 'user-agent': 'safetyvibe-connect/' + VERSION };
   const rawKey = rc.key || process.env.SAFETYVIBE_KEY || '';
   const key = typeof rawKey === 'string' && REPORT_KEY.test(rawKey) ? rawKey : '';
   if (rawKey && !key) alert('Invalid report key in SAFETYVIBE_KEY or .safetyviberc.local.json/.safetyviberc.json.');
-  if (rc.site) headers['x-safetyvibe-site'] = rc.site;
+  if (typeof rc.site === 'string' && UUID.test(rc.site)) headers['x-safetyvibe-site'] = rc.site;
   if (rc.site && key) headers['x-safetyvibe-key'] = key;
   if (token) headers['x-safetyvibe-claim-token'] = token;
-  for (const variable of findSupabase(root).warnings) alert(`Warning: ${variable} holds a secret key. Variables starting with VITE_/NEXT_PUBLIC_/EXPO_PUBLIC_/PUBLIC_ are shipped to every visitor; rotate that key in Supabase.`);
+  for (const finding of findSupabase(root).warnings) alert(`WARNING: ${safeName(finding)} holds a Supabase secret/service_role key in client-exposed config; every visitor can read it. Rotate it in Supabase now. Only a flag is sent, never the key.`);
+  const lockState = readPackages(root);
+  if (lockState.noLockfile && !flags.quiet) alert('No readable lockfile found (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock); dependency check unavailable.'
+    + (lockState.binaryBun ? ' Run `bun install --save-text-lockfile` to create bun.lock.' : ''));
+  const json = JSON.stringify(body, null, 2) + '\n';
+  try { writeBody(json); } catch { alert('Could not write --out: use a new .json file inside the project root with an existing parent directory.'); return 2; }
   if (flags['dry-run']) {
-    console.log(JSON.stringify(body, null, 2));
-    console.error(destination + ' headers: ' + Object.keys(headers).join(', ') + ' (values hidden)');
+    // Keep the five summary lines first; warnings follow the destination details.
+    const pending = [...takeScreenWarnings(), ...warnings.splice(0)];
+    summary(body, 'Dry run: nothing sent');
+    if (!flags.summary) {
+      console.error(body.supabase?.secret_key_exposed_client_side ? 'A secret key is exposed in client code; only that fact is reported, never the key.' : 'No keys or secrets are sent. The anon key is public by design. Only a fingerprint is sent.');
+      console.error(safeText(destination) + ' headers: ' + Object.keys(headers).join(', ') + ' (values hidden)');
+    }
+    warnings.push(...pending); flushWarnings();
+    if (!flags.summary && !flags.out) process.stdout.write(json);
     return 0;
   }
+  if (!setup && !rc.site && !key && !token && !installed(root)) {
+    say('SafetyVibe: no project connection or connector dependency; skipping report.'); return 0;
+  }
   let saveFailed = false;
   const legacy = readJson(RC);
   if (['key', 'claimToken', 'api'].some(k => Object.hasOwn(legacy, k)) || (legacy.url && legacy.url !== normPublicUrl(legacy.url))) {
@@ -125,11 +174,27 @@ async function report() {
     return setup ? 1 : 0;
   }
   let response; let b;
-  const ctl = new AbortController(); const timer = setTimeout(() => ctl.abort(), 10000);
+  const ctl = new AbortController(); let reader;
+  const requested = Number(process.env.SAFETYVIBE_TIMEOUT_MS);
+  const timeout = Number.isFinite(requested) && requested > 0 ? Math.min(requested, 10000) : 10000;
+  const cancel = () => { ctl.abort(); if (reader) void reader.cancel().catch(() => {}); };
+  let timer;
+  const deadline = new Promise((_, reject) => { timer = setTimeout(() => { cancel(); reject(new Error('deadline')); }, timeout); });
   try {
-    response = await fetch(destination, { method: 'POST', headers, body: JSON.stringify(body), signal: ctl.signal, redirect: 'error' });
-    try { b = await response.json(); } catch {}
-  } catch { alert('SafetyVibe: could not reach ' + new URL(destination).host + '.'); return 1; }
+    const work = (async () => {
+      response = await fetch(destination, { method: 'POST', headers, body: json, signal: ctl.signal, redirect: 'error' });
+      reader = response.body?.getReader();
+      const chunks = []; let size = 0;
+      if (reader) while (true) {
+        const { done, value } = await reader.read(); if (done) break;
+        size += value.byteLength; if (size > 65536) { cancel(); throw new Error('response too large'); }
+        chunks.push(Buffer.from(value));
+      }
+      try { b = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch {}
+    })();
+    work.catch(() => {});   // a late rejection after the deadline must not become an unhandled rejection
+    await Promise.race([deadline, work]);
+  } catch { alert('SafetyVibe: could not reach ' + safeText(new URL(destination).host) + '.'); return 1; }
   finally { clearTimeout(timer); }
   if (typeof b?.warning === 'string') alert('SafetyVibe: ' + safeText(b.warning));
   if (!response.ok) {
@@ -144,8 +209,16 @@ async function report() {
