secanix 0.1.3 → 0.1.5

package/README.md

@@ -9,6 +9,8 @@ Checks it runs:
 - Disabled Supabase Row Level Security (RLS)
 - CORS wildcard origins
 - Vulnerable dependencies (known CVEs)
+- Open Firebase security rules (Firestore/Realtime Database/Storage)
+- Exposed Firebase Admin SDK keys (env leak or a committed service account JSON file)
 
 ## CLI Usage
 
@@ -22,6 +24,29 @@ npx -p secanix@latest secanix --json
 ```
 Same scan, machine-readable JSON output — useful for piping into other tooling.
 
+## Suppressing false positives
+
+Some findings are correct in general but not in your case — e.g. an API route
+protected by `middleware.ts` instead of an in-handler check, which
+`api-auth-missing` can't see. Add a `.secanix.json` at your project root:
+
+```json
+{
+  "ignore": [
+    {
+      "file": "app/api/admin/route.ts",
+      "ruleId": "nextjs-api-route-missing-auth",
+      "reason": "protected by middleware.ts, matcher /api/admin/*"
+    }
+  ]
+}
+```
+
+Both `file` (relative path) and `ruleId` must match exactly. Suppressed
+findings aren't silently dropped — they're printed separately (with your
+`reason`) so they stay visible for review, not just filtered out of the JSON
+output.
+
 ## GitHub Action
 
 Add to `.github/workflows/security-scan.yml` in your repo:

package/dist/checks/apiAuthMissing.js

@@ -1,6 +1,22 @@
 import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
+const MIDDLEWARE_CANDIDATES = [
+    "middleware.ts",
+    "middleware.js",
+    join("src", "middleware.ts"),
+    join("src", "middleware.js"),
+];
+// A route can be protected upstream by middleware.ts instead of an in-handler
+// check — this rule only ever sees the handler file, so it can't tell.
+// Rather than guess at matcher-pattern coverage (getting that wrong would
+// silently hide a genuinely unprotected route), we stay honest about the gap.
+const MIDDLEWARE_CAVEAT = ' Kalo route ini diproteksi lewat middleware.ts, ini bisa jadi false positive — cek matcher-nya, atau suppress via .secanix.json kalo emang udah aman.';
+async function hasMiddlewareFile(targetDir) {
+    const results = await Promise.all(MIDDLEWARE_CANDIDATES.map((candidate) => access(join(targetDir, candidate)).then(() => true, () => false)));
+    return results.some(Boolean);
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const RULE_PATH = join(__dirname, "..", "rules", "nextjs-api-auth-missing.yaml");
 export class SemgrepNotFoundError extends Error {
@@ -71,8 +87,11 @@ export async function findMissingApiAuth(targetDir) {
         "--quiet",
         targetDir,
     ]);
-    return parseSemgrepReport(stdout).map((finding) => ({
+    const findings = parseSemgrepReport(stdout).map((finding) => ({
         ...finding,
         file: relative(targetDir, resolve(targetDir, finding.file)).split(sep).join("/"),
     }));
+    if (findings.length === 0 || !(await hasMiddlewareFile(targetDir)))
+        return findings;
+    return findings.map((finding) => ({ ...finding, description: finding.description + MIDDLEWARE_CAVEAT }));
 }

package/dist/checks/exposedFirebaseAdminKey.js

@@ -0,0 +1,59 @@
+import { readFile } from "node:fs/promises";
+import { basename, extname, relative, sep } from "node:path";
+import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+// NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
+// a Firebase Admin SDK key under that prefix is a guaranteed leak.
+const PUBLIC_ADMIN_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:FIREBASE_PRIVATE_KEY|FIREBASE_ADMIN|SERVICE_ACCOUNT)[A-Z0-9_]*/i;
+// The literal downloaded Admin SDK key file always carries this exact field.
+// gitleaks' generic PEM detector expects real newlines, not the \n-escaped
+// key JSON.stringify produces, so a committed key file slips past secret-scan.
