secanix 0.1.4 → 0.1.6

package/README.md

@@ -2,13 +2,24 @@
 
 Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
 
-Checks it runs:
-- Leaked secrets (API keys, tokens, credentials committed to the repo)
-- Exposed Supabase service role keys
-- Missing auth on Next.js API routes
-- Disabled Supabase Row Level Security (RLS)
-- CORS wildcard origins
-- Vulnerable dependencies (known CVEs)
+## Checks
+
+| Check | ruleId | Severity | Triggers on | Fix |
+|---|---|---|---|---|
+| Leaked secrets (gitleaks) | varies per gitleaks rule | Critical | Hardcoded API key/token/credential in a git-tracked or about-to-be-tracked file | Rotate the secret now, strip it from code & git history (not just a new commit), move it to an env var / secret manager |
+| Exposed Supabase service role key | `supabase-service-role-key-public-env` | Critical | `NEXT_PUBLIC_*` env var holding a Supabase service role key — gets inlined into the client bundle at build time | Move it to a server-only env var, rotate the key in the Supabase dashboard if it's ever been deployed |
+| Missing auth on Next.js API route | `nextjs-api-route-missing-auth` | High | A Pages/App Router API handler with no session/token check before it runs any logic | Add an auth check (`getServerSession`/`getToken`/etc.) at the top of the handler |
+| Supabase RLS disabled | `supabase-rls-disabled` | Critical | A table where RLS was explicitly turned off | Re-enable RLS (`ALTER TABLE ... ENABLE ROW LEVEL SECURITY`) and add matching policies |
+| Supabase RLS missing | `supabase-rls-missing` | High | A table created with no RLS enable statement at all | Add `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` plus a policy for the table |
+| CORS wildcard origin | `cors-wildcard-origin` | Medium | `Access-Control-Allow-Origin: *` (or equivalent) on an API response | Replace `*` with an explicit origin allowlist, or validate the origin dynamically server-side |
+| Open Firebase security rules | `firebase-rules-open` | Critical | Firestore/Realtime Database/Storage rules using `if true` / `.read`/`.write: true` | Replace the allow-all rule with one that checks `request.auth != null` etc. — Firebase's default is deny-all, don't override it to allow-all |
+| Exposed Firebase Admin key (env) | `firebase-admin-key-public-env` | Critical | `NEXT_PUBLIC_*` env var holding a Firebase Admin SDK key — gets inlined into the client bundle at build time | Move it to a server-only env var, rotate the key in Firebase Console if it's ever been deployed |
+| Committed Firebase service account key | `firebase-service-account-key-committed` | Critical | A literal Admin SDK service-account JSON key file checked into the repo | Delete the file from the repo & git history, rotate the key in Firebase Console, store the new one in a secret manager / env var |
+| Vulnerable dependency (osv-scanner) | varies (GHSA id) | Derived from CVSS score (≥9 critical, ≥7 high, ≥4 medium, else low) | A dependency with a known CVE | Update to the patched version named in the advisory |
+
+Two checks (leaked secrets, vulnerable dependencies) delegate to gitleaks/osv-scanner, so
+their `ruleId` varies per finding instead of being fixed — everything else in this table is
+custom, Next.js/Supabase/Firebase-specific pattern matching.
 
