secanix 0.1.4 → 0.1.5

package/README.md

@@ -9,6 +9,8 @@ Checks it runs:
 - Disabled Supabase Row Level Security (RLS)
 - CORS wildcard origins
 - Vulnerable dependencies (known CVEs)
+- Open Firebase security rules (Firestore/Realtime Database/Storage)
+- Exposed Firebase Admin SDK keys (env leak or a committed service account JSON file)
 
 ## CLI Usage
 

package/dist/checks/exposedFirebaseAdminKey.js

@@ -0,0 +1,59 @@
+import { readFile } from "node:fs/promises";
+import { basename, extname, relative, sep } from "node:path";
+import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+// NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
+// a Firebase Admin SDK key under that prefix is a guaranteed leak.
+const PUBLIC_ADMIN_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:FIREBASE_PRIVATE_KEY|FIREBASE_ADMIN|SERVICE_ACCOUNT)[A-Z0-9_]*/i;
+// The literal downloaded Admin SDK key file always carries this exact field.
+// gitleaks' generic PEM detector expects real newlines, not the \n-escaped
+// key JSON.stringify produces, so a committed key file slips past secret-scan.
+const SERVICE_ACCOUNT_JSON_PATTERN = /"type"\s*:\s*"service_account"/;
+function isScannableFile(filePath) {
+    const name = basename(filePath);
+    if (name.startsWith(".env"))
+        return true;
+    const ext = extname(filePath);
+    return SOURCE_EXTENSIONS.has(ext) || ext === ".json";
+}
+export function scanTextForPublicFirebaseAdminKey(content) {
+    const matches = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        const match = PUBLIC_ADMIN_KEY_PATTERN.exec(line);
+        if (match)
+            matches.push({ line: index + 1, variableName: match[0] });
+    });
+    return matches;
+}
+export function scanTextForCommittedServiceAccountKey(content) {
+    const matches = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        if (SERVICE_ACCOUNT_JSON_PATTERN.test(line))
+            matches.push({ line: index + 1 });
+    });
+    return matches;
+}
+export async function findExposedFirebaseAdminKeys(targetDir) {
+    const files = await collectFiles(targetDir, isScannableFile);
+    const findings = [];
+    for (const file of files) {
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        for (const match of scanTextForPublicFirebaseAdminKey(content)) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-admin-key-public-env",
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Firebase Admin SDK key — Next.js bakal inline ini ke client bundle.`,
+            });
+        }
+        for (const match of scanTextForCommittedServiceAccountKey(content)) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-service-account-key-committed",
+                description: `File ini kelihatan kayak service account key JSON asli dari Firebase Admin SDK — private key literal ke-commit ke repo.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/firebaseRulesOpen.js

@@ -0,0 +1,46 @@
+import { readFile } from "node:fs/promises";
+import { basename, relative, sep } from "node:path";
+import { collectFiles } from "./fsWalk.js";
+const OPEN_SECURITY_RULE_PATTERN = /allow\s+[\w,\s]+:\s*if\s+true\s*;/gi;
+const OPEN_DATABASE_JSON_PATTERN = /"\.(?:read|write)"\s*:\s*(?:true|"true")/gi;
+function isFirebaseRulesFile(filePath) {
+    const name = basename(filePath);
+    return name === "firestore.rules" || name === "storage.rules" || name === "database.rules.json";
+}
+function findMatchesAcrossLines(content, globalPattern) {
+    const matches = [];
+    const pattern = new RegExp(globalPattern.source, globalPattern.flags);
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+        const line = content.slice(0, match.index).split(/\r?\n/).length;
+        matches.push({ line });
+    }
+    return matches;
+}
+export function findOpenRulesInSecurityRulesText(content) {
+    return findMatchesAcrossLines(content, OPEN_SECURITY_RULE_PATTERN);
+}
+export function findOpenRulesInDatabaseJson(content) {
+    return findMatchesAcrossLines(content, OPEN_DATABASE_JSON_PATTERN);
+}
+export async function findOpenFirebaseRules(targetDir) {
+    const files = await collectFiles(targetDir, isFirebaseRulesFile);
+    const findings = [];
+    for (const file of files) {
+        const name = basename(file);
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        const matches = name === "database.rules.json"
+            ? findOpenRulesInDatabaseJson(content)
+            : findOpenRulesInSecurityRulesText(content);
+        for (const match of matches) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-rules-open",
+                description: `Rule di "${name}" ngasih akses baca/tulis tanpa syarat (if true / .read atau .write: true) — data bisa diakses siapa aja tanpa auth.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/cli.js

@@ -6,7 +6,9 @@ import { pathToFileURL } from "node:url";
 import { findMissingApiAuth, SemgrepNotFoundError } from "./checks/apiAuthMissing.js";
 import { findCorsWildcard } from "./checks/corsWildcard.js";
 import { findDependencyVulnerabilities, OsvScannerNotFoundError } from "./checks/dependencyVulnerabilities.js";
+import { findExposedFirebaseAdminKeys } from "./checks/exposedFirebaseAdminKey.js";
 import { findExposedServiceRoleKeys } from "./checks/exposedServiceRoleKey.js";
+import { findOpenFirebaseRules } from "./checks/firebaseRulesOpen.js";
 import { findRlsDisabledTables } from "./checks/rlsDisabled.js";
 import { GitleaksNotFoundError, runSecretScan } from "./checks/secretScan.js";
 import { applyIgnoreRules, buildReport, formatReport } from "./report.js";
@@ -76,6 +78,11 @@ export async function run(targetDir = process.cwd(), options = {}) {
     }
     checkFindings.push({ checkId: "rls-disabled", findings: await findRlsDisabledTables(targetDir) });
     checkFindings.push({ checkId: "cors-wildcard", findings: await findCorsWildcard(targetDir) });
+    checkFindings.push({ checkId: "firebase-rules-open", findings: await findOpenFirebaseRules(targetDir) });
+    checkFindings.push({
+        checkId: "firebase-admin-key-exposed",
+        findings: await findExposedFirebaseAdminKeys(targetDir),
+    });
     try {
         checkFindings.push({
             checkId: "dependency-cve",

package/dist/report.js

@@ -20,6 +20,18 @@ const RULE_INFO = {
         severity: "medium",
         fix: "Ganti '*' jadi daftar origin eksplisit yang emang butuh akses, atau validasi origin secara dinamis di server.",
     },
+    "firebase-rules-open": {
+        severity: "critical",
+        fix: "Ganti 'if true' / '.read'/'.write': true dengan rule yang validasi auth (request.auth != null, dst) — rule default Firebase itu deny-all, jangan di-override jadi allow-all.",
+    },
+    "firebase-admin-key-public-env": {
+        severity: "critical",
+        fix: "Jangan expose Firebase Admin key lewat NEXT_PUBLIC_* — pindahin ke env var server-only, lalu rotate key ini di Firebase Console (Project Settings > Service Accounts) kalau udah sempet ke-deploy.",
+    },
+    "firebase-service-account-key-committed": {
+        severity: "critical",
+        fix: "Hapus file JSON key ini dari repo & git history, rotate key di Firebase Console, generate key baru & simpan di secret manager / env var server-only.",
+    },
 };
 // gitleaks (secret-scan) and osv-scanner (dependency-cve) each emit a
 // ruleId that varies per finding (rule name / GHSA id), so they're

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secanix",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": false,
   "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
   "license": "MIT",