secanix 0.1.2

package/README.md

@@ -0,0 +1,42 @@
+# Secanix
+
+Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
+
+Checks it runs:
+- Leaked secrets (API keys, tokens, credentials committed to the repo)
+- Exposed Supabase service role keys
+- Missing auth on Next.js API routes
+- Disabled Supabase Row Level Security (RLS)
+- CORS wildcard origins
+- Vulnerable dependencies (known CVEs)
+
+## CLI Usage
+
+```
+npx -p secanix@latest secanix
+```
+Runs all checks against the current directory and prints a human-readable report.
+
+```
+npx -p secanix@latest secanix --json
+```
+Same scan, machine-readable JSON output — useful for piping into other tooling.
+
+## GitHub Action
+
+Add to `.github/workflows/security-scan.yml` in your repo:
+
+```yaml
+name: Security Scan
+on: pull_request
+permissions:
+  pull-requests: write
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cutryandifonna/secanix@v1
+```
+
+The action fails CI when a critical finding is present (leaked secret, exposed Supabase service role key, or RLS disabled). It posts and updates a single PR comment listing all findings by severity. This requires the consuming workflow to grant `permissions: pull-requests: write` itself, as shown above — without it, comment posting fails with a 403. GitHub-hosted `ubuntu-latest` runners (uses `sudo` for tool installs — self-hosted runners need equivalent permissions).

package/dist/checks/apiAuthMissing.js

@@ -0,0 +1,79 @@
+import { spawn } from "node:child_process";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const RULE_PATH = join(__dirname, "..", "rules", "nextjs-api-auth-missing.yaml");
+export class SemgrepNotFoundError extends Error {
+    constructor() {
+        super("semgrep gak ketemu di PATH. Install: https://semgrep.dev/docs/getting-started/");
+        this.name = "SemgrepNotFoundError";
+    }
+}
+function runSemgrepProcess(args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("semgrep", args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            if (err.code === "ENOENT") {
+                reject(new SemgrepNotFoundError());
+            }
+            else {
+                reject(err);
+            }
+        });
+        child.on("close", (code) => {
+            // semgrep exits 1 when it has findings — that's not a run failure.
+            if (code === 0 || code === 1) {
+                resolve(stdout);
+            }
+            else {
+                reject(new Error(`semgrep exit code ${code}: ${stderr.trim()}`));
+            }
+        });
+    });
+}
+export function parseSemgrepReport(json) {
+    const trimmed = json.trim();
+    if (trimmed.length === 0)
+        return [];
+    const raw = JSON.parse(trimmed);
+    if (typeof raw !== "object" || raw === null || !Array.isArray(raw.results)) {
+        return [];
+    }
+    const findings = [];
+    for (const entry of raw.results) {
+        if (typeof entry.path !== "string" ||
+            typeof entry.check_id !== "string" ||
+            typeof entry.start?.line !== "number") {
+            continue;
+        }
+        findings.push({
+            file: entry.path,
+            line: entry.start.line,
+            ruleId: entry.check_id.split(".").pop() ?? entry.check_id,
+            description: entry.extra?.message?.trim() ?? entry.check_id,
+        });
+    }
+    return findings;
+}
+export async function findMissingApiAuth(targetDir) {
+    const stdout = await runSemgrepProcess([
+        "--config",
+        RULE_PATH,
+        "--json",
+        "--quiet",
+        "--no-git-ignore",
+        targetDir,
+    ]);
+    return parseSemgrepReport(stdout).map((finding) => ({
+        ...finding,
+        file: relative(targetDir, resolve(targetDir, finding.file)).split(sep).join("/"),
+    }));
+}