 ## CLI Usage
 

package/dist/checks/exposedFirebaseAdminKey.js

@@ -0,0 +1,61 @@
+import { readFile } from "node:fs/promises";
+import { basename, extname, relative, sep } from "node:path";
+import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+import { envFileTrackingContext, listTrackedFiles } from "./gitUtils.js";
+// NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
+// a Firebase Admin SDK key under that prefix is a guaranteed leak.
+const PUBLIC_ADMIN_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:FIREBASE_PRIVATE_KEY|FIREBASE_ADMIN|SERVICE_ACCOUNT)[A-Z0-9_]*/i;
+// The literal downloaded Admin SDK key file always carries this exact field.
+// gitleaks' generic PEM detector expects real newlines, not the \n-escaped
+// key JSON.stringify produces, so a committed key file slips past secret-scan.
+const SERVICE_ACCOUNT_JSON_PATTERN = /"type"\s*:\s*"service_account"/;
+function isScannableFile(filePath) {
+    const name = basename(filePath);
+    if (name.startsWith(".env"))
+        return true;
+    const ext = extname(filePath);
+    return SOURCE_EXTENSIONS.has(ext) || ext === ".json";
+}
+export function scanTextForPublicFirebaseAdminKey(content) {
+    const matches = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        const match = PUBLIC_ADMIN_KEY_PATTERN.exec(line);
+        if (match)
+            matches.push({ line: index + 1, variableName: match[0] });
+    });
+    return matches;
+}
+export function scanTextForCommittedServiceAccountKey(content) {
+    const matches = [];
+    content.split(/\r?\n/).forEach((line, index) => {
+        if (SERVICE_ACCOUNT_JSON_PATTERN.test(line))
+            matches.push({ line: index + 1 });
+    });
+    return matches;
+}
+export async function findExposedFirebaseAdminKeys(targetDir) {
+    const files = await collectFiles(targetDir, isScannableFile);
+    const tracked = await listTrackedFiles(targetDir);
+    const findings = [];
+    for (const file of files) {
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        for (const match of scanTextForPublicFirebaseAdminKey(content)) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-admin-key-public-env",
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Firebase Admin SDK key — Next.js bakal inline ini ke client bundle.${envFileTrackingContext(relFile, tracked)}`,
+            });
+        }
+        for (const match of scanTextForCommittedServiceAccountKey(content)) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-service-account-key-committed",
+                description: `File ini kelihatan kayak service account key JSON asli dari Firebase Admin SDK — private key literal ke-commit ke repo.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/exposedServiceRoleKey.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { basename, extname, relative, sep } from "node:path";
 import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+import { envFileTrackingContext, listTrackedFiles } from "./gitUtils.js";
 // NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
 // a Supabase service role key under that prefix is a guaranteed leak.
 const EXPOSED_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:SERVICE_ROLE|SERVICE_KEY)[A-Z0-9_]*/i;
@@ -23,15 +24,17 @@ function isScannableFile(filePath) {
 }
 export async function findExposedServiceRoleKeys(targetDir) {
     const files = await collectFiles(targetDir, isScannableFile);
+    const tracked = await listTrackedFiles(targetDir);
     const findings = [];
     for (const file of files) {
         const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
         for (const match of scanTextForExposedServiceRoleKey(content)) {
             findings.push({
-                file: relative(targetDir, file).split(sep).join("/"),
+                file: relFile,
                 line: match.line,
                 ruleId: "supabase-service-role-key-public-env",
-                description: `Env var publik "${match.variableName}" kelihatan nyimpen Supabase service role key — Next.js bakal inline ini ke client bundle.`,
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Supabase service role key — Next.js bakal inline ini ke client bundle.${envFileTrackingContext(relFile, tracked)}`,
             });
         }
     }

package/dist/checks/firebaseRulesOpen.js

@@ -0,0 +1,46 @@
+import { readFile } from "node:fs/promises";
+import { basename, relative, sep } from "node:path";
+import { collectFiles } from "./fsWalk.js";
+const OPEN_SECURITY_RULE_PATTERN = /allow\s+[\w,\s]+:\s*if\s+true\s*;/gi;
+const OPEN_DATABASE_JSON_PATTERN = /"\.(?:read|write)"\s*:\s*(?:true|"true")/gi;
+function isFirebaseRulesFile(filePath) {
+    const name = basename(filePath);
+    return name === "firestore.rules" || name === "storage.rules" || name === "database.rules.json";
+}
+function findMatchesAcrossLines(content, globalPattern) {
+    const matches = [];
+    const pattern = new RegExp(globalPattern.source, globalPattern.flags);
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+        const line = content.slice(0, match.index).split(/\r?\n/).length;
+        matches.push({ line });
+    }
+    return matches;
+}
+export function findOpenRulesInSecurityRulesText(content) {
+    return findMatchesAcrossLines(content, OPEN_SECURITY_RULE_PATTERN);
+}
+export function findOpenRulesInDatabaseJson(content) {
+    return findMatchesAcrossLines(content, OPEN_DATABASE_JSON_PATTERN);
+}
+export async function findOpenFirebaseRules(targetDir) {
+    const files = await collectFiles(targetDir, isFirebaseRulesFile);
+    const findings = [];
+    for (const file of files) {
+        const name = basename(file);
+        const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
+        const matches = name === "database.rules.json"
+            ? findOpenRulesInDatabaseJson(content)
+            : findOpenRulesInSecurityRulesText(content);
+        for (const match of matches) {
+            findings.push({
+                file: relFile,
+                line: match.line,
+                ruleId: "firebase-rules-open",
+                description: `Rule di "${name}" ngasih akses baca/tulis tanpa syarat (if true / .read atau .write: true) — data bisa diakses siapa aja tanpa auth.`,
+            });
+        }
+    }
+    return findings;
+}

