secureflow-cli 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { execSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+const LOGGING_SECRET_REGEX = /console\.(log|info|warn|error|debug)\s*\([\s\S]*?(process\.env|password|secret|token|key)[\s\S]*?\)/i;
+function getStagedFiles() {
+    try {
+        const output = execSync('git diff --cached --name-only', { encoding: 'utf-8' });
+        return output.split('\n').filter(Boolean);
+    }
+    catch (error) {
+        console.error('Failed to get staged files. Are you in a git repository?');
+        process.exit(1);
+    }
+}
+function scanFiles() {
+    const files = getStagedFiles();
+    let hasViolations = false;
+    files.forEach(file => {
+        const filePath = path.resolve(process.cwd(), file);
+        if (fs.existsSync(filePath)) {
+            const content = fs.readFileSync(filePath, 'utf-8');
+            const lines = content.split(/\r?\n/);
+            lines.forEach((line, index) => {
+                const trimmedLine = line.trim();
+                // 1. Ignore single-line comments
+                if (trimmedLine.startsWith('//')) {
+                    return;
+                }
+                // 2. Strip string literals ('...', "...", `...`) so we only scan actual code/variables
+                const lineWithoutStrings = trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '');
+                if (LOGGING_SECRET_REGEX.test(lineWithoutStrings)) {
+                    console.error(`🚨 [SecureFlow] Secret logging detected in ${file}:${index + 1}`);
+                    console.error(`   -> ${line.trim()}`);
+                    hasViolations = true;
+                }
+            });
+        }
+    });
+    if (hasViolations) {
+        console.error('\n❌ SecureFlow blocked this commit. Please remove the exposed secrets/env variables.');
+        process.exit(1);
+    }
+    else {
+        console.log('✅ SecureFlow scan passed.');
+        process.exit(0);
+    }
+}
+scanFiles();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,oBAAoB,GAAG,sGAAsG,CAAC;AAEpI,SAAS,cAAc;IACnB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IACd,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAEnD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAEhC,iCAAiC;gBACjC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,uFAAuF;gBACvF,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBAEnF,IAAI,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,KAAK,CAAC,8CAA8C,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjF,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtC,aAAa,GAAG,IAAI,CAAC;gBACzB,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,EAAE,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "secureflow-cli",
+  "version": "1.0.0",
+  "description": "Pre-commit secret logging detector for secure development workflows",
+  "main": "./dist/index.js",
+  "bin": {
+    "secureflow": "./dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepare": "npm run build",
+    "publish": "npm publish --access public"
+  },
+  "keywords": [
+    "security",
+    "secrets",
+    "scanner",
+    "pre-commit",
+    "husky",
+    "secureflow"
+  ],
+  "author": "Gaurav Karakoti",
+  "license": "ISC",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "typescript": "^7.0.2"
+  }
+}