     return 1;
   }
   if (!b || typeof b !== 'object' || Array.isArray(b) || typeof b.site !== 'string' || !UUID.test(b.site)) {
-    alert('SafetyVibe: unexpected response from ' + new URL(destination).host + ' (HTTP ' + response.status + ')'); return 1;
+    alert('SafetyVibe: unexpected response from ' + safeText(new URL(destination).host) + ' (HTTP ' + response.status + ')'); return 1;
   }
+  let claim = '';
+  if (!b.claimed) try {
+    if (typeof b.claimUrl === 'string' && !/[\x00-\x1f\x7f-\x9f]/.test(b.claimUrl)) {
+      const u = new URL(b.claimUrl);
+      if (u.protocol === 'https:' && !u.username && !u.password && u.origin === new URL(destination).origin) claim = u.href;   // same-origin, validated; a random claim code must not be dropped by the key screen
+    }
+  } catch {}
+  summary(body, 'Connected: ' + (b.claimed ? 'https://dashboard.safetyvibe.eu' : claim || 'open your SafetyVibe dashboard'));
   const next = { ...rc, site: b.site, url, ...(flags.name ? { name: body.name } : {}), ...(flags['no-hook'] ? { hook: false } : {}) };
   if (typeof b.key === 'string' && REPORT_KEY.test(b.key)) next.key = b.key;
   else if (b.key) alert('Invalid report key in server response.');
@@ -155,29 +228,20 @@ async function report() {
     alert('SafetyVibe: report sent; app id ' + b.site + '; could not save .safetyviberc.json here, so future reports from this folder cannot reach the same app - set SAFETYVIBE_KEY or run setup in a writable checkout');
     return 1;
   }
-  const inventory = readPackages(root);
-  say(`SafetyVibe: reported ${body.packages.length} packages (${body.packages.filter(p => p.dev).length} dev-only).`);
+  const inventory = lockState;
   if (body.truncated) alert(`Only the first 5000 of ${inventory.total} packages were reported.`);
+  let followup = '';
   if (setup && next.hook !== false) {
     const hook = addHook();
     if (hook === 'could not write package.json') { alert('SafetyVibe: report sent; app id ' + b.site + '; could not write package.json.'); return 1; }
-    say('SafetyVibe: postinstall hook ' + hook + '.');
-  } else if (setup) say('Re-report manually: ' + runner + ' safetyvibe-connect scan');
-  if (b.claimed) say('SafetyVibe: linked to your dashboard: https://dashboard.safetyvibe.eu');
-  else {
-    let claim = '';
-    try {
-      if (typeof b.claimUrl === 'string' && !/[\x00-\x1f\x7f-\x9f]/.test(b.claimUrl)) {
-        const u = new URL(b.claimUrl);
-        if (u.protocol === 'https:' && !u.username && !u.password && u.origin === new URL(destination).origin) claim = u.href;
-      }
-    } catch {}
-    say(claim ? 'SafetyVibe: open this link to add the app to your dashboard: ' + claim : 'SafetyVibe: open your SafetyVibe dashboard');
-  }
-  return saveFailed || saved === 'unignored' ? 1 : 0;
+    followup = 'SafetyVibe: postinstall hook ' + hook + '.';
+  } else if (setup) followup = 'Re-report manually: ' + runner + ' safetyvibe-connect scan';
+  if (saveFailed || saved === 'unignored') return 1;
+  if (followup) say(followup);
+  return 0;
 }
 async function main() {
-  if (cmd === 'status') { const rc = readRc(); say(rc.site ? 'Linked to SafetyVibe app ' + rc.site + (normPublicUrl(rc.url) ? ' (' + normPublicUrl(rc.url) + ')' : '') + '.' : 'Not linked.'); return 0; }
+  if (cmd === 'status') { const rc = readRc(); say(rc.site ? 'Linked to SafetyVibe app ' + safeText(rc.site) + (normPublicUrl(rc.url) ? ' (' + normPublicUrl(rc.url) + ')' : '') + '.' : 'Not linked.'); return 0; }
   return report();
 }
-main().then(code => process.exit(cmd === 'scan' ? 0 : code), () => { alert('SafetyVibe: could not complete report.'); process.exit(cmd === 'scan' ? 0 : 1); });
+main().then(code => { flushWarnings(); process.exit(cmd === 'scan' ? 0 : code); }, () => { alert('SafetyVibe: could not complete report.'); flushWarnings(); process.exit(cmd === 'scan' ? 0 : 1); });

package/lib.mjs

@@ -1,33 +1,47 @@
 // safetyvibe-connect - pure helpers (no network, no writes). Tested in connect.test.mjs.
-// Egress = buildReport() body + headers x-safetyvibe-site / x-safetyvibe-key /
+// Egress = buildReport() body: v, name?, url?, platform?, environment?, lockfile,
+// versions_source, source, packages, truncated?, supabase (project_ref, host,
+// key_kind + key_fingerprint OR secret_key_exposed_client_side; never keys).
+// Authentication headers x-safetyvibe-site / x-safetyvibe-key /
 // x-safetyvibe-claim-token, only to the default API or SAFETYVIBE_API
-// (https, or http on localhost); redirects refused. Never source code or secret Supabase keys.
-import { readFileSync, existsSync, readdirSync, statSync, lstatSync, realpathSync } from 'node:fs';
-import { join, basename, dirname, sep, relative } from 'node:path';
+// (https, or http on localhost); redirects refused. Never source code or any Supabase keys.
