shercheck 0.1.0 → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NightWiing
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,188 @@
+# 🔍 shercheck
+
+**AI-aware security scanner** — finds exposed secrets in your codebase and checks whether your AI coding agent (Cursor, Copilot, Windsurf, Claude Code, etc.) can actually read your sensitive files.
+
+Most secret scanners stop at "you have a `.env` file." shercheck goes one step further: it checks whether that file is actually **blocked from AI agents** via `.cursorignore`, `.aiexclude`, `.clineignore`, Claude Code's deny rules, and more — and tells you exactly what's missing.
+
+## Why
+
+AI coding assistants can read almost any file in your project by default. If your `.env`, private keys, or credentials aren't explicitly excluded, your AI agent (and anything it shares context with) can see them. shercheck audits this blind spot in seconds.
+
+## Features
+
+- 🔎 **Sensitive file detection** — flags `.env` files, private keys (`.pem`, `.key`, `id_rsa`), cloud credentials (`.aws/credentials`, `.npmrc`), keystores, and more.
+- 🔑 **Secret scanning** — greps file contents for real leaked credentials: AWS keys, GitHub tokens, Stripe keys, Supabase keys, Anthropic keys, SendGrid keys, private key blocks, JWTs, and generic hardcoded secrets.
+- 🤖 **AI exposure check** — cross-references every sensitive file against the ignore files of 9+ AI tools (Cursor, Windsurf, Cline, Gemini, Codeium, Copilot, Claude Code, and generic `.aiignore`) to see if it's actually protected.
+- 🛡️ **Masked previews** — secrets are shown masked (e.g. `AKIA********MNOP`) so reports are safe to share/paste.
+- 📊 **Readable or machine output** — pretty colored terminal report by default, or `--json` for scripting.
+- 🚦 **CI-friendly** — `--ci` flag exits with code `1` when exposed secrets are found, so you can fail a pipeline on real risk.
+
+## Installation
+
+Run it directly without installing anything (recommended):
+
+```bash
+npx shercheck
+```
+
+Or install globally:
+
+```bash
+npm install -g shercheck
+```
+
+Or add it as a dev dependency to run via npm scripts:
+
+```bash
+npm install --save-dev shercheck
+```
+
+## Usage
+
+Scan the current directory:
+
+```bash
+npx shercheck
+```
+
+Scan a specific project path:
+
+```bash
+npx shercheck ./path/to/project
+```
+
+Output JSON (for scripting or piping into other tools):
+
+```bash
+npx shercheck --json
+```
+
+Fail CI when a sensitive file with no AI-ignore coverage is found:
+
+```bash
+npx shercheck --ci
+```
+
+### Options
+
+| Flag | Description |
+| --- | --- |
+| `[path]` | Project directory to scan (defaults to `.`) |
+| `--json` | Output results as JSON instead of a colored report |
+| `--ci` | Exit with code `1` if any fully-exposed findings are detected |
+| `-V, --version` | Print the version number |
+| `-h, --help` | Print usage help |
+
+## Example output
+
+```
+────────────────────────────────────────────────────
+  🔍 SHERCHECK  · AI-aware security scanner
+────────────────────────────────────────────────────
+
+────────────────────────────────── SUMMARY ──────────────────────────────────
+
+  Sensitive files found       1
+  Secrets in content          1
+  Files exposed to AI agents  1
+
+    HIGH      1 file(s)
+
+────────────────────────────── SECRETS DETECTED ─────────────────────────────
+
+    HIGH    .env
+           Line 1  ·  AWS Access Key
+           Preview: SECRET_KEY=AKIA********MNOP
+
+──────────────────────────────── AI EXPOSURE ────────────────────────────────
+
+    HIGH    .env
+           Status   fully exposed   has secret
+
+──────────────────────────────── RECOMMENDATIONS ────────────────────────────
+
+  ✖  No AI ignore files found in this project
+
+  →  Create a .aiignore or .cursorignore and add:
+       .env
+
+  ⚠   Rotate these credentials immediately:
+      .env
+
+────────────────────────────────────────────────────
+  ✖  Issues found — review recommendations above
+────────────────────────────────────────────────────
+```
+
+## What it checks
+
+### Sensitive files
+
+shercheck flags files matching common sensitive-file patterns, including:
+
+- `.env`, `.env.*` (any environment file)
+- `*.pem`, `*.key`, `id_rsa*`, `id_ed25519*` (private keys)
+- `*.p12`, `*.pfx`, `*.keystore` (certificates/keystores)
+- `credentials.json`, `secrets.*`
+- `.npmrc`
+- `.aws/credentials`, `.aws/config`
+- Supabase's `supabase/.temp/**` directory
+
+### Secret patterns
+
+File contents (for common source/config file types under 500 KB, skipping binaries) are scanned for:
+
+- AWS Access Keys
+- GitHub Tokens
+- Stripe Live/Test Keys
+- Supabase Keys
+- Anthropic API Keys
+- SendGrid Keys
+- Private key blocks (`-----BEGIN ... PRIVATE KEY-----`)
+- Generic JWTs
+- Hardcoded `SECRET` / `API_KEY` / `PRIVATE_KEY` / `AUTH_TOKEN` assignments
+
+Matches inside comments are skipped, and all detected secrets are masked in the report.
+
+### AI exposure
+
+For every sensitive file found, shercheck checks whether it's covered by any of these AI-tool ignore mechanisms:
+
+| Tool | Ignore file |
+| --- | --- |
+| Cursor | `.cursorignore`, `.cursorindexingignore` |
+| Windsurf | `.windsurfignore` |
+| Cline | `.clineignore` |
+| Gemini | `.aiexclude`, `.geminiignore` |
+| Codeium | `.codeiumignore` |
+| Copilot | `.copilotignore` |
+| Claude Code | `.claude/settings.json` (`permissions.deny` rules) |
+| Generic | `.aiignore` |
+
+A file is marked **fully exposed** if none of the detected AI tools' ignore rules cover it — meaning an AI agent working in that project could read it.
+
+## Using in CI
+
+Add shercheck to your pipeline to catch exposed secrets before they ship:
+
+```yaml
+# .github/workflows/security.yml
+name: Security check
+on: [push, pull_request]
+jobs:
+  shercheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npx shercheck --ci
+```
+
+The command exits with code `1` if any sensitive file is fully exposed to an AI agent, failing the build.
+
+## Requirements
+
+- Node.js >= 18
+
+## License
+
+MIT

package/bin/cli.js

@@ -1,24 +1,27 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import path from "node:path";
+import fs from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 import { scan } from "../src/scanner.js";
 import { findSensitiveFiles } from "../src/sensitive-files.js";
 import { findSecrets } from "../src/secrets.js";
 import { checkAiExposure } from "../src/ai-exposure.js";
 import { printJsonReport, printReport } from "../src/report.js";
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const pkg = JSON.parse(
+  await fs.readFile(path.join(__dirname, "..", "package.json"), "utf-8"),
+);
+
 const program = new Command();
 
 program
   .name("shercheck")
   .description("A tool to check the integrity of your files")
-  .version("1.0.0")
+  .version(pkg.version)
   .argument("[path]", "project directory to scan", ".")
   .option("--json", "output results as JSON instead of colored text")
-  .option(
-    "--fix",
-    "auto-create/update AI-ignore files for unprotected sensitive files",
-  )
   .option("--ci", "exit with code 1 if any findings are detected")
   .action((targetPath, options) => {
     const resolvedPath = path.resolve(targetPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shercheck",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "AI-aware security scanner — finds exposed secrets and checks if your AI agent can read sensitive files",
   "type": "module",
   "bin": {