+const SERVICE_ACCOUNT_JSON_PATTERN = /"type"\s*:\s*"service_account"/;
+function isScannableFile(filePath) {
+    const name = basename(filePath);
+    if (name.startsWith(".env"))
+        return true;
+    const ext = extname(filePath);
+    return SOURCE_EXTENSIONS.has(ext) || ext === ".json";
+}
+export function scanTextForPublicFirebaseAdminKey(content) {
+    const matches = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        const match = PUBLIC_ADMIN_KEY_PATTERN.exec(line);
+        if (match)
+            matches.push({ line: index + 1, variableName: match[0] });
+    });
+    return matches;
+}
+export function scanTextForCommittedServiceAccountKey(content) {
+    const matches = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        if (SERVICE_ACCOUNT_JSON_PATTERN.test(line))
+            matches.push({ line: index + 1 });
+    });
+    return matches;
+}
+export async function findExposedFirebaseAdminKeys(targetDir) {
+    const files = await collectFiles(targetDir, isScannableFile);
+    const findings = [];
+    for (const file of files) {
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        for (const match of scanTextForPublicFirebaseAdminKey(content)) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-admin-key-public-env",
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Firebase Admin SDK key — Next.js bakal inline ini ke client bundle.`,
+            });
+        }
+        for (const match of scanTextForCommittedServiceAccountKey(content)) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-service-account-key-committed",
+                description: `File ini kelihatan kayak service account key JSON asli dari Firebase Admin SDK — private key literal ke-commit ke repo.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/firebaseRulesOpen.js

@@ -0,0 +1,46 @@
+import { readFile } from "node:fs/promises";
+import { basename, relative, sep } from "node:path";
+import { collectFiles } from "./fsWalk.js";
+const OPEN_SECURITY_RULE_PATTERN = /allow\s+[\w,\s]+:\s*if\s+true\s*;/gi;
+const OPEN_DATABASE_JSON_PATTERN = /"\.(?:read|write)"\s*:\s*(?:true|"true")/gi;
+function isFirebaseRulesFile(filePath) {
+    const name = basename(filePath);
+    return name === "firestore.rules" || name === "storage.rules" || name === "database.rules.json";
+}
+function findMatchesAcrossLines(content, globalPattern) {
+    const matches = [];
+    const pattern = new RegExp(globalPattern.source, globalPattern.flags);
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+        const line = content.slice(0, match.index).split(/\r?\n/).length;
+        matches.push({ line });
+    }
+    return matches;
+}
+export function findOpenRulesInSecurityRulesText(content) {
+    return findMatchesAcrossLines(content, OPEN_SECURITY_RULE_PATTERN);
+}
+export function findOpenRulesInDatabaseJson(content) {
+    return findMatchesAcrossLines(content, OPEN_DATABASE_JSON_PATTERN);
+}
+export async function findOpenFirebaseRules(targetDir) {
+    const files = await collectFiles(targetDir, isFirebaseRulesFile);
+    const findings = [];
+    for (const file of files) {
+        const name = basename(file);
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        const matches = name === "database.rules.json"
+            ? findOpenRulesInDatabaseJson(content)
+            : findOpenRulesInSecurityRulesText(content);
+        for (const match of matches) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-rules-open",
+                description: `Rule di "${name}" ngasih akses baca/tulis tanpa syarat (if true / .read atau .write: true) — data bisa diakses siapa aja tanpa auth.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/rlsDisabled.js

@@ -59,7 +59,7 @@ export async function findRlsDisabledTables(targetDir) {
                 file: table.file,
                 line: table.line,
                 ruleId: "supabase-rls-missing",
-                description: `Tabel "${table.name}" gak ketemu "ENABLE ROW LEVEL SECURITY" di migration manapun — kemungkinan RLS mati.`,
+                description: `Tabel "${table.name}" gak ketemu "ENABLE ROW LEVEL SECURITY" di migration manapun — kemungkinan RLS mati. Ini cuma liat file migration, bukan state Supabase Dashboard asli — kalo RLS-nya emang udah dinyalain lewat Dashboard, suppress lewat .secanix.json.`,
             });
         }
     }

package/dist/checks/secretScan.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { dirname, join } from "node:path";
-import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { copyFile, mkdir, mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -61,14 +61,49 @@ export function parseGitleaksReport(json) {
     }
     return findings;
 }
+// Returns tracked + untracked-but-not-ignored relative paths, or null when
+// targetDir isn't a git repo (no .gitignore semantics to respect there).