+import { createHash } from 'node:crypto';
+import { readFileSync, existsSync, statSync } from 'node:fs';
+import { join, dirname, sep, relative } from 'node:path';
 
 const MAX_PACKAGES = 5000;
 const read = (f) => { try { return readFileSync(f, 'utf8'); } catch { return null; } };
 const readJson = (f) => { const t = read(f); if (t == null) return null; try { return JSON.parse(t); } catch { return null; } };
+const semver = v => typeof v === 'string' && !!screenString(v, 'package version') && /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(v);
+function registryTarball(value) {
+  try { const u = new URL(value); return /^https?:$/.test(u.protocol) && /\/(?:@[^/]+\/)?[^/]+\/-\/[^/]+-\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?\.tgz$/.test(decodeURIComponent(u.pathname)); } catch { return false; }
+}
+const registrySpec = v => typeof v === 'string' && (/^npm:(?:@[^/]+\/)?[^@]+@/.test(v) ? registrySpec(v.slice(v.lastIndexOf('@') + 1)) : /^(?:[~^<>=]*\s*v?(?:\d+|[xX*])(?:\.(?:\d+|[xX*])){0,2}(?:-[\w.-]+)?(?:\+[\w.-]+)?)(?:(?:\s+(?:-\s+)?|\s*\|\|\s*)[~^<>=]*\s*v?(?:\d+|[xX*])(?:\.(?:\d+|[xX*])){0,2}(?:-[\w.-]+)?(?:\+[\w.-]+)?)*$/.test(v.trim()));
+const dependencySpecs = p => ({ ...p?.dependencies, ...p?.devDependencies, ...p?.optionalDependencies, ...p?.requires });
+const nonRegistryNames = p => Object.entries(dependencySpecs(p)).filter(([, spec]) => typeof spec === 'string' && !registrySpec(spec)).map(([name]) => name);
+const registryEntry = v => v && !v.link && semver(v.version) && (v.resolved == null || registryTarball(v.resolved));
 
 // ---- lockfiles -------------------------------------------------------------
 // Each parser returns [{ name, version }] for every installed package (deduped later).
 
 export function fromPackageLock(json, { platform = process.platform, arch = process.arch } = {}) {
-  const out = [];
+  const out = []; const excluded = new Set();
+  const remember = p => { for (const name of nonRegistryNames(p)) excluded.add(name); };
   if (json && json.packages && typeof json.packages === 'object') {
+    for (const v of Object.values(json.packages)) remember(v);
     for (const [path, v] of Object.entries(json.packages)) {
-      if (!path || !v || v.link || /^(workspace:|link:|file:)/.test(v.resolved || '') || typeof v.version !== 'string') continue;   // "" = the root project
+      if (!path || !registryEntry(v)) continue;
       const matches = (list, value) => !Array.isArray(list) || (!list.includes('!' + value) && (!list.some(x => !x.startsWith('!')) || list.includes(value) || list.includes('any')));
       if (v.optional && (!matches(v.os, platform) || !matches(v.cpu, arch))) continue;
       const i = path.lastIndexOf('node_modules/');
-      if (i === -1) continue;
+      if (i === -1 || excluded.has(path.slice(i + 'node_modules/'.length))) continue;
       out.push({ name: v.name || path.slice(i + 'node_modules/'.length), version: v.version, ...(v.dev === true ? { dev: true } : {}) });
     }
   } else if (json && json.dependencies) {                          // lockfileVersion 1
-    const walk = (deps) => { for (const [n, v] of Object.entries(deps || {})) { if (v && v.version && !v.link && !/^(workspace:|link:|file:)/.test(v.resolved || '')) out.push({ name: n, version: v.version, ...(v.dev === true ? { dev: true } : {}) }); walk(v && v.dependencies); } };
+    const walk = (deps) => { for (const [n, v] of Object.entries(deps || {})) { remember(v); if (registryEntry(v)) out.push({ name: n, version: v.version, ...(v.dev === true ? { dev: true } : {}) }); walk(v && v.dependencies); } };
     walk(json.dependencies);
   }
-  return out;
+  return out.filter(p => !excluded.has(p.name));
 }
 
 // bun.lock (text, JSONC): "packages": { "<key>": ["name@version", registry, {...}, integrity], ... }
@@ -41,49 +55,39 @@ export function fromBunLock(text) {
     const at = spec.lastIndexOf('@');
     if (at <= 0) continue;
     const version = spec.slice(at + 1);
-    if (/^\d/.test(version)) out.push({ name: spec.slice(0, at), version });   // skip workspace:/git:/file:
+    if (semver(version) && (v[1] === '' || (typeof v[1] === 'string' && /^https?:\/\//.test(v[1]) && !/\.tgz|\.git|github/i.test(v[1])))) out.push({ name: spec.slice(0, at), version });
   }
   return out;
 }
 
 // yarn.lock v1 ("name@range":\n  version "x") and berry ("name@npm:range":\n  version: x)
 export function fromYarnLock(text) {
-  const out = []; let names = null;
-  for (const line of String(text).split(/\r?\n/)) {
-    if (/^\S.*:\s*$/.test(line) && !line.startsWith('#') && !line.startsWith('__metadata')) {
-      names = /@(workspace:|link:|file:)/.test(line) ? null : line.replace(/:\s*$/, '').split(',').map((s) => s.trim().replace(/^"|"$/g, ''))
-        .map((s) => s.slice(0, s.lastIndexOf('@') > 0 ? s.lastIndexOf('@') : s.length));