package/dist/checks/corsWildcard.js

@@ -0,0 +1,47 @@
+import { readFile } from "node:fs/promises";
+import { extname, relative, sep } from "node:path";
+import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+// Manual header set: res.setHeader('Access-Control-Allow-Origin', '*'),
+// or an object literal { 'Access-Control-Allow-Origin': '*' }.
+const DIRECT_HEADER_PATTERN = /access-control-allow-origin['"]?\s*[:,]\s*['"]\*['"]/i;
+// next.config.js headers() array format: { key: '...', value: '*' } on
+// separate lines — scanned across the whole file, not line-by-line.
+const NEXT_CONFIG_HEADER_PATTERN = /key\s*:\s*['"]Access-Control-Allow-Origin['"][\s\S]{0,80}?value\s*:\s*['"]\*['"]/gi;
+// cors npm package: cors({ origin: '*' }).
+const CORS_PACKAGE_PATTERN = /\bcors\s*\(\s*\{[\s\S]{0,200}?origin\s*:\s*['"]\*['"]/gi;
+function isScannableFile(filePath) {
+    return SOURCE_EXTENSIONS.has(extname(filePath));
+}
+function lineAt(content, index) {
+    return content.slice(0, index).split(/\r?\n/).length;
+}
+export function scanTextForCorsWildcard(content) {
+    const lines = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        if (DIRECT_HEADER_PATTERN.test(line))
+            lines.push(index + 1);
+    });
+    for (const match of content.matchAll(NEXT_CONFIG_HEADER_PATTERN)) {
+        lines.push(lineAt(content, match.index));
+    }
+    for (const match of content.matchAll(CORS_PACKAGE_PATTERN)) {
+        lines.push(lineAt(content, match.index));
+    }
+    return [...new Set(lines)].sort((a, b) => a - b).map((line) => ({ line }));
+}
+export async function findCorsWildcard(targetDir) {
+    const files = await collectFiles(targetDir, isScannableFile);
+    const findings = [];
+    for (const file of files) {
+        const content = await readFile(file, "utf8");
+        for (const match of scanTextForCorsWildcard(content)) {
+            findings.push({
+                file: relative(targetDir, file).split(sep).join("/"),
+                line: match.line,
+                ruleId: "cors-wildcard-origin",
+                description: 'CORS "Access-Control-Allow-Origin" di-set ke "*" — semua origin bisa akses endpoint ini, termasuk yang jahat.',
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/dependencyVulnerabilities.js

@@ -0,0 +1,112 @@
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { relative, resolve, sep } from "node:path";
+export class OsvScannerNotFoundError extends Error {
+    constructor() {
+        super("osv-scanner gak ketemu di PATH. Install: https://google.github.io/osv-scanner/installation/");
+        this.name = "OsvScannerNotFoundError";
+    }
+}
+function runOsvScannerProcess(args) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn("osv-scanner", args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            if (err.code === "ENOENT") {
+                reject(new OsvScannerNotFoundError());
+            }
+            else {
+                reject(err);
+            }
+        });
+        child.on("close", (code) => {
+            // osv-scanner exits 1 when it finds vulnerabilities — not a run failure.
+            if (code === 0 || code === 1) {
+                resolvePromise(stdout);
+            }
+            else {
+                reject(new Error(`osv-scanner exit code ${code}: ${stderr.trim()}`));
+            }
+        });
+    });
+}
+export function parseOsvReport(json) {
+    const trimmed = json.trim();
+    if (trimmed.length === 0)
+        return [];
+    const raw = JSON.parse(trimmed);
+    if (typeof raw !== "object" || raw === null || !Array.isArray(raw.results)) {
+        return [];
+    }
+    const findings = [];
+    for (const result of raw.results) {
+        if (typeof result.source?.path !== "string")
+            continue;
+        for (const pkg of result.packages ?? []) {
+            if (typeof pkg.package?.name !== "string" || typeof pkg.package?.version !== "string")
+                continue;
+            for (const group of pkg.groups ?? []) {
+                const ruleId = group.ids?.[0];
+                if (typeof ruleId !== "string")
+                    continue;
+                const aliases = (group.aliases ?? []).join(", ") || ruleId;
+                const severity = group.max_severity ? ` (severity ${group.max_severity})` : "";
+                findings.push({
+                    file: result.source.path,
+                    packageName: pkg.package.name,
+                    ruleId,
+                    description: `${pkg.package.name}@${pkg.package.version} kena kerentanan dikenal: ${aliases}${severity}.`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+// osv-scanner's JSON output doesn't carry line numbers — best-effort locate
+// the package name's first mention in its own lockfile as an anchor.
+function findLineForPackage(content, packageName) {
+    const needle = `"${packageName}"`;
+    const lines = content.split(/\r?\n/);
+    const index = lines.findIndex((line) => line.includes(needle));
+    return index === -1 ? 1 : index + 1;
+}
+export async function findDependencyVulnerabilities(targetDir) {
+    const stdout = await runOsvScannerProcess([
+        "scan",
+        "source",
+        "-r",
+        "--allow-no-lockfiles",
+        "--format",
+        "json",
+        targetDir,
+    ]);
+    const rawFindings = parseOsvReport(stdout);
+    const contentCache = new Map();
+    const findings = [];
+    for (const raw of rawFindings) {
+        // osv-scanner's source.path may be relative to targetDir rather than to
+        // our own cwd (e.g. when targetDir is a subdirectory) — resolve once and
+        // reuse it for both the line lookup and the reported file path so they
+        // agree on the same file.
+        const absolutePath = resolve(targetDir, raw.file);
+        let content = contentCache.get(raw.file);
+        if (content === undefined) {
+            content = await readFile(absolutePath, "utf8").catch(() => "");
+            contentCache.set(raw.file, content);
+        }
+        findings.push({
+            file: relative(targetDir, absolutePath).split(sep).join("/"),
+            line: findLineForPackage(content, raw.packageName),
+            ruleId: raw.ruleId,
+            description: raw.description,
+        });
+    }
+    return findings;
+}