+function listGitRespectedFiles(targetDir) {
+    return new Promise((resolve) => {
+        const child = spawn("git", ["-C", targetDir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { stdio: ["ignore", "pipe", "ignore"] });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.on("error", () => resolve(null));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                resolve(null);
+                return;
+            }
+            resolve(stdout.split("\0").filter((f) => f.length > 0));
+        });
+    });
+}
+// Mirrors the given relative paths into mirrorRoot so gitleaks (run with
+// --no-git) only ever sees files .gitignore would let through.
+async function mirrorFiles(sourceDir, files, mirrorRoot) {
+    for (const rel of files) {
+        const dest = join(mirrorRoot, rel);
+        await mkdir(dirname(dest), { recursive: true });
+        await copyFile(join(sourceDir, rel), dest).catch(() => { });
+    }
+}
 export async function runSecretScan(targetDir) {
     const tempDir = await mkdtemp(join(tmpdir(), "vibe-secret-scan-"));
     const reportPath = join(tempDir, "gitleaks-report.json");
     try {
+        const respectedFiles = await listGitRespectedFiles(targetDir);
+        let scanDir = targetDir;
+        if (respectedFiles !== null) {
+            scanDir = join(tempDir, "mirror");
+            await mkdir(scanDir, { recursive: true });
+            await mirrorFiles(targetDir, respectedFiles, scanDir);
+        }
         await runGitleaksProcess([
             "detect",
             "--source",
-            targetDir,
+            scanDir,
             "--no-git",
             "--no-banner",
             "--config",
@@ -81,7 +116,18 @@ export async function runSecretScan(targetDir) {
             "0",
         ]);
         const content = await readFile(reportPath, "utf8").catch(() => "");
-        return parseGitleaksReport(content);
+        const findings = parseGitleaksReport(content);
+        if (respectedFiles === null)
+            return findings;
+        // Mirror dir is deleted below; rewrite paths to point at the real project.
+        const mirrorPrefix = scanDir.replace(/\\/g, "/");
+        return findings.map((finding) => {
+            const fileFwd = finding.file.replace(/\\/g, "/");
+            if (!fileFwd.startsWith(mirrorPrefix))
+                return finding;
+            const rel = fileFwd.slice(mirrorPrefix.length).replace(/^\/+/, "");
+            return { ...finding, file: join(targetDir, rel) };
+        });
     }
     finally {
         await rm(tempDir, { recursive: true, force: true });

package/dist/cli.js

@@ -1,13 +1,50 @@
 #!/usr/bin/env node
 import { readFileSync, realpathSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { findMissingApiAuth, SemgrepNotFoundError } from "./checks/apiAuthMissing.js";
 import { findCorsWildcard } from "./checks/corsWildcard.js";
 import { findDependencyVulnerabilities, OsvScannerNotFoundError } from "./checks/dependencyVulnerabilities.js";
+import { findExposedFirebaseAdminKeys } from "./checks/exposedFirebaseAdminKey.js";
 import { findExposedServiceRoleKeys } from "./checks/exposedServiceRoleKey.js";
+import { findOpenFirebaseRules } from "./checks/firebaseRulesOpen.js";
 import { findRlsDisabledTables } from "./checks/rlsDisabled.js";
 import { GitleaksNotFoundError, runSecretScan } from "./checks/secretScan.js";
-import { buildReport, formatReport } from "./report.js";
+import { applyIgnoreRules, buildReport, formatReport } from "./report.js";
+const IGNORE_FILE = ".secanix.json";
+// Missing file = no suppression (default, zero-friction). Malformed file
+// warns and falls back to no suppression rather than crashing the scan.