-      continue;
+  const out = []; const seen = new Set(); const berry = /^__metadata:/m.test(text);
+  for (const block of String(text).split(/(?=^\S)/m)) {
+    const lines = block.split(/\r?\n/); const head = lines.shift();
+    if (!head?.endsWith(':') || head.startsWith('#') || head.startsWith('__metadata')) continue;
+    const specs = head.slice(0, -1).split(/,\s*/).map(s => s.replace(/^"|"$/g, ''));
+    const version = /^\s+version:?\s+"?([^"\s]+)/m.exec(block)?.[1];
+    const resolved = /^\s+resolved\s+["']?([^"'\s]+)/m.exec(block)?.[1];
+    const resolution = /^\s+resolution:\s+"?([^"\s]+)/m.exec(block)?.[1];
+    if (!semver(version) || (berry ? !/^(?:@[^/]+\/)?[^@:/]+@npm:/.test(resolution || '') : resolved != null && !registryTarball(resolved))) continue;
+    for (const spec of new Set(specs)) {
+      const at = spec.indexOf('@', spec.startsWith('@') ? 1 : 0);
+      if (at < 1 || !(berry ? spec.slice(at + 1).startsWith('npm:') : registrySpec(spec.slice(at + 1)))) continue;
+      const name = spec.slice(0, at); const id = name + '@' + version;
+      if (!seen.has(id)) { seen.add(id); out.push({ name, version }); }
     }
-    const m = line.match(/^\s+version:?\s+"?([^"\s]+)"?\s*$/);
-    if (m && names) { for (const n of new Set(names)) if (n) out.push({ name: n, version: m[1] }); names = null; }
   }
   return out;
 }
 
-// pnpm-lock.yaml: package keys like "/name@1.2.3", "name@1.2.3", "/@scope/name@1.2.3(peer@x)"
 export function fromPnpmLock(text) {
-  const out = []; let inPackages = false;
-  for (const line of String(text).split(/\r?\n/)) {
-    if (/^(packages|snapshots):\s*$/.test(line)) { inPackages = line.startsWith('packages'); continue; }
-    if (/^\S/.test(line)) { inPackages = false; continue; }
-    if (!inPackages) continue;
-    const m = line.match(/^ {2}'?\/?((?:@[^/@\s]+\/)?[^@\s/]+)@(\d[^('\s:]*)/);
-    if (m) out.push({ name: m[1], version: m[2] });
-    else if (/^ {4}dev: true\s*$/.test(line) && out.length) out[out.length - 1].dev = true;
-  }
-  return out;
-}
-
-// Fallback (bun.lockb is binary): what is actually installed in node_modules.
-export function fromNodeModules(root) {
-  const out = []; const nm = join(root, 'node_modules');
-  let entries = []; try { entries = readdirSync(nm); } catch { return out; }
-  const add = (dir) => { try { if (lstatSync(dir).isSymbolicLink() && !realpathSync(dir).startsWith(realpathSync(nm) + sep)) return; } catch { return; } const pj = readJson(join(dir, 'package.json')); if (pj && pj.name && pj.version) out.push({ name: pj.name, version: pj.version }); };
-  for (const e of entries) {
-    if (e.startsWith('.')) continue;
-    if (e.startsWith('@')) { let sub = []; try { sub = readdirSync(join(nm, e)); } catch {} for (const s of sub) add(join(nm, e, s)); }
-    else add(join(nm, e));
+  const out = []; const section = /^packages:\s*\r?\n([\s\S]*?)(?=^\S|(?![\s\S]))/m.exec(text)?.[1] || '';
+  for (const block of section.split(/(?=^ {2}\S)/m)) {
+    const head = block.split(/\r?\n/)[0];
+    if (/https?:|git[+:]|github|file:|link:|workspace:/.test(head) || /\b(?:tarball|repo|directory|type):/.test(block) || !/\bintegrity:/.test(block)) continue;
+    const m = /^ {2}['"]?\/?((?:@[^/\s]+\/)?[^@/\s]+)(?:@|\/)(\d+\.\d+\.\d+(?:-[\w.-]+)?)/.exec(head);
+    if (m) out.push({ name: m[1], version: m[2], ...(/^ {4}dev: true\s*$/m.test(block) ? { dev: true } : {}) });
   }
   return out;
 }
@@ -131,29 +135,40 @@ export function readPackages(root) {
     let ok = true;
     try { list = parse(t); } catch { list = []; ok = false; }
     if (list.length) { source = file; break; }
-    // A JSON lockfile that parses and lists nothing really means "no dependencies". The line-based
-    // yarn/pnpm parsers can't tell empty from unsupported, so those stay "unknown".
-    if (ok && /\.json$|^bun\.lock$/.test(file)) { source = file; break; }
+    // Recognized locks remain authoritative when every entry was excluded; falling back
+    // to installed packages could reintroduce names from non-registry sources.
+    if (ok && (/\.json$|^bun\.lock$/.test(file) || (file === 'pnpm-lock.yaml' && /^packages:/m.test(t)) || (file === 'yarn.lock' && /^(?:__metadata:|# yarn lockfile v1|\S.*:\s*$)/m.test(t)))) { source = file; break; }
   }
-  if (!list.length && source === 'none') { list = fromNodeModules(root); if (!list.length && lockRoot !== root) list = fromNodeModules(lockRoot); if (list.length) source = 'node_modules'; }
+  // No node_modules fallback: installed folders do not say where a package came from, so a git/tarball/
+  // file dependency could be reported under its name. Without a readable lockfile no packages are sent and
+  // lockfile stays 'none', so the dashboard keeps the last known inventory.
