secanix 0.1.2 → 0.1.4

package/README.md

@@ -1,42 +1,65 @@
-# Secanix
-
-Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
-
-Checks it runs:
-- Leaked secrets (API keys, tokens, credentials committed to the repo)
-- Exposed Supabase service role keys
-- Missing auth on Next.js API routes
-- Disabled Supabase Row Level Security (RLS)
-- CORS wildcard origins
-- Vulnerable dependencies (known CVEs)
-
-## CLI Usage
-
-```
-npx -p secanix@latest secanix
-```
-Runs all checks against the current directory and prints a human-readable report.
-
-```
-npx -p secanix@latest secanix --json
-```
-Same scan, machine-readable JSON output — useful for piping into other tooling.
-
-## GitHub Action
-
-Add to `.github/workflows/security-scan.yml` in your repo:
-
-```yaml
-name: Security Scan
-on: pull_request
-permissions:
-  pull-requests: write
-jobs:
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cutryandifonna/secanix@v1
-```
-
-The action fails CI when a critical finding is present (leaked secret, exposed Supabase service role key, or RLS disabled). It posts and updates a single PR comment listing all findings by severity. This requires the consuming workflow to grant `permissions: pull-requests: write` itself, as shown above — without it, comment posting fails with a 403. GitHub-hosted `ubuntu-latest` runners (uses `sudo` for tool installs — self-hosted runners need equivalent permissions).
+# Secanix
+
+Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
+
+Checks it runs:
+- Leaked secrets (API keys, tokens, credentials committed to the repo)
+- Exposed Supabase service role keys
+- Missing auth on Next.js API routes
+- Disabled Supabase Row Level Security (RLS)
+- CORS wildcard origins
+- Vulnerable dependencies (known CVEs)
+
+## CLI Usage
+
+```
+npx -p secanix@latest secanix
+```
+Runs all checks against the current directory and prints a human-readable report.
+
+```
+npx -p secanix@latest secanix --json
+```
+Same scan, machine-readable JSON output — useful for piping into other tooling.
+
+## Suppressing false positives
+
+Some findings are correct in general but not in your case — e.g. an API route
+protected by `middleware.ts` instead of an in-handler check, which
+`api-auth-missing` can't see. Add a `.secanix.json` at your project root:
+
+```json
+{
+  "ignore": [
+    {
+      "file": "app/api/admin/route.ts",
+      "ruleId": "nextjs-api-route-missing-auth",
+      "reason": "protected by middleware.ts, matcher /api/admin/*"
+    }
+  ]
+}
+```
+
+Both `file` (relative path) and `ruleId` must match exactly. Suppressed
+findings aren't silently dropped — they're printed separately (with your
+`reason`) so they stay visible for review, not just filtered out of the JSON
+output.
+
+## GitHub Action
+
+Add to `.github/workflows/security-scan.yml` in your repo:
+
+```yaml
+name: Security Scan
+on: pull_request
+permissions:
+  pull-requests: write
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cutryandifonna/secanix@v1
+```
+
+The action fails CI when a critical finding is present (leaked secret, exposed Supabase service role key, or RLS disabled). It posts and updates a single PR comment listing all findings by severity. This requires the consuming workflow to grant `permissions: pull-requests: write` itself, as shown above — without it, comment posting fails with a 403. GitHub-hosted `ubuntu-latest` runners (uses `sudo` for tool installs — self-hosted runners need equivalent permissions).

package/dist/checks/apiAuthMissing.js

@@ -1,6 +1,22 @@
 import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+const MIDDLEWARE_CANDIDATES = [
+    "middleware.ts",
+    "middleware.js",
+    join("src", "middleware.ts"),
+    join("src", "middleware.js"),
+];
+// A route can be protected upstream by middleware.ts instead of an in-handler
+// check — this rule only ever sees the handler file, so it can't tell.
+// Rather than guess at matcher-pattern coverage (getting that wrong would
+// silently hide a genuinely unprotected route), we stay honest about the gap.
+const MIDDLEWARE_CAVEAT = ' Kalo route ini diproteksi lewat middleware.ts, ini bisa jadi false positive — cek matcher-nya, atau suppress via .secanix.json kalo emang udah aman.';
+async function hasMiddlewareFile(targetDir) {
+    const results = await Promise.all(MIDDLEWARE_CANDIDATES.map((candidate) => access(join(targetDir, candidate)).then(() => true, () => false)));
+    return results.some(Boolean);
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const RULE_PATH = join(__dirname, "..", "rules", "nextjs-api-auth-missing.yaml");
 export class SemgrepNotFoundError extends Error {
@@ -69,11 +85,13 @@ export async function findMissingApiAuth(targetDir) {
         RULE_PATH,
         "--json",
         "--quiet",
-        "--no-git-ignore",
         targetDir,
     ]);
-    return parseSemgrepReport(stdout).map((finding) => ({
+    const findings = parseSemgrepReport(stdout).map((finding) => ({
         ...finding,
         file: relative(targetDir, resolve(targetDir, finding.file)).split(sep).join("/"),
     }));
+    if (findings.length === 0 || !(await hasMiddlewareFile(targetDir)))
+        return findings;
+    return findings.map((finding) => ({ ...finding, description: finding.description + MIDDLEWARE_CAVEAT }));
 }

