secanix 0.1.5 → 0.1.6

package/README.md

@@ -2,15 +2,24 @@
 
 Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).
 
-Checks it runs:
-- Leaked secrets (API keys, tokens, credentials committed to the repo)
-- Exposed Supabase service role keys
-- Missing auth on Next.js API routes
-- Disabled Supabase Row Level Security (RLS)
-- CORS wildcard origins
-- Vulnerable dependencies (known CVEs)
-- Open Firebase security rules (Firestore/Realtime Database/Storage)
-- Exposed Firebase Admin SDK keys (env leak or a committed service account JSON file)
+## Checks
+
+| Check | ruleId | Severity | Triggers on | Fix |
+|---|---|---|---|---|
+| Leaked secrets (gitleaks) | varies per gitleaks rule | Critical | Hardcoded API key/token/credential in a git-tracked or about-to-be-tracked file | Rotate the secret now, strip it from code & git history (not just a new commit), move it to an env var / secret manager |
+| Exposed Supabase service role key | `supabase-service-role-key-public-env` | Critical | `NEXT_PUBLIC_*` env var holding a Supabase service role key — gets inlined into the client bundle at build time | Move it to a server-only env var, rotate the key in the Supabase dashboard if it's ever been deployed |
+| Missing auth on Next.js API route | `nextjs-api-route-missing-auth` | High | A Pages/App Router API handler with no session/token check before it runs any logic | Add an auth check (`getServerSession`/`getToken`/etc.) at the top of the handler |
+| Supabase RLS disabled | `supabase-rls-disabled` | Critical | A table where RLS was explicitly turned off | Re-enable RLS (`ALTER TABLE ... ENABLE ROW LEVEL SECURITY`) and add matching policies |
+| Supabase RLS missing | `supabase-rls-missing` | High | A table created with no RLS enable statement at all | Add `ALTER TABLE ... ENABLE ROW LEVEL SECURITY` plus a policy for the table |
+| CORS wildcard origin | `cors-wildcard-origin` | Medium | `Access-Control-Allow-Origin: *` (or equivalent) on an API response | Replace `*` with an explicit origin allowlist, or validate the origin dynamically server-side |
+| Open Firebase security rules | `firebase-rules-open` | Critical | Firestore/Realtime Database/Storage rules using `if true` / `.read`/`.write: true` | Replace the allow-all rule with one that checks `request.auth != null` etc. — Firebase's default is deny-all, don't override it to allow-all |
+| Exposed Firebase Admin key (env) | `firebase-admin-key-public-env` | Critical | `NEXT_PUBLIC_*` env var holding a Firebase Admin SDK key — gets inlined into the client bundle at build time | Move it to a server-only env var, rotate the key in Firebase Console if it's ever been deployed |
+| Committed Firebase service account key | `firebase-service-account-key-committed` | Critical | A literal Admin SDK service-account JSON key file checked into the repo | Delete the file from the repo & git history, rotate the key in Firebase Console, store the new one in a secret manager / env var |
+| Vulnerable dependency (osv-scanner) | varies (GHSA id) | Derived from CVSS score (≥9 critical, ≥7 high, ≥4 medium, else low) | A dependency with a known CVE | Update to the patched version named in the advisory |
+
+Two checks (leaked secrets, vulnerable dependencies) delegate to gitleaks/osv-scanner, so
+their `ruleId` varies per finding instead of being fixed — everything else in this table is
+custom, Next.js/Supabase/Firebase-specific pattern matching.
 
 ## CLI Usage
 

package/dist/checks/exposedFirebaseAdminKey.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { basename, extname, relative, sep } from "node:path";
 import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+import { envFileTrackingContext, listTrackedFiles } from "./gitUtils.js";
 // NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
 // a Firebase Admin SDK key under that prefix is a guaranteed leak.
 const PUBLIC_ADMIN_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:FIREBASE_PRIVATE_KEY|FIREBASE_ADMIN|SERVICE_ACCOUNT)[A-Z0-9_]*/i;
@@ -34,6 +35,7 @@ export function scanTextForCommittedServiceAccountKey(content) {
 }
 export async function findExposedFirebaseAdminKeys(targetDir) {
     const files = await collectFiles(targetDir, isScannableFile);
+    const tracked = await listTrackedFiles(targetDir);
     const findings = [];
     for (const file of files) {
         const content = await readFile(file, "utf8");
@@ -43,7 +45,7 @@ export async function findExposedFirebaseAdminKeys(targetDir) {
                 file: relFile,
                 line: match.line,
                 ruleId: "firebase-admin-key-public-env",
-                description: `Env var publik "${match.variableName}" kelihatan nyimpen Firebase Admin SDK key — Next.js bakal inline ini ke client bundle.`,
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Firebase Admin SDK key — Next.js bakal inline ini ke client bundle.${envFileTrackingContext(relFile, tracked)}`,
             });
         }
         for (const match of scanTextForCommittedServiceAccountKey(content)) {