+  const missing = source === 'none' ? { noLockfile: true, ...(existsSync(join(lockRoot, 'bun.lockb')) || existsSync(join(root, 'bun.lockb')) ? { binaryBun: true } : {}) } : {};
   const seen = new Map(); const pkgs = [];
   for (const p of list) {
     const k = p.name + '@' + p.version;
     // Registry versions only. git/file/link/http specs can carry tokens or local paths: never sent.
-    if ([p.name, p.version].some(v => /sb_secret_|svk_/i.test(String(v)) || keyKind(v) !== 'unknown')) continue;
+    const safeName = screenString(p.name, 'package name', undefined, true);
+    const safeVersion = screenString(p.version, 'package version');
+    if (!safeName || !safeVersion) continue;
     if (!/^(@[\w.-]+\/)?[\w.-]+$/.test(p.name) || !/^\d+\.\d+\.\d+[\w.+-]{0,40}$/.test(String(p.version))) continue;
     if (seen.has(k)) { if (p.dev !== true) delete seen.get(k).dev; continue; }
     const row = { ecosystem: 'npm', name: p.name, version: p.version, ...(p.dev === true ? { dev: true } : {}) };
     seen.set(k, row); pkgs.push(row);
 
   }
-  return { packages: pkgs.slice(0, MAX_PACKAGES), source, ...(pkgs.length > MAX_PACKAGES ? { total: pkgs.length, truncated: true } : {}) };
+  return { packages: pkgs.slice(0, MAX_PACKAGES), source, ...missing, ...(pkgs.length > MAX_PACKAGES ? { total: pkgs.length, truncated: true } : {}) };
 }
 
 // ---- Supabase (project URL + PUBLIC key only) ------------------------------
 function jwtPayload(value) {
   if (typeof value !== 'string' || value.length > 2000 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) return null;
-  try { const p = JSON.parse(Buffer.from(value.split('.')[1], 'base64url').toString('utf8')); return p && typeof p === 'object' && !Array.isArray(p) ? p : null; } catch { return null; }
+  try {
+    const raw = Buffer.from(value.split('.')[1], 'base64url').toString('utf8');
+    // Tokenize complete strings so quoted text inside a value cannot become a key.
+    const keys = [...raw.matchAll(/"(?:[^"\\]|\\.)*"/g)]
+      .filter(m => /^\s*:/.test(raw.slice(m.index + m[0].length))).map(m => JSON.parse(m[0]));
+    if (new Set(keys).size !== keys.length) return { role: 'rejected' };
+    const p = JSON.parse(raw); return p && typeof p === 'object' && !Array.isArray(p) ? p : null; } catch { return null; }
 }
 export function publicKeyKind(value) {
   if (typeof value !== 'string' || /sb_secret_|[\s#'"`]/i.test(value)) return null;
@@ -191,34 +206,52 @@ export function parseEnv(text) {
   return env;
 }
 
-const URL_VARS = ['VITE_SUPABASE_URL', 'NEXT_PUBLIC_SUPABASE_URL', 'PUBLIC_SUPABASE_URL', 'EXPO_PUBLIC_SUPABASE_URL', 'SUPABASE_URL'];
-const KEY_VARS = ['VITE_SUPABASE_PUBLISHABLE_KEY', 'VITE_SUPABASE_ANON_KEY', 'NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'NEXT_PUBLIC_SUPABASE_ANON_KEY',
-  'PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'EXPO_PUBLIC_SUPABASE_PUBLISHABLE_KEY', 'PUBLIC_SUPABASE_ANON_KEY', 'EXPO_PUBLIC_SUPABASE_ANON_KEY', 'SUPABASE_PUBLISHABLE_KEY', 'SUPABASE_ANON_KEY'];
+// Only client-exposed variable names (bundled into the browser build by these prefixes); server-only
+// names such as SUPABASE_URL / SUPABASE_ANON_KEY are never read.
+const CLIENT_PREFIXES = ['VITE_', 'NEXT_PUBLIC_', 'EXPO_PUBLIC_', 'PUBLIC_', 'REACT_APP_', 'NUXT_PUBLIC_'];
+const URL_VARS = CLIENT_PREFIXES.map(p => p + 'SUPABASE_URL');
+const KEY_VARS = CLIENT_PREFIXES.flatMap(p => [p + 'SUPABASE_PUBLISHABLE_KEY', p + 'SUPABASE_ANON_KEY']);
+const exposedSupabaseSecret = value => typeof value === 'string' && (value.startsWith('sb_secret_') || jwtPayload(value)?.role === 'service_role');
 
+// Only clearly client-side source files: what the browser bundle already ships to every visitor.
+const SERVER_PATH = /(^|\/)(server|api|functions)\/|(^|\/)app\/api\/|(^|\/)pages\/api\/|(^|\/)supabase\/functions\/|(^|\/)netlify\/functions\/|(^|\/)middleware\.[cm]?[jt]sx?$|\.server\.[cm]?[jt]sx?$/i;
+export function clientSource(path, text) {
+  if (SERVER_PATH.test(String(path).split('\\').join('/'))) return false;
+  // Any quoted 'server-only' or "use server" anywhere (comments, spacing or syntax tricks included) marks
+  // the file as server code. Excluding a client file by mistake is the safe direction.