package/dist/checks/rlsDisabled.js

@@ -59,7 +59,7 @@ export async function findRlsDisabledTables(targetDir) {
                 file: table.file,
                 line: table.line,
                 ruleId: "supabase-rls-missing",
-                description: `Tabel "${table.name}" gak ketemu "ENABLE ROW LEVEL SECURITY" di migration manapun — kemungkinan RLS mati.`,
+                description: `Tabel "${table.name}" gak ketemu "ENABLE ROW LEVEL SECURITY" di migration manapun — kemungkinan RLS mati. Ini cuma liat file migration, bukan state Supabase Dashboard asli — kalo RLS-nya emang udah dinyalain lewat Dashboard, suppress lewat .secanix.json.`,
             });
         }
     }

package/dist/checks/secretScan.js

@@ -1,7 +1,10 @@
 import { spawn } from "node:child_process";
-import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { copyFile, mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const CONFIG_PATH = join(__dirname, "..", "rules", "gitleaks-config.toml");
 export class GitleaksNotFoundError extends Error {
     constructor() {
         super("gitleaks gak ketemu di PATH. Install: https://github.com/gitleaks/gitleaks#installing");
@@ -58,16 +61,53 @@ export function parseGitleaksReport(json) {
     }
     return findings;
 }
+// Returns tracked + untracked-but-not-ignored relative paths, or null when
+// targetDir isn't a git repo (no .gitignore semantics to respect there).
+function listGitRespectedFiles(targetDir) {
+    return new Promise((resolve) => {
+        const child = spawn("git", ["-C", targetDir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { stdio: ["ignore", "pipe", "ignore"] });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.on("error", () => resolve(null));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                resolve(null);
+                return;
+            }
+            resolve(stdout.split("\0").filter((f) => f.length > 0));
+        });
+    });
+}
+// Mirrors the given relative paths into mirrorRoot so gitleaks (run with
+// --no-git) only ever sees files .gitignore would let through.
+async function mirrorFiles(sourceDir, files, mirrorRoot) {
+    for (const rel of files) {
+        const dest = join(mirrorRoot, rel);
+        await mkdir(dirname(dest), { recursive: true });
+        await copyFile(join(sourceDir, rel), dest).catch(() => { });
+    }
+}
 export async function runSecretScan(targetDir) {
     const tempDir = await mkdtemp(join(tmpdir(), "vibe-secret-scan-"));
     const reportPath = join(tempDir, "gitleaks-report.json");
     try {
+        const respectedFiles = await listGitRespectedFiles(targetDir);
+        let scanDir = targetDir;
+        if (respectedFiles !== null) {
+            scanDir = join(tempDir, "mirror");
+            await mkdir(scanDir, { recursive: true });
+            await mirrorFiles(targetDir, respectedFiles, scanDir);
+        }
         await runGitleaksProcess([
             "detect",
             "--source",
-            targetDir,
+            scanDir,
             "--no-git",
             "--no-banner",
+            "--config",
+            CONFIG_PATH,
             "--report-format",
             "json",
             "--report-path",
@@ -76,7 +116,18 @@ export async function runSecretScan(targetDir) {
             "0",
         ]);
         const content = await readFile(reportPath, "utf8").catch(() => "");
-        return parseGitleaksReport(content);
+        const findings = parseGitleaksReport(content);
+        if (respectedFiles === null)
+            return findings;
+        // Mirror dir is deleted below; rewrite paths to point at the real project.
+        const mirrorPrefix = scanDir.replace(/\\/g, "/");
+        return findings.map((finding) => {
+            const fileFwd = finding.file.replace(/\\/g, "/");
+            if (!fileFwd.startsWith(mirrorPrefix))
+                return finding;
+            const rel = fileFwd.slice(mirrorPrefix.length).replace(/^\/+/, "");
+            return { ...finding, file: join(targetDir, rel) };
+        });
     }
     finally {
         await rm(tempDir, { recursive: true, force: true });