package/dist/checks/exposedServiceRoleKey.js

@@ -0,0 +1,39 @@
+import { readFile } from "node:fs/promises";
+import { basename, extname, relative, sep } from "node:path";
+import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+// NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
+// a Supabase service role key under that prefix is a guaranteed leak.
+const EXPOSED_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:SERVICE_ROLE|SERVICE_KEY)[A-Z0-9_]*/i;
+export function scanTextForExposedServiceRoleKey(content) {
+    const matches = [];
+    const lines = content.split(/\r?\n/);
+    lines.forEach((line, index) => {
+        const match = EXPOSED_KEY_PATTERN.exec(line);
+        if (match) {
+            matches.push({ line: index + 1, variableName: match[0] });
+        }
+    });
+    return matches;
+}
+function isScannableFile(filePath) {
+    const name = basename(filePath);
+    if (name.startsWith(".env"))
+        return true;
+    return SOURCE_EXTENSIONS.has(extname(filePath));
+}
+export async function findExposedServiceRoleKeys(targetDir) {
+    const files = await collectFiles(targetDir, isScannableFile);
+    const findings = [];
+    for (const file of files) {
+        const content = await readFile(file, "utf8");
+        for (const match of scanTextForExposedServiceRoleKey(content)) {
+            findings.push({
+                file: relative(targetDir, file).split(sep).join("/"),
+                line: match.line,
+                ruleId: "supabase-service-role-key-public-env",
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Supabase service role key — Next.js bakal inline ini ke client bundle.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/fsWalk.js

@@ -0,0 +1,20 @@
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+export const IGNORED_DIRS = new Set(["node_modules", ".git", ".next", "dist", "build", "out", "coverage"]);
+export const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+export async function collectFiles(dir, isScannable) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (IGNORED_DIRS.has(entry.name))
+                continue;
+            files.push(...(await collectFiles(fullPath, isScannable)));
+        }
+        else if (entry.isFile() && isScannable(fullPath)) {
+            files.push(fullPath);
+        }
+    }
+    return files;
+}