+  return !/['"`]server-only['"`]/.test(text) && !/['"`]use server['"`]/.test(text);
+}
 export function findSupabase(root, procEnv = process.env) {
-  const env = {};
-  for (const f of ['.env', '.env.local', '.env.production', '.env.production.local']) Object.assign(env, parseEnv(read(join(root, f))));
-  for (const k of [...URL_VARS, ...KEY_VARS]) if (procEnv[k]) env[k] = procEnv[k];
-  const warnings = KEY_VARS.filter(k => keyKind(env[k]) === 'secret');
-  let url = URL_VARS.map((k) => env[k]).find(Boolean) || '';
-  let key = KEY_VARS.map((k) => env[k]).find(value => publicKeyKind(value)) || '';
-  // Lovable hard-codes them in src/integrations/supabase/client.ts
-  if (!url || !key) {
-    for (const f of ['src/integrations/supabase/client.ts', 'src/integrations/supabase/client.js', 'src/lib/supabase.ts', 'src/lib/supabase.js', 'lib/supabase.ts', 'utils/supabase.ts']) {
-      const t = read(join(root, f)); if (!t) continue;
-      url = url || ((t.match(/["'`](https:\/\/[a-z0-9-]+\.supabase\.co)["'`]/i) || [])[1] || '');
-      for (const match of t.matchAll(/([\w]*(?:PUBLISHABLE|ANON)_KEY)\s*=\s*["'`]([^"'`]+)["'`]/gi)) {
-        if (keyKind(match[2]) === 'secret') warnings.push(match[1]);
-        if (!key && publicKeyKind(match[2])) key = match[2];
-      }
-      if (url && key) break;
+  const env = {}; const warnings = new Set();
+  const collect = values => {
+    for (const k of Object.keys(values)) {
+      if (!CLIENT_PREFIXES.some(p => k.startsWith(p))) continue;
+      const value = values[k];
+      if (KEY_VARS.includes(k) ? keyKind(value) === 'secret' : exposedSupabaseSecret(value)) warnings.add(k);
+      if (value) env[k] = value;
+    }
+  };
+  for (const f of ['.env', '.env.local', '.env.production', '.env.production.local']) collect(parseEnv(read(join(root, f))));
+  collect(procEnv);
+  let url = URL_VARS.map(k => env[k]).find(value => /^https:\/\/[a-z0-9-]+\.supabase\.(co|in)\/?$/i.test(value || '')) || '';
+  let key = KEY_VARS.map(k => env[k]).find(value => publicKeyKind(value)) || '';
+  // Scan every allowed client file even when environment config is complete.
+  for (const f of ['src/integrations/supabase/client.ts', 'src/integrations/supabase/client.js', 'src/lib/supabase.ts', 'src/lib/supabase.js', 'lib/supabase.ts', 'utils/supabase.ts']) {
+    const t = read(join(root, f)); if (!t || !clientSource(f, t)) continue;
+    url = url || ((t.match(/["'`](https:\/\/[a-z0-9-]+\.supabase\.co)["'`]/i) || [])[1] || '');
+    for (const match of t.matchAll(/(["'`])((?:\\.|(?!\1)[^\\])*?)\1/g)) {
+      if (exposedSupabaseSecret(match[2])) warnings.add(f);
+    }
+    for (const match of t.matchAll(/([\w]*(?:PUBLISHABLE|ANON)_KEY)\s*=\s*["'`]([^"'`]+)["'`]/gi)) {
+      if (keyKind(match[2]) === 'secret') warnings.add(f);
+      if (!key && publicKeyKind(match[2])) key = match[2];
     }
   }
   if (!/^https:\/\/[a-z0-9-]+\.supabase\.(co|in)\/?$/i.test(url)) url = '';
   const kind = key ? keyKind(key) : 'none';
   // Never send anything that isn't provably a public key.
   if (!publicKeyKind(key)) key = '';
-  return { url: url.replace(/\/$/, ''), key, kind, warnings };
+  return { url: url.replace(/\/$/, ''), key, kind, warnings: [...warnings] };
 }
 
 // ---- app identity ------------------------------------------------------------
@@ -229,6 +262,12 @@ export function detectPlatform(root, procEnv = process.env, url = '') {
   if (deps['lovable-tagger'] || existsSync(join(root, '.lovable'))) return 'Lovable';
   if (existsSync(join(root, '.replit'))) return 'Replit';
   for (const [marker, label] of Object.entries({ '.bolt': 'Bolt', '.emergent': 'Emergent', '.softgen': 'Softgen', '.leap': 'Leap', '.rocket': 'Rocket', '.v0': 'v0' })) if (existsSync(join(root, marker))) return label;
+  if (String(pj.name || '').toLowerCase().replace(/^@[^/]+\//, '') === 'softgen-starter') return 'Softgen';
+  for (const dir of [root, join(root, 'frontend')]) for (const file of ['.env', '.env.local', '.env.production']) {
+    for (const value of Object.values(parseEnv(read(join(dir, file))))) {
+      try { const u = new URL(value); if (/^https?:$/.test(u.protocol) && /\.(emergentagent\.com|emergent\.host)$/.test(u.hostname)) return 'Emergent'; } catch {}
+    }
+  }
   if (deps['@base44/sdk']) return 'Base44';
   if (Object.hasOwn(readJson(join(root, 'metadata.json')) || {}, 'requestFramePermissions') || (pj.name === 'react-example' && deps['@google/genai']) || ['ts', 'js', 'mjs', 'mts'].some(ext => /process\.env\.GEMINI_API_KEY/.test(read(join(root, 'vite.config.' + ext)) || ''))) return 'Google AI Studio';
   try { const host = new URL(url).hostname; for (const [suffix, label] of Object.entries(HOSTS)) if (host.endsWith('.' + suffix)) return label; } catch {}
@@ -237,16 +276,53 @@ export function detectPlatform(root, procEnv = process.env, url = '') {
   if (procEnv.NETLIFY) return 'Netlify';
   return '';
 }
-const TEMPLATES = new Set('workspace frontend backend client web app project src home repl code dev-server react-example vite-project vite-react-shadcn-ts tanstack-start-ts vite-react-typescript-starter rest-express my-app react-app nextjs next-app nextjs-app my-v0-project'.split(' '));
+const TEMPLATES = new Set('softgen-starter my-react-app create-react-app starter template workspace frontend backend client web app project src home repl code dev-server react-example vite-project vite-react-shadcn-ts tanstack-start-ts vite-react-typescript-starter rest-express my-app react-app nextjs next-app nextjs-app my-v0-project'.split(' '));
+TEMPLATES.add('');
 // Real JWTs start with eyJ (base64 of {"); plain dotted names like notes.example.com stay allowed.