package/dist/cli.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { readFileSync, realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { findMissingApiAuth, SemgrepNotFoundError } from "./checks/apiAuthMissing.js";
 import { findCorsWildcard } from "./checks/corsWildcard.js";
@@ -7,7 +9,40 @@ import { findDependencyVulnerabilities, OsvScannerNotFoundError } from "./checks
 import { findExposedServiceRoleKeys } from "./checks/exposedServiceRoleKey.js";
 import { findRlsDisabledTables } from "./checks/rlsDisabled.js";
 import { GitleaksNotFoundError, runSecretScan } from "./checks/secretScan.js";
-import { buildReport, formatReport } from "./report.js";
+import { applyIgnoreRules, buildReport, formatReport } from "./report.js";
+const IGNORE_FILE = ".secanix.json";
+// Missing file = no suppression (default, zero-friction). Malformed file
+// warns and falls back to no suppression rather than crashing the scan.
+export async function loadIgnoreRules(targetDir) {
+    let content;
+    try {
+        content = await readFile(join(targetDir, IGNORE_FILE), "utf8");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(content);
+        const ignore = parsed.ignore;
+        if (!Array.isArray(ignore))
+            return [];
+        const rules = [];
+        for (const entry of ignore) {
+            if (typeof entry === "object" &&
+                entry !== null &&
+                typeof entry.file === "string" &&
+                typeof entry.ruleId === "string") {
+                const { file, ruleId, reason } = entry;
+                rules.push({ file, ruleId, reason: typeof reason === "string" ? reason : undefined });
+            }
+        }
+        return rules;
+    }
+    catch (err) {
+        console.error(`${IGNORE_FILE} invalid, diabaikan: ${err.message}`);
+        return [];
+    }
+}
 const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export async function run(targetDir = process.cwd(), options = {}) {
     const { json = false } = options;
@@ -54,7 +89,15 @@ export async function run(targetDir = process.cwd(), options = {}) {
         }
         throw err;
     }
-    const reported = buildReport(checkFindings);
+    const ignoreRules = await loadIgnoreRules(targetDir);
+    const { findings: reported, suppressed } = applyIgnoreRules(buildReport(checkFindings), ignoreRules);
+    if (suppressed.length > 0) {
+        console.error(`${suppressed.length} temuan diabaikan via ${IGNORE_FILE}:`);
+        for (const finding of suppressed) {
+            const reasonSuffix = finding.reason ? ` (${finding.reason})` : "";
+            console.error(`  ${finding.file}:${finding.line} — ${finding.ruleId}${reasonSuffix}`);
+        }
+    }
     if (json) {
         console.log(JSON.stringify(reported));
     }

package/dist/report.js

@@ -60,6 +60,22 @@ export function classify(finding, checkId) {
     }
     return { ...finding, severity: "medium", fixSuggestion: DEFAULT_FIX };
 }
+// file+ruleId must both match — narrow on purpose so an ignore entry never
+// silently swallows an unrelated finding that happens to share one field.
+export function applyIgnoreRules(reported, ignoreRules) {
+    const findings = [];
+    const suppressed = [];
+    for (const finding of reported) {
+        const rule = ignoreRules.find((r) => r.file === finding.file && r.ruleId === finding.ruleId);
+        if (rule) {
+            suppressed.push({ ...finding, reason: rule.reason });
+        }
+        else {
+            findings.push(finding);
+        }
+    }
+    return { findings, suppressed };
+}
 const SEVERITY_ORDER = ["critical", "high", "medium", "low"];
 const SEVERITY_RANK = new Map(SEVERITY_ORDER.map((severity, index) => [severity, index]));
 export function buildReport(checkFindings) {

package/dist/rules/gitleaks-config.toml

@@ -0,0 +1,13 @@
+[extend]
+useDefault = true
+
+[allowlist]
+paths = [
+  '''(^|/)node_modules(/|$)''',
+  '''(^|/)\.git(/|$)''',
+  '''(^|/)\.next(/|$)''',
+  '''(^|/)dist(/|$)''',
+  '''(^|/)build(/|$)''',
+  '''(^|/)out(/|$)''',
+  '''(^|/)coverage(/|$)''',
+]

package/dist/rules/nextjs-api-auth-missing.yaml

@@ -1,24 +1,24 @@
-rules:
-  - id: nextjs-api-route-missing-auth
-    languages: [typescript, javascript]
-    severity: WARNING
-    message: >-
-      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
-    paths:
-      include:
-        - "pages/api/**"
-        - "src/pages/api/**"
-        - "app/**/route.ts"
-        - "app/**/route.js"
-        - "src/app/**/route.ts"
-        - "src/app/**/route.js"
-    patterns:
-      - pattern-either:
-          - pattern: export default function $HANDLER(...) { ... }
-          - pattern: export default async function $HANDLER(...) { ... }
-          - pattern: export async function GET(...) { ... }
-          - pattern: export async function POST(...) { ... }
-          - pattern: export async function PUT(...) { ... }
-          - pattern: export async function PATCH(...) { ... }
-          - pattern: export async function DELETE(...) { ... }
-      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)
+rules:
+  - id: nextjs-api-route-missing-auth
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
+    paths:
+      include:
+        - "pages/api/**"
+        - "src/pages/api/**"
+        - "app/**/route.ts"
+        - "app/**/route.js"
+        - "src/app/**/route.ts"
+        - "src/app/**/route.js"
+    patterns:
+      - pattern-either:
+          - pattern: export default function $HANDLER(...) { ... }
+          - pattern: export default async function $HANDLER(...) { ... }
+          - pattern: export async function GET(...) { ... }
+          - pattern: export async function POST(...) { ... }
+          - pattern: export async function PUT(...) { ... }
+          - pattern: export async function PATCH(...) { ... }
+          - pattern: export async function DELETE(...) { ... }
+      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secanix",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "private": false,
   "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
   "license": "MIT",