package/dist/checks/rlsDisabled.js

@@ -0,0 +1,67 @@
+import { readFile } from "node:fs/promises";
+import { extname, relative, sep } from "node:path";
+import { collectFiles } from "./fsWalk.js";
+const CREATE_TABLE_PATTERN = /create\s+table\s+(?:if\s+not\s+exists\s+)?(?:"?\w+"?\.)?"?(\w+)"?/i;
+const ENABLE_RLS_PATTERN = /alter\s+table\s+(?:only\s+)?(?:"?\w+"?\.)?"?(\w+)"?\s+enable\s+row\s+level\s+security/gi;
+const DISABLE_RLS_PATTERN = /alter\s+table\s+(?:only\s+)?(?:"?\w+"?\.)?"?(\w+)"?\s+disable\s+row\s+level\s+security/gi;
+function isSqlFile(filePath) {
+    return extname(filePath) === ".sql";
+}
+// Migrations put one statement per line in practice — scanning line-by-line
+// is enough to recover a usable line number without a real SQL parser.
+export function findCreatedTables(content) {
+    const tables = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        const match = CREATE_TABLE_PATTERN.exec(line);
+        if (match)
+            tables.push({ name: match[1].toLowerCase(), line: index + 1 });
+    });
+    return tables;
+}
+function collectTableNames(content, pattern) {
+    const names = new Set();
+    for (const match of content.matchAll(pattern)) {
+        names.add(match[1].toLowerCase());
+    }
+    return names;
+}
+// RLS enable/disable statements are often in a different migration file than
+// the CREATE TABLE — so this correlates table names across every .sql file
+// in the project rather than checking each file in isolation.
+export async function findRlsDisabledTables(targetDir) {
+    const files = await collectFiles(targetDir, isSqlFile);
+    const createdTables = [];
+    const enabledTables = new Set();
+    const disabledTables = new Set();
+    for (const file of files) {
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        for (const table of findCreatedTables(content)) {
+            createdTables.push({ ...table, file: relFile });
+        }
+        for (const name of collectTableNames(content, ENABLE_RLS_PATTERN))
+            enabledTables.add(name);
+        for (const name of collectTableNames(content, DISABLE_RLS_PATTERN))
+            disabledTables.add(name);
+    }
+    const findings = [];
+    for (const table of createdTables) {
+        if (disabledTables.has(table.name)) {
+            findings.push({
+                file: table.file,
+                line: table.line,
+                ruleId: "supabase-rls-disabled",
+                description: `Tabel "${table.name}" RLS-nya di-disable eksplisit — data bisa diakses tanpa policy.`,
+            });
+        }
+        else if (!enabledTables.has(table.name)) {
+            findings.push({
+                file: table.file,
+                line: table.line,
+                ruleId: "supabase-rls-missing",
+                description: `Tabel "${table.name}" gak ketemu "ENABLE ROW LEVEL SECURITY" di migration manapun — kemungkinan RLS mati.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/secretScan.js

@@ -0,0 +1,84 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export class GitleaksNotFoundError extends Error {
+    constructor() {
+        super("gitleaks gak ketemu di PATH. Install: https://github.com/gitleaks/gitleaks#installing");
+        this.name = "GitleaksNotFoundError";
+    }
+}
+function runGitleaksProcess(args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("gitleaks", args, { stdio: ["ignore", "ignore", "pipe"] });
+        let stderr = "";
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on("error", (err) => {
+            if (err.code === "ENOENT") {
+                reject(new GitleaksNotFoundError());
+            }
+            else {
+                reject(err);
+            }
+        });
+        child.on("close", (code) => {
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`gitleaks exit code ${code}: ${stderr.trim()}`));
+            }
+        });
+    });
+}
+// gitleaks report never carries the raw secret value into a Finding here —
+// printing/logging matched secrets would itself be a leak.
+export function parseGitleaksReport(json) {
+    const trimmed = json.trim();
+    if (trimmed.length === 0)
+        return [];
+    const raw = JSON.parse(trimmed);
+    if (!Array.isArray(raw))
+        return [];
+    const findings = [];
+    for (const entry of raw) {
+        if (typeof entry.File !== "string" ||
+            typeof entry.StartLine !== "number" ||
+            typeof entry.RuleID !== "string") {
+            continue;
+        }
+        findings.push({
+            file: entry.File,
+            line: entry.StartLine,
+            ruleId: entry.RuleID,
+            description: entry.Description ?? entry.RuleID,
+        });
+    }
+    return findings;
+}
+export async function runSecretScan(targetDir) {
+    const tempDir = await mkdtemp(join(tmpdir(), "vibe-secret-scan-"));
+    const reportPath = join(tempDir, "gitleaks-report.json");
+    try {
+        await runGitleaksProcess([
+            "detect",
+            "--source",
+            targetDir,
+            "--no-git",
+            "--no-banner",
+            "--report-format",
+            "json",
+            "--report-path",
+            reportPath,
+            "--exit-code",
+            "0",
+        ]);
+        const content = await readFile(reportPath, "utf8").catch(() => "");
+        return parseGitleaksReport(content);
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}