+export async function loadIgnoreRules(targetDir) {
+    let content;
+    try {
+        content = await readFile(join(targetDir, IGNORE_FILE), "utf8");
+    }
+    catch {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(content);
+        const ignore = parsed.ignore;
+        if (!Array.isArray(ignore))
+            return [];
+        const rules = [];
+        for (const entry of ignore) {
+            if (typeof entry === "object" &&
+                entry !== null &&
+                typeof entry.file === "string" &&
+                typeof entry.ruleId === "string") {
+                const { file, ruleId, reason } = entry;
+                rules.push({ file, ruleId, reason: typeof reason === "string" ? reason : undefined });
+            }
+        }
+        return rules;
+    }
+    catch (err) {
+        console.error(`${IGNORE_FILE} invalid, diabaikan: ${err.message}`);
+        return [];
+    }
+}
 const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 export async function run(targetDir = process.cwd(), options = {}) {
     const { json = false } = options;
@@ -41,6 +78,11 @@ export async function run(targetDir = process.cwd(), options = {}) {
     }
     checkFindings.push({ checkId: "rls-disabled", findings: await findRlsDisabledTables(targetDir) });
     checkFindings.push({ checkId: "cors-wildcard", findings: await findCorsWildcard(targetDir) });
+    checkFindings.push({ checkId: "firebase-rules-open", findings: await findOpenFirebaseRules(targetDir) });
+    checkFindings.push({
+        checkId: "firebase-admin-key-exposed",
+        findings: await findExposedFirebaseAdminKeys(targetDir),
+    });
     try {
         checkFindings.push({
             checkId: "dependency-cve",
@@ -54,7 +96,15 @@ export async function run(targetDir = process.cwd(), options = {}) {
         }
         throw err;
     }
-    const reported = buildReport(checkFindings);
+    const ignoreRules = await loadIgnoreRules(targetDir);
+    const { findings: reported, suppressed } = applyIgnoreRules(buildReport(checkFindings), ignoreRules);
+    if (suppressed.length > 0) {
+        console.error(`${suppressed.length} temuan diabaikan via ${IGNORE_FILE}:`);
+        for (const finding of suppressed) {
+            const reasonSuffix = finding.reason ? ` (${finding.reason})` : "";
+            console.error(`  ${finding.file}:${finding.line} — ${finding.ruleId}${reasonSuffix}`);
+        }
+    }
     if (json) {
         console.log(JSON.stringify(reported));
     }

package/dist/report.js

@@ -20,6 +20,18 @@ const RULE_INFO = {
         severity: "medium",
         fix: "Ganti '*' jadi daftar origin eksplisit yang emang butuh akses, atau validasi origin secara dinamis di server.",
     },
+    "firebase-rules-open": {
+        severity: "critical",
+        fix: "Ganti 'if true' / '.read'/'.write': true dengan rule yang validasi auth (request.auth != null, dst) — rule default Firebase itu deny-all, jangan di-override jadi allow-all.",
+    },
+    "firebase-admin-key-public-env": {
+        severity: "critical",
+        fix: "Jangan expose Firebase Admin key lewat NEXT_PUBLIC_* — pindahin ke env var server-only, lalu rotate key ini di Firebase Console (Project Settings > Service Accounts) kalau udah sempet ke-deploy.",
+    },
+    "firebase-service-account-key-committed": {
+        severity: "critical",
+        fix: "Hapus file JSON key ini dari repo & git history, rotate key di Firebase Console, generate key baru & simpan di secret manager / env var server-only.",
+    },
 };
 // gitleaks (secret-scan) and osv-scanner (dependency-cve) each emit a
 // ruleId that varies per finding (rule name / GHSA id), so they're
@@ -60,6 +72,22 @@ export function classify(finding, checkId) {
     }
     return { ...finding, severity: "medium", fixSuggestion: DEFAULT_FIX };
 }
+// file+ruleId must both match — narrow on purpose so an ignore entry never
+// silently swallows an unrelated finding that happens to share one field.
+export function applyIgnoreRules(reported, ignoreRules) {
+    const findings = [];
+    const suppressed = [];
+    for (const finding of reported) {
+        const rule = ignoreRules.find((r) => r.file === finding.file && r.ruleId === finding.ruleId);
+        if (rule) {
+            suppressed.push({ ...finding, reason: rule.reason });
+        }
+        else {
+            findings.push(finding);
+        }
+    }
+    return { findings, suppressed };
+}
 const SEVERITY_ORDER = ["critical", "high", "medium", "low"];
 const SEVERITY_RANK = new Map(SEVERITY_ORDER.map((severity, index) => [severity, index]));
 export function buildReport(checkFindings) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secanix",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": false,
   "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
   "license": "MIT",