package/dist/checks/gitUtils.js

@@ -0,0 +1,37 @@
+import { spawn } from "node:child_process";
+import { basename } from "node:path";
+// Returns the set of forward-slash relative paths staged/committed in
+// targetDir's git index, or null when targetDir isn't a git repo (no
+// tracking info to report).
+export function listTrackedFiles(targetDir) {
+    return new Promise((resolve) => {
+        const child = spawn("git", ["-C", targetDir, "ls-files", "-z", "--cached"], {
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.on("error", () => resolve(null));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                resolve(null);
+                return;
+            }
+            resolve(new Set(stdout.split("\0").filter((f) => f.length > 0)));
+        });
+    });
+}
+const TRACKED_CONTEXT = " File ini ke-track di git — kemungkinan udah ke-commit ke repo.";
+const UNTRACKED_CONTEXT = " File ini gitignored atau belum ke-commit — tapi kalau var ini pernah dipasang di production (Vercel dst) dengan prefix NEXT_PUBLIC_, tetap ke-inline ke client bundle.";
+// Two checks (exposedServiceRoleKey, exposedFirebaseAdminKey) scan raw
+// filesystem .env files without git-awareness, so a gitignored/local-only
+// var reads the same as a committed one. Appending this note keeps their
+// CRITICAL severity honest about which case it actually is.
+export function envFileTrackingContext(relFile, tracked) {
+    if (!basename(relFile).startsWith(".env"))
+        return "";
+    if (tracked === null)
+        return "";
+    return tracked.has(relFile) ? TRACKED_CONTEXT : UNTRACKED_CONTEXT;
+}

package/dist/cli.js

@@ -6,9 +6,12 @@ import { pathToFileURL } from "node:url";
 import { findMissingApiAuth, SemgrepNotFoundError } from "./checks/apiAuthMissing.js";
 import { findCorsWildcard } from "./checks/corsWildcard.js";
 import { findDependencyVulnerabilities, OsvScannerNotFoundError } from "./checks/dependencyVulnerabilities.js";
+import { findExposedFirebaseAdminKeys } from "./checks/exposedFirebaseAdminKey.js";
 import { findExposedServiceRoleKeys } from "./checks/exposedServiceRoleKey.js";
+import { findOpenFirebaseRules } from "./checks/firebaseRulesOpen.js";
 import { findRlsDisabledTables } from "./checks/rlsDisabled.js";
 import { GitleaksNotFoundError, runSecretScan } from "./checks/secretScan.js";
+import { checkLicense } from "./licenseCheck.js";
 import { applyIgnoreRules, buildReport, formatReport } from "./report.js";
 const IGNORE_FILE = ".secanix.json";
 // Missing file = no suppression (default, zero-friction). Malformed file
@@ -76,6 +79,11 @@ export async function run(targetDir = process.cwd(), options = {}) {
     }
     checkFindings.push({ checkId: "rls-disabled", findings: await findRlsDisabledTables(targetDir) });
     checkFindings.push({ checkId: "cors-wildcard", findings: await findCorsWildcard(targetDir) });
+    checkFindings.push({ checkId: "firebase-rules-open", findings: await findOpenFirebaseRules(targetDir) });
+    checkFindings.push({
+        checkId: "firebase-admin-key-exposed",
+        findings: await findExposedFirebaseAdminKeys(targetDir),
+    });
     try {
         checkFindings.push({
             checkId: "dependency-cve",
@@ -108,10 +116,28 @@ export async function run(targetDir = process.cwd(), options = {}) {
     }
     return 0;
 }
+export async function runLicenseCheck(key) {
+    const result = await checkLicense(key);
+    if (result.status === "valid") {
+        console.log("secanix Pro license valid.");
+        return 0;
+    }
+    if (result.status === "invalid") {
+        console.error(`secanix Pro license invalid: ${result.message}`);
+        return 1;
+    }
+    console.error(`secanix Pro license check inconclusive: ${result.message}`);
+    return 2;
+}
 const isMain = process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
 if (isMain) {
     const args = process.argv.slice(2);
-    const json = args.includes("--json");
-    const targetDir = args.find((arg) => arg !== "--json" && !arg.startsWith("-"));
-    process.exit(await run(targetDir, { json }));
+    if (args[0] === "license-check") {
+        process.exitCode = await runLicenseCheck(process.env.SECANIX_LICENSE_KEY);
+    }
+    else {
+        const json = args.includes("--json");
+        const targetDir = args.find((arg) => arg !== "--json" && !arg.startsWith("-"));
+        process.exitCode = await run(targetDir, { json });
+    }
 }