package/dist/checks/types.js

@@ -0,0 +1 @@
+export {};

package/dist/cli.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { readFileSync, realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { findMissingApiAuth, SemgrepNotFoundError } from "./checks/apiAuthMissing.js";
+import { findCorsWildcard } from "./checks/corsWildcard.js";
+import { findDependencyVulnerabilities, OsvScannerNotFoundError } from "./checks/dependencyVulnerabilities.js";
+import { findExposedServiceRoleKeys } from "./checks/exposedServiceRoleKey.js";
+import { findRlsDisabledTables } from "./checks/rlsDisabled.js";
+import { GitleaksNotFoundError, runSecretScan } from "./checks/secretScan.js";
+import { buildReport, formatReport } from "./report.js";
+const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+export async function run(targetDir = process.cwd(), options = {}) {
+    const { json = false } = options;
+    if (!json) {
+        console.log(`Secanix v${version}`);
+    }
+    const checkFindings = [];
+    try {
+        checkFindings.push({ checkId: "secret-scan", findings: await runSecretScan(targetDir) });
+    }
+    catch (err) {
+        if (err instanceof GitleaksNotFoundError) {
+            console.error(err.message);
+            return 1;
+        }
+        throw err;
+    }
+    checkFindings.push({
+        checkId: "exposed-service-role-key",
+        findings: await findExposedServiceRoleKeys(targetDir),
+    });
+    try {
+        checkFindings.push({ checkId: "api-auth-missing", findings: await findMissingApiAuth(targetDir) });
+    }
+    catch (err) {
+        if (err instanceof SemgrepNotFoundError) {
+            console.error(err.message);
+            return 1;
+        }
+        throw err;
+    }
+    checkFindings.push({ checkId: "rls-disabled", findings: await findRlsDisabledTables(targetDir) });
+    checkFindings.push({ checkId: "cors-wildcard", findings: await findCorsWildcard(targetDir) });
+    try {
+        checkFindings.push({
+            checkId: "dependency-cve",
+            findings: await findDependencyVulnerabilities(targetDir),
+        });
+    }
+    catch (err) {
+        if (err instanceof OsvScannerNotFoundError) {
+            console.error(err.message);
+            return 1;
+        }
+        throw err;
+    }
+    const reported = buildReport(checkFindings);
+    if (json) {
+        console.log(JSON.stringify(reported));
+    }
+    else {
+        for (const line of formatReport(reported)) {
+            console.log(line);
+        }
+    }
+    return 0;
+}
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+if (isMain) {
+    const args = process.argv.slice(2);
+    const json = args.includes("--json");
+    const targetDir = args.find((arg) => arg !== "--json" && !arg.startsWith("-"));
+    process.exit(await run(targetDir, { json }));
+}