-const secretLike = value => keyKind(value) !== 'unknown' || /sb_secret_|svk_|eyJ/i.test(value);
+export function screenNormalized(value) {
+  let text = String(value || '');
+  for (let i = 0; i < 3; i++) {
+    const decoded = text.replace(/(?:%[0-9a-f]{2})+/gi, run => { try { return decodeURIComponent(run); } catch { return run; } });
+    if (decoded === text) break;
+    text = decoded;
+  }
+  const glyphs = { \u0430:'a', \u0435:'e', \u043e:'o', \u0440:'p', \u0441:'c', \u0445:'x', \u0443:'y', \u0456:'i', \u0455:'s', \u0458:'j', \u043a:'k', \u043c:'m', \u043d:'h', \u0442:'t', \u0432:'b', \u03bf:'o', \u03b1:'a', \u03b5:'e', \u03b9:'i', \u03ba:'k', \u03bd:'v', \u03c1:'p', \u03c4:'t', \u03c5:'y', \u03c7:'x' };
+  // Decompose first so accents composed onto letters (e + U+0301 -> U+00E9) are stripped too, then recompose.
+  return text.normalize('NFKD').replace(/[\p{M}\p{Cf}\p{Default_Ignorable_Code_Point}]/gu, '').normalize('NFKC').replace(/[\u0430 \u0435 \u043e \u0440 \u0441 \u0445 \u0443 \u0456 \u0455 \u0458 \u043a \u043c \u043d \u0442 \u0432 \u03bf \u03b1 \u03b5 \u03b9 \u03ba \u03bd \u03c1 \u03c4 \u03c5 \u03c7]/giu, c => glyphs[c.toLowerCase()] || c);
+}
+export function secretLike(value, packageName = false, credentials = true) {
+  if (typeof value !== 'string') return false;
+  return [value, screenNormalized(value)].some(v => {
+    // eyJ is case-sensitive (base64 of '{"'): lowercase "eyj" occurs in ordinary words (honeyjar, journeyjs).
+    if (/sb_publishable_|sb_secret_|sk_live_|sk_test_|sk-ant-|sk-proj-|rk_live_|service_role|svk_/i.test(v) || /eyJ/.test(v)) return true;
+    // Generic secret-key shapes (sk_<random>, sk-<random>) with no separators in the random part.
+    if (/sk_[A-Za-z0-9]{16,}|sk-[A-Za-z0-9]{20,}/i.test(v)) return true;
+    if (credentials && (/[a-z][a-z0-9+.-]*:\/\/[^\s/?#]*@/i.test(v) || /(?:^|[?&])(?:apikey|api_key|access_token|token|key|sig|signature|secret|password)=/i.test(v))) return true;
+    // Within a run, a separator-free piece of >= 32 characters, or >= 16 mixing letters and digits, is key
+    // material; hyphenated words and paths ("some-long-path/another-segment") are not. Real npm package
+    // names are exempt from this long-run rule only, never from the key prefixes above.
+    if (packageName && /^(@[\w.-]+\/)?[\w.-]{1,214}$/.test(value)) return false;
+    return (v.match(/[A-Za-z0-9+/_=-]{40,}/g) || []).some(run => run.split(/[-/_+=]/)
+      .some(piece => piece.length >= 32 || (piece.length >= 16 && /[a-z]/i.test(piece) && /\d/.test(piece))));
+  });
+}
+// Screening warnings are collected (deduplicated) and printed by the CLI after the summary.