package/dist/checks/exposedServiceRoleKey.js

@@ -1,6 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { basename, extname, relative, sep } from "node:path";
 import { collectFiles, SOURCE_EXTENSIONS } from "./fsWalk.js";
+import { envFileTrackingContext, listTrackedFiles } from "./gitUtils.js";
 // NEXT_PUBLIC_* env vars get inlined into the client bundle at build time —
 // a Supabase service role key under that prefix is a guaranteed leak.
 const EXPOSED_KEY_PATTERN = /NEXT_PUBLIC_[A-Z0-9_]*(?:SERVICE_ROLE|SERVICE_KEY)[A-Z0-9_]*/i;
@@ -23,15 +24,17 @@ function isScannableFile(filePath) {
 }
 export async function findExposedServiceRoleKeys(targetDir) {
     const files = await collectFiles(targetDir, isScannableFile);
+    const tracked = await listTrackedFiles(targetDir);
     const findings = [];
     for (const file of files) {
         const content = await readFile(file, "utf8");
+        const relFile = relative(targetDir, file).split(sep).join("/");
         for (const match of scanTextForExposedServiceRoleKey(content)) {
             findings.push({
-                file: relative(targetDir, file).split(sep).join("/"),
+                file: relFile,
                 line: match.line,
                 ruleId: "supabase-service-role-key-public-env",
-                description: `Env var publik "${match.variableName}" kelihatan nyimpen Supabase service role key — Next.js bakal inline ini ke client bundle.`,
+                description: `Env var publik "${match.variableName}" kelihatan nyimpen Supabase service role key — Next.js bakal inline ini ke client bundle.${envFileTrackingContext(relFile, tracked)}`,
             });
         }
     }

package/dist/checks/gitUtils.js

@@ -0,0 +1,37 @@
+import { spawn } from "node:child_process";
+import { basename } from "node:path";
+// Returns the set of forward-slash relative paths staged/committed in
+// targetDir's git index, or null when targetDir isn't a git repo (no
+// tracking info to report).
+export function listTrackedFiles(targetDir) {
+    return new Promise((resolve) => {
+        const child = spawn("git", ["-C", targetDir, "ls-files", "-z", "--cached"], {
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        let stdout = "";
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.on("error", () => resolve(null));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                resolve(null);
+                return;
+            }
+            resolve(new Set(stdout.split("\0").filter((f) => f.length > 0)));
+        });
+    });
+}
+const TRACKED_CONTEXT = " File ini ke-track di git — kemungkinan udah ke-commit ke repo.";
+const UNTRACKED_CONTEXT = " File ini gitignored atau belum ke-commit — tapi kalau var ini pernah dipasang di production (Vercel dst) dengan prefix NEXT_PUBLIC_, tetap ke-inline ke client bundle.";
+// Two checks (exposedServiceRoleKey, exposedFirebaseAdminKey) scan raw
+// filesystem .env files without git-awareness, so a gitignored/local-only
+// var reads the same as a committed one. Appending this note keeps their
+// CRITICAL severity honest about which case it actually is.
+export function envFileTrackingContext(relFile, tracked) {
+    if (!basename(relFile).startsWith(".env"))
+        return "";
+    if (tracked === null)
+        return "";
+    return tracked.has(relFile) ? TRACKED_CONTEXT : UNTRACKED_CONTEXT;
+}

package/dist/cli.js

@@ -11,6 +11,7 @@ import { findExposedServiceRoleKeys } from "./checks/exposedServiceRoleKey.js";
 import { findOpenFirebaseRules } from "./checks/firebaseRulesOpen.js";
 import { findRlsDisabledTables } from "./checks/rlsDisabled.js";
 import { GitleaksNotFoundError, runSecretScan } from "./checks/secretScan.js";
+import { checkLicense } from "./licenseCheck.js";
 import { applyIgnoreRules, buildReport, formatReport } from "./report.js";
 const IGNORE_FILE = ".secanix.json";
 // Missing file = no suppression (default, zero-friction). Malformed file
@@ -115,10 +116,28 @@ export async function run(targetDir = process.cwd(), options = {}) {
     }
     return 0;
 }
+export async function runLicenseCheck(key) {
+    const result = await checkLicense(key);
+    if (result.status === "valid") {
+        console.log("secanix Pro license valid.");
+        return 0;
+    }
+    if (result.status === "invalid") {
+        console.error(`secanix Pro license invalid: ${result.message}`);
+        return 1;
+    }
+    console.error(`secanix Pro license check inconclusive: ${result.message}`);
+    return 2;
+}
 const isMain = process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
 if (isMain) {
     const args = process.argv.slice(2);
-    const json = args.includes("--json");
-    const targetDir = args.find((arg) => arg !== "--json" && !arg.startsWith("-"));
-    process.exit(await run(targetDir, { json }));
+    if (args[0] === "license-check") {
+        process.exitCode = await runLicenseCheck(process.env.SECANIX_LICENSE_KEY);
+    }
+    else {
+        const json = args.includes("--json");
+        const targetDir = args.find((arg) => arg !== "--json" && !arg.startsWith("-"));
+        process.exitCode = await run(targetDir, { json });
+    }
 }