package/dist/report.js

@@ -0,0 +1,89 @@
+// Static lookup for checks whose ruleId is a fixed, known-ahead-of-time set.
+const RULE_INFO = {
+    "supabase-service-role-key-public-env": {
+        severity: "critical",
+        fix: "Jangan expose service role key lewat NEXT_PUBLIC_* — pindahin ke env var server-only, lalu rotate key ini di Supabase dashboard kalau udah sempet ke-deploy.",
+    },
+    "nextjs-api-route-missing-auth": {
+        severity: "high",
+        fix: "Tambahin auth check (getServerSession/getToken/dst) di awal handler sebelum jalanin logic apapun.",
+    },
+    "supabase-rls-disabled": {
+        severity: "critical",
+        fix: "Enable lagi RLS-nya (ALTER TABLE ... ENABLE ROW LEVEL SECURITY) dan pasang policy yang sesuai — jangan biarin RLS mati di production.",
+    },
+    "supabase-rls-missing": {
+        severity: "high",
+        fix: "Tambahin ALTER TABLE ... ENABLE ROW LEVEL SECURITY + policy buat tabel ini.",
+    },
+    "cors-wildcard-origin": {
+        severity: "medium",
+        fix: "Ganti '*' jadi daftar origin eksplisit yang emang butuh akses, atau validasi origin secara dinamis di server.",
+    },
+};
+// gitleaks (secret-scan) and osv-scanner (dependency-cve) each emit a
+// ruleId that varies per finding (rule name / GHSA id), so they're
+// classified by checkId instead of an exhaustive per-ruleId table.
+const SECRET_SCAN_FIX = "Cabut/rotate secret ini sekarang, hapus dari kode & git history (bukan cuma commit baru), pindahin ke env var / secret manager.";
+const DEPENDENCY_CVE_FIX = "Update dependency ini ke versi yang udah di-patch (cek advisory-nya buat versi aman).";
+const DEFAULT_FIX = "Cek temuan ini manual — belum ada saran otomatis buat rule ini.";
+function cvssToSeverity(score) {
+    if (score >= 9)
+        return "critical";
+    if (score >= 7)
+        return "high";
+    if (score >= 4)
+        return "medium";
+    return "low";
+}
+// dependencyVulnerabilities.ts embeds the CVSS score it got from
+// osv-scanner into its own description as "(severity 8.1)" — that format
+// is ours to rely on since we control where it's written.
+function severityFromDescription(description) {
+    const match = /severity (\d+(?:\.\d+)?)/.exec(description);
+    return match ? cvssToSeverity(Number(match[1])) : undefined;
+}
+export function classify(finding, checkId) {
+    const ruleInfo = RULE_INFO[finding.ruleId];
+    if (ruleInfo) {
+        return { ...finding, severity: ruleInfo.severity, fixSuggestion: ruleInfo.fix };
+    }
+    if (checkId === "secret-scan") {
+        return { ...finding, severity: "critical", fixSuggestion: SECRET_SCAN_FIX };
+    }
+    if (checkId === "dependency-cve") {
+        return {
+            ...finding,
+            severity: severityFromDescription(finding.description) ?? "high",
+            fixSuggestion: DEPENDENCY_CVE_FIX,
+        };
+    }
+    return { ...finding, severity: "medium", fixSuggestion: DEFAULT_FIX };
+}
+const SEVERITY_ORDER = ["critical", "high", "medium", "low"];
+const SEVERITY_RANK = new Map(SEVERITY_ORDER.map((severity, index) => [severity, index]));
+export function buildReport(checkFindings) {
+    const reported = checkFindings.flatMap(({ checkId, findings }) => findings.map((finding) => classify(finding, checkId)));
+    return reported.sort((a, b) => SEVERITY_RANK.get(a.severity) - SEVERITY_RANK.get(b.severity));
+}
+const SEVERITY_LABEL = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+};
+export function formatReport(reported) {
+    if (reported.length === 0)
+        return ["Nol temuan."];
+    const lines = [`${reported.length} temuan:`];
+    for (const severity of SEVERITY_ORDER) {
+        const group = reported.filter((finding) => finding.severity === severity);
+        if (group.length === 0)
+            continue;
+        lines.push(`[${SEVERITY_LABEL[severity]}] (${group.length})`);
+        for (const finding of group) {
+            lines.push(`  ${finding.file}:${finding.line} — ${finding.description} Fix: ${finding.fixSuggestion}`);
+        }
+    }
+    return lines;
+}

package/dist/rules/nextjs-api-auth-missing.yaml

@@ -0,0 +1,24 @@
+rules:
+  - id: nextjs-api-route-missing-auth
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
+    paths:
+      include:
+        - "pages/api/**"
+        - "src/pages/api/**"
+        - "app/**/route.ts"
+        - "app/**/route.js"
+        - "src/app/**/route.ts"
+        - "src/app/**/route.js"
+    patterns:
+      - pattern-either:
+          - pattern: export default function $HANDLER(...) { ... }
+          - pattern: export default async function $HANDLER(...) { ... }
+          - pattern: export async function GET(...) { ... }
+          - pattern: export async function POST(...) { ... }
+          - pattern: export async function PUT(...) { ... }
+          - pattern: export async function PATCH(...) { ... }
+          - pattern: export async function DELETE(...) { ... }
+      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "secanix",
+  "version": "0.1.2",
+  "private": false,
+  "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cutryandifonna/secanix.git"
+  },
+  "type": "module",
+  "bin": {
+    "secanix": "dist/cli.js"
+  },
+  "main": "./dist/cli.js",
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/copy-rules.mjs",
+    "dev": "tsx src/cli.ts",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.10"
+  }
+}