secanix 0.1.2 → 0.1.3

package/README.md

@@ -1,42 +1,42 @@
-# Secanix
-
-Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
-
-Checks it runs:
-- Leaked secrets (API keys, tokens, credentials committed to the repo)
-- Exposed Supabase service role keys
-- Missing auth on Next.js API routes
-- Disabled Supabase Row Level Security (RLS)
-- CORS wildcard origins
-- Vulnerable dependencies (known CVEs)
-
-## CLI Usage
-
-```
-npx -p secanix@latest secanix
-```
-Runs all checks against the current directory and prints a human-readable report.
-
-```
-npx -p secanix@latest secanix --json
-```
-Same scan, machine-readable JSON output — useful for piping into other tooling.
-
-## GitHub Action
-
-Add to `.github/workflows/security-scan.yml` in your repo:
-
-```yaml
-name: Security Scan
-on: pull_request
-permissions:
-  pull-requests: write
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cutryandifonna/secanix@v1
-```
-
-The action fails CI when a critical finding is present (leaked secret, exposed Supabase service role key, or RLS disabled). It posts and updates a single PR comment listing all findings by severity. This requires the consuming workflow to grant `permissions: pull-requests: write` itself, as shown above — without it, comment posting fails with a 403. GitHub-hosted `ubuntu-latest` runners (uses `sudo` for tool installs — self-hosted runners need equivalent permissions).
+# Secanix
+
+Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
+
+Checks it runs:
+- Leaked secrets (API keys, tokens, credentials committed to the repo)
+- Exposed Supabase service role keys
+- Missing auth on Next.js API routes
+- Disabled Supabase Row Level Security (RLS)
+- CORS wildcard origins
+- Vulnerable dependencies (known CVEs)
+
+## CLI Usage
+
+```
+npx -p secanix@latest secanix
+```
+Runs all checks against the current directory and prints a human-readable report.
+
+```
+npx -p secanix@latest secanix --json
+```
+Same scan, machine-readable JSON output — useful for piping into other tooling.
+
+## GitHub Action
+
+Add to `.github/workflows/security-scan.yml` in your repo:
+
+```yaml
+name: Security Scan
+on: pull_request
+permissions:
+  pull-requests: write
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cutryandifonna/secanix@v1
+```
+
+The action fails CI when a critical finding is present (leaked secret, exposed Supabase service role key, or RLS disabled). It posts and updates a single PR comment listing all findings by severity. This requires the consuming workflow to grant `permissions: pull-requests: write` itself, as shown above — without it, comment posting fails with a 403. GitHub-hosted `ubuntu-latest` runners (uses `sudo` for tool installs — self-hosted runners need equivalent permissions).

package/dist/checks/apiAuthMissing.js

@@ -69,7 +69,6 @@ export async function findMissingApiAuth(targetDir) {
         RULE_PATH,
         "--json",
         "--quiet",
-        "--no-git-ignore",
         targetDir,
     ]);
     return parseSemgrepReport(stdout).map((finding) => ({

package/dist/checks/secretScan.js

@@ -1,7 +1,10 @@
 import { spawn } from "node:child_process";
+import { dirname, join } from "node:path";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const CONFIG_PATH = join(__dirname, "..", "rules", "gitleaks-config.toml");
 export class GitleaksNotFoundError extends Error {
     constructor() {
         super("gitleaks gak ketemu di PATH. Install: https://github.com/gitleaks/gitleaks#installing");
@@ -68,6 +71,8 @@ export async function runSecretScan(targetDir) {
             targetDir,
             "--no-git",
             "--no-banner",
+            "--config",
+            CONFIG_PATH,
             "--report-format",
             "json",
             "--report-path",

package/dist/rules/gitleaks-config.toml

@@ -0,0 +1,13 @@
+[extend]
+useDefault = true
+
+[allowlist]
+paths = [
+  '''(^|/)node_modules(/|$)''',
+  '''(^|/)\.git(/|$)''',
+  '''(^|/)\.next(/|$)''',
+  '''(^|/)dist(/|$)''',
+  '''(^|/)build(/|$)''',
+  '''(^|/)out(/|$)''',
+  '''(^|/)coverage(/|$)''',
+]

package/dist/rules/nextjs-api-auth-missing.yaml

@@ -1,24 +1,24 @@
-rules:
-  - id: nextjs-api-route-missing-auth
-    languages: [typescript, javascript]
-    severity: WARNING
-    message: >-
-      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
-    paths:
-      include:
-        - "pages/api/**"
-        - "src/pages/api/**"
-        - "app/**/route.ts"
-        - "app/**/route.js"
-        - "src/app/**/route.ts"
-        - "src/app/**/route.js"
-    patterns:
-      - pattern-either:
-          - pattern: export default function $HANDLER(...) { ... }
-          - pattern: export default async function $HANDLER(...) { ... }
-          - pattern: export async function GET(...) { ... }
-          - pattern: export async function POST(...) { ... }
-          - pattern: export async function PUT(...) { ... }
-          - pattern: export async function PATCH(...) { ... }
-          - pattern: export async function DELETE(...) { ... }
-      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)
+rules:
+  - id: nextjs-api-route-missing-auth
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
+    paths:
+      include:
+        - "pages/api/**"
+        - "src/pages/api/**"
+        - "app/**/route.ts"
+        - "app/**/route.js"
+        - "src/app/**/route.ts"
+        - "src/app/**/route.js"
+    patterns:
+      - pattern-either:
+          - pattern: export default function $HANDLER(...) { ... }
+          - pattern: export default async function $HANDLER(...) { ... }
+          - pattern: export async function GET(...) { ... }
+          - pattern: export async function POST(...) { ... }
+          - pattern: export async function PUT(...) { ... }
+          - pattern: export async function PATCH(...) { ... }
+          - pattern: export async function DELETE(...) { ... }
+      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secanix",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": false,
   "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
   "license": "MIT",