+const screenWarnings = new Set();
+export function takeScreenWarnings() { const list = [...screenWarnings]; screenWarnings.clear(); return list; }
+export function screenString(value, field, warn = message => screenWarnings.add(message), packageName = false) {
+  if (typeof value !== 'string') return '';
+  if (!secretLike(value, packageName, false)) return value;
+  warn('Dropped ' + field + ': it looked like a key.');
+  return '';
+}
 export function appName(root, explicit = '', url = '') {
   let host = ''; try { host = new URL(url).hostname; if (Object.keys(HOSTS).some(s => host.endsWith('.' + s))) host = host.split('.')[0]; } catch {}
-  for (const candidate of [explicit, readJson(join(root, 'package.json'))?.name, host, basename(root)]) {
+  for (const candidate of [explicit, host, readJson(join(root, 'package.json'))?.name]) {
     const raw = String(candidate || '').trim();
-    if (secretLike(raw)) continue;
+    if (!screenString(raw, 'name')) { if (raw) return ''; continue; }
     const n = raw.replace(/[^A-Za-z0-9 @/._-]/g, '').trim();
-    if (n && !TEMPLATES.has(n.toLowerCase().replace(/_/g, '-')) && !secretLike(n) && !secretLike(n.slice(0, 80))) return n.slice(0, 80);
+    if (n && (!screenString(n, 'name') || !screenString(n.slice(0, 80), 'name'))) return '';
+    if (n && !TEMPLATES.has(n.toLowerCase().replace(/^@[^/]+\//, '').replace(/_/g, '-'))) return n.slice(0, 80);
   }
   return '';
 }
@@ -270,9 +346,11 @@ export function withHook(current = '') {
 }
 
 function publicUrl(given) {
+  if (!screenString(given, 'url')) return { url: '', cleaning: Boolean(given) };
   try {
     const u = new URL(String(given));
     if (!['http:', 'https:'].includes(u.protocol)) return { url: '', cleaning: false };
+    if (/sb_|svk_|eyJ/i.test(u.hostname)) return { url: '', cleaning: true };
     const keep = /^(\/[A-Za-z0-9._~-]{1,64}){0,8}\/?$/.test(u.pathname)
       && u.pathname.split('/').every(segment => segment.length <= 40 && !/sb_|svk_|eyJ/i.test(segment));
     return { url: u.origin + (keep && u.pathname !== '/' ? u.pathname : ''),
@@ -286,17 +364,23 @@ export function buildReport(root, opts = {}, procEnv = process.env) {
   const { packages, source, truncated } = readPackages(root);
   const url = normPublicUrl(opts.url || procEnv.SAFETYVIBE_URL || '');
   const sb = findSupabase(root, procEnv);
+  const host = sb.url ? screenString(new URL(sb.url).host, 'supabase host') || null : null;
+  const project_ref = host && /^([a-z0-9]{20})\.supabase\.co$/.exec(host)?.[1] || null;
+  const supabase = sb.warnings.length ? { project_ref, host, secret_key_exposed_client_side: true }
+    : sb.url && sb.key ? { project_ref, host, key_kind: sb.kind, key_fingerprint: createHash('sha256').update(sb.key, 'utf8').digest('hex').slice(0, 8) } : null;
   const rawEnvironment = String(opts.environment || procEnv.SAFETYVIBE_ENV || (procEnv.NODE_ENV === 'production' ? 'production' : ''));
   const environment = rawEnvironment.replace(/[^A-Za-z0-9_-]/g, '');
-  return {
+  return Object.fromEntries(Object.entries({
     v: 1,
     name: appName(root, opts.name, url),
     url,
-    platform: detectPlatform(root, procEnv, url),
-    environment: [rawEnvironment, environment, environment.slice(0, 20)].some(secretLike) ? '' : environment.slice(0, 20),
+    platform: screenString(detectPlatform(root, procEnv, url), 'platform'),
+    environment: screenString(rawEnvironment, 'environment') && screenString(environment, 'environment') ? environment.slice(0, 20) : '',
     lockfile: source,
+    versions_source: "lockfile",
+    source: "connector",
     packages,
     ...(truncated ? { truncated: true } : {}),
-    supabase: sb.url && sb.key ? { url: sb.url, key: sb.key, kind: sb.kind } : null,
-  };
+    supabase,
+  }).filter(([, value]) => value !== ''));
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "safetyvibe-connect",
-  "version": "0.2.1",
-  "description": "SafetyVibe security monitoring for AI-built apps (Lovable, Replit, Bolt, Claude Code\u2026). Reports the app's dependency list, public URL and, if used, its Supabase project URL + public anon key. Never source code or secrets.",
+  "version": "0.3.0",
+  "description": "Checks your app's dependencies for known vulnerabilities and its public configuration for common mistakes. Sends the package list and public settings only; preview with --dry-run.",
   "type": "module",
   "bin": {
     "safetyvibe-connect": "cli.mjs"
@@ -10,22 +10,26 @@
     "cli.mjs",
     "lib.mjs",
     "README.md",
-    "AGENTS.md"
+    "AGENTS.md",
+    "LICENSE",
+    "SECURITY.md"
   ],
   "engines": {
     "node": ">=18"
   },
-  "license": "UNLICENSED",
-  "homepage": "https://safetyvibe.eu",
+  "license": "MIT",
+  "homepage": "https://safetyvibe.eu/connect",
   "keywords": [
     "security",
     "vulnerabilities",
-    "lovable",
-    "replit",
-    "bolt",
-    "supabase",
-    "vibe-coding",
+    "dependencies",
+    "audit",
+    "osv",
     "safetyvibe"
   ],
-  "author": "SafetyVibe <safetyvibe@advertis.ee>"
+  "author": "SafetyVibe <safetyvibe@advertis.ee>",
+  "bugs": {
+    "email": "safetyvibe@advertis.ee",
+    "url": "https://safetyvibe.eu/connect"
+  }
 }