package/dist/licenseCheck.js

@@ -0,0 +1,37 @@
+const VALIDATE_URL = "https://api.lemonsqueezy.com/v1/licenses/validate";
+const REQUEST_TIMEOUT_MS = 10_000;
+export async function checkLicense(key) {
+    if (!key) {
+        return { status: "invalid", message: "SECANIX_LICENSE_KEY is missing or empty." };
+    }
+    let response;
+    try {
+        response = await fetch(VALIDATE_URL, {
+            method: "POST",
+            headers: { Accept: "application/json" },
+            body: new URLSearchParams({ license_key: key }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (err) {
+        return { status: "error", message: `Could not reach LemonSqueezy: ${err.message}` };
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        return { status: "error", message: "LemonSqueezy returned a non-JSON response." };
+    }
+    if (typeof body !== "object" || body === null || !("valid" in body)) {
+        return { status: "error", message: "Unexpected response shape from LemonSqueezy." };
+    }
+    const { valid, error } = body;
+    if (valid === true) {
+        return { status: "valid" };
+    }
+    return {
+        status: "invalid",
+        message: typeof error === "string" ? error : "License key is invalid or expired.",
+    };
+}

package/dist/rules/gitleaks-config.toml

@@ -1,13 +1,13 @@
-[extend]
-useDefault = true
-
-[allowlist]
-paths = [
-  '''(^|/)node_modules(/|$)''',
-  '''(^|/)\.git(/|$)''',
-  '''(^|/)\.next(/|$)''',
-  '''(^|/)dist(/|$)''',
-  '''(^|/)build(/|$)''',
-  '''(^|/)out(/|$)''',
-  '''(^|/)coverage(/|$)''',
-]
+[extend]
+useDefault = true
+
+[allowlist]
+paths = [
+  '''(^|/)node_modules(/|$)''',
+  '''(^|/)\.git(/|$)''',
+  '''(^|/)\.next(/|$)''',
+  '''(^|/)dist(/|$)''',
+  '''(^|/)build(/|$)''',
+  '''(^|/)out(/|$)''',
+  '''(^|/)coverage(/|$)''',
+]

package/dist/rules/nextjs-api-auth-missing.yaml

@@ -1,24 +1,24 @@
-rules:
-  - id: nextjs-api-route-missing-auth
-    languages: [typescript, javascript]
-    severity: WARNING
-    message: >-
-      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
-    paths:
-      include:
-        - "pages/api/**"
-        - "src/pages/api/**"
-        - "app/**/route.ts"
-        - "app/**/route.js"
-        - "src/app/**/route.ts"
-        - "src/app/**/route.js"
-    patterns:
-      - pattern-either:
-          - pattern: export default function $HANDLER(...) { ... }
-          - pattern: export default async function $HANDLER(...) { ... }
-          - pattern: export async function GET(...) { ... }
-          - pattern: export async function POST(...) { ... }
-          - pattern: export async function PUT(...) { ... }
-          - pattern: export async function PATCH(...) { ... }
-          - pattern: export async function DELETE(...) { ... }
-      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)
+rules:
+  - id: nextjs-api-route-missing-auth
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: >-
+      API route Next.js ini kelihatan gak ada auth check (session/token) sebelum jalanin logic.
+    paths:
+      include:
+        - "pages/api/**"
+        - "src/pages/api/**"
+        - "app/**/route.ts"
+        - "app/**/route.js"
+        - "src/app/**/route.ts"
+        - "src/app/**/route.js"
+    patterns:
+      - pattern-either:
+          - pattern: export default function $HANDLER(...) { ... }
+          - pattern: export default async function $HANDLER(...) { ... }
+          - pattern: export async function GET(...) { ... }
+          - pattern: export async function POST(...) { ... }
+          - pattern: export async function PUT(...) { ... }
+          - pattern: export async function PATCH(...) { ... }
+          - pattern: export async function DELETE(...) { ... }
+      - pattern-not-regex: (?i)(getServerSession|getToken|currentUser|verifyAuth|requireAuth|withAuth|auth\(\)|\.auth\.getUser|\.auth\.getSession|jwt\.verify|isAuthenticated|checkAuth)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secanix",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "private": false,
   "description": "Security scanner buat app hasil vibe-coding (Next.js + Supabase/Firebase).",
   "license": "MIT",