package/dist/licenseCheck.js

@@ -0,0 +1,37 @@
+const VALIDATE_URL = "https://api.lemonsqueezy.com/v1/licenses/validate";
+const REQUEST_TIMEOUT_MS = 10_000;
+export async function checkLicense(key) {
+    if (!key) {
+        return { status: "invalid", message: "SECANIX_LICENSE_KEY is missing or empty." };
+    }
+    let response;
+    try {
+        response = await fetch(VALIDATE_URL, {
+            method: "POST",
+            headers: { Accept: "application/json" },
+            body: new URLSearchParams({ license_key: key }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        return { status: "error", message: `Could not reach LemonSqueezy: ${err.message}` };
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { status: "error", message: "LemonSqueezy returned a non-JSON response." };
+    }
+    if (typeof body !== "object" || body === null || !("valid" in body)) {
+        return { status: "error", message: "Unexpected response shape from LemonSqueezy." };
+    }
+    const { valid, error } = body;
+    if (valid === true) {
+        return { status: "valid" };
+    }
+    return {
+        status: "invalid",
+        message: typeof error === "string" ? error : "License key is invalid or expired.",
+    };
+}

package/dist/report.js

@@ -20,6 +20,18 @@ const RULE_INFO = {
         severity: "medium",
         fix: "Ganti '*' jadi daftar origin eksplisit yang emang butuh akses, atau validasi origin secara dinamis di server.",
     },
+    "firebase-rules-open": {
+        severity: "critical",
+        fix: "Ganti 'if true' / '.read'/'.write': true dengan rule yang validasi auth (request.auth != null, dst) — rule default Firebase itu deny-all, jangan di-override jadi allow-all.",
+    },
+    "firebase-admin-key-public-env": {
+        severity: "critical",
+        fix: "Jangan expose Firebase Admin key lewat NEXT_PUBLIC_* — pindahin ke env var server-only, lalu rotate key ini di Firebase Console (Project Settings > Service Accounts) kalau udah sempet ke-deploy.",
+    },
+    "firebase-service-account-key-committed": {
+        severity: "critical",
+        fix: "Hapus file JSON key ini dari repo & git history, rotate key di Firebase Console, generate key baru & simpan di secret manager / env var server-only.",
+    },
 };
 // gitleaks (secret-scan) and osv-scanner (dependency-cve) each emit a
 // ruleId that varies per finding (rule name / GHSA id), so they're

package/dist/rules/gitleaks-config.toml

@@ -1,13 +1,13 @@
-[extend]
-useDefault = true
-
-[allowlist]
-paths = [
-  '''(^|/)node_modules(/|$)''',
-  '''(^|/)\.git(/|$)''',
-  '''(^|/)\.next(/|$)''',
-  '''(^|/)dist(/|$)''',
-  '''(^|/)build(/|$)''',
-  '''(^|/)out(/|$)''',
-  '''(^|/)coverage(/|$)''',
-]
+[extend]
+useDefault = true
+
+[allowlist]
+paths = [
+  '''(^|/)node_modules(/|$)''',
+  '''(^|/)\.git(/|$)''',
+  '''(^|/)\.next(/|$)''',
+  '''(^|/)dist(/|$)''',
+  '''(^|/)build(/|$)''',
+  '''(^|/)out(/|$)''',
+  '''(^|/)coverage(/|$)''',
+]

package/dist/rules/nextjs-api-auth-missing.yaml

@@ -1,24 +1,24 @@
-rules:
-  - id: nextjs-api-route-missing-auth
-    languages: [typescript, javascript]
-    severity: WARNING
-    message: >-
-      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
-    paths:
-      include:
-        - "pages/api/**"
-        - "src/pages/api/**"
-        - "app/**/route.ts"
-        - "app/**/route.js"
-        - "src/app/**/route.ts"
-        - "src/app/**/route.js"
-    patterns:
-      - pattern-either:
-          - pattern: export default function $HANDLER(...) { ... }
-          - pattern: export default async function $HANDLER(...) { ... }
-          - pattern: export async function GET(...) { ... }
-          - pattern: export async function POST(...) { ... }
-          - pattern: export async function PUT(...) { ... }
-          - pattern: export async function PATCH(...) { ... }
-          - pattern: export async function DELETE(...) { ... }
-      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)
+rules:
+  - id: nextjs-api-route-missing-auth
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
+    paths:
+      include:
+        - "pages/api/**"
+        - "src/pages/api/**"
+        - "app/**/route.ts"
+        - "app/**/route.js"
+        - "src/app/**/route.ts"
+        - "src/app/**/route.js"
+    patterns:
+      - pattern-either:
+          - pattern: export default function $HANDLER(...) { ... }
+          - pattern: export default async function $HANDLER(...) { ... }
+          - pattern: export async function GET(...) { ... }
+          - pattern: export async function POST(...) { ... }
+          - pattern: export async function PUT(...) { ... }
+          - pattern: export async function PATCH(...) { ... }
+          - pattern: export async function DELETE(...) { ... }
+      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secanix",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "private": false,
   "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
   "license": "MIT",