shippable-dev 0.1.0

package/dist/shippable.mjs

@@ -0,0 +1,2119 @@
+#!/usr/bin/env node
+
+// ../engine/src/cli.ts
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// ../engine/src/types.ts
+var SEVERITY_RANK = {
+  critical: 5,
+  high: 4,
+  medium: 3,
+  low: 2,
+  info: 1
+};
+function worstSeverity(findings) {
+  let worst = null;
+  for (const f of findings) {
+    if (worst === null || SEVERITY_RANK[f.severity] > SEVERITY_RANK[worst]) {
+      worst = f.severity;
+    }
+  }
+  return worst;
+}
+
+// ../engine/src/fetchClient.ts
+var MAX_SCRIPTS = 20;
+var MAX_CHUNKS = 30;
+var MAX_CHUNK_BYTES_TOTAL = 15e6;
+function extractScriptSrcs(html, pageUrl) {
+  const out = [];
+  const re = /<script[^>]*\ssrc=["']([^"']+)["'][^>]*>/gi;
+  let m;
+  while ((m = re.exec(html)) !== null) {
+    const raw = m[1];
+    if (!raw) continue;
+    try {
+      out.push(new URL(raw, pageUrl).toString());
+    } catch {
+    }
+  }
+  return [...new Set(out)];
+}
+function extractChunkRefs(text, baseUrl) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (raw) => {
+    if (!raw) return;
+    try {
+      out.add(new URL(raw, baseUrl).toString());
+    } catch {
+    }
+  };
+  const addRootRelative = (raw) => {
+    if (!raw) return;
+    add((raw.startsWith("/") ? raw : "/" + raw).replace(/^\/+/, "/"));
+  };
+  const importRe = /\bimport\(\s*["'`]([^"'`]+\.js)["'`]\s*\)/g;
+  let m;
+  while ((m = importRe.exec(text)) !== null) add(m[1]);
+  const assetLiteralRe = /["'](\.?\/?(?:assets|static\/chunks)\/[^"'\s]+\.js)["']/g;
+  while ((m = assetLiteralRe.exec(text)) !== null) addRootRelative(m[1]);
+  for (const tag of text.match(/<link\b[^>]*>/gi) ?? []) {
+    if (!/rel=["']modulepreload["']/i.test(tag)) continue;
+    const href = /href=["']([^"']+)["']/i.exec(tag)?.[1];
+    if (href && /\.js($|\?)/.test(href)) add(href);
+  }
+  return [...out];
+}
+function sameOrigin(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+function isJsUrl(url) {
+  try {
+    return new URL(url).pathname.endsWith(".js");
+  } catch {
+    return false;
+  }
+}
+async function fetchApp(ctx, pageUrl) {
+  const notes = [];
+  const page = await ctx.http(pageUrl, { method: "GET" });
+  let combined = page.text;
+  const scriptsFetched = [];
+  const scripts = [];
+  const srcs = extractScriptSrcs(page.text, pageUrl).filter((s) => sameOrigin(s, pageUrl)).slice(0, MAX_SCRIPTS);
+  const discovered = new Set(srcs);
+  for (const src of srcs) {
+    try {
+      const res = await ctx.http(src, { method: "GET" });
+      if (res.status >= 200 && res.status < 300) {
+        combined += "\n/*__" + src + "__*/\n" + res.text;
+        scriptsFetched.push(src);
+        scripts.push({ url: src, text: res.text });
+      } else {
+        notes.push(`Skipped ${src} (status ${res.status}).`);
+      }
+    } catch {
+      notes.push(`Could not fetch ${src}.`);
+    }
+  }
+  const queue = [];
+  const enqueue = (refs) => {
+    for (const ref of refs) {
+      if (discovered.has(ref) || !sameOrigin(ref, pageUrl) || !isJsUrl(ref)) continue;
+      discovered.add(ref);
+      queue.push(ref);
+    }
+  };
+  enqueue(extractChunkRefs(page.text, pageUrl));
+  for (const s of scripts) enqueue(extractChunkRefs(s.text, s.url));
+  let chunksFetched = 0;
+  let chunkBytesTotal = 0;
+  while (queue.length > 0 && chunksFetched < MAX_CHUNKS && chunkBytesTotal < MAX_CHUNK_BYTES_TOTAL) {
+    const url = queue.shift();
+    try {
+      const res = await ctx.http(url, { method: "GET" });
+      if (res.status < 200 || res.status >= 300) continue;
+      if (res.text.length > ctx.maxBytesPerAsset) continue;
+      chunksFetched++;
+      chunkBytesTotal += res.text.length;
+      combined += "\n/*__" + url + "__*/\n" + res.text;
+      scriptsFetched.push(url);
+      scripts.push({ url, text: res.text });
+      enqueue(extractChunkRefs(res.text, url));
+    } catch {
+    }
+  }
+  if (chunksFetched > 0) {
+    notes.push(`Scanned ${chunksFetched} code chunk${chunksFetched === 1 ? "" : "s"}.`);
+  }
+  return {
+    finalStatus: page.status,
+    headers: page.headers,
+    setCookie: page.setCookie ?? [],
+    combinedSource: combined,
+    scriptsFetched,
+    scripts,
+    notes
+  };
+}
+
+// ../engine/src/checks/secrets.ts
+function redact(value) {
+  if (value.length <= 12) return value.slice(0, 3) + "\u2026";
+  return value.slice(0, 6) + "\u2026" + value.slice(-4);
+}
+function decodeJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const payload = parts[1];
+  if (!payload) return null;
+  try {
+    const b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = b64.length % 4 === 0 ? "" : "=".repeat(4 - b64.length % 4);
+    const json = Buffer.from(b64 + pad, "base64").toString("utf8");
+    const obj = JSON.parse(json);
+    return typeof obj === "object" && obj !== null ? obj : null;
+  } catch {
+    return null;
+  }
+}
+var JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g;
+var SUPABASE_URL_RE = /https:\/\/([a-z0-9]{16,40})\.supabase\.co/g;
+var STRIPE_SECRET_RE = /\b([rs]k_(?:live|test)_[A-Za-z0-9]{16,})/g;
+var STRIPE_PUB_RE = /\bpk_(?:live|test)_[A-Za-z0-9]{16,}/g;
+var OPENAI_RE = /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}/g;
+var ANTHROPIC_RE = /\bsk-ant-[A-Za-z0-9_-]{20,}/g;
+var AWS_RE = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g;
+var GOOGLE_API_RE = /\bAIza[A-Za-z0-9_-]{30,}\b/g;
+var GITHUB_RE = /\b(?:ghp_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b/g;
+var RESEND_RE = /\bre_[A-Za-z0-9]{32,40}\b/g;
+var SENDGRID_RE = /\bSG\.[A-Za-z0-9_-]{16,32}\.[A-Za-z0-9_-]{16,64}\b/g;
+var TWILIO_KEY_RE = /\bSK[0-9a-fA-F]{32}\b/g;
+var MAILGUN_RE = /\bkey-[0-9a-fA-F]{32}\b/g;
+var GROQ_RE = /\bgsk_[A-Za-z0-9]{20,}\b/g;
+var REPLICATE_RE = /\br8_[A-Za-z0-9]{20,}\b/g;
+function pushAll(out, seen, kind, matches) {
+  for (const value of matches) {
+    const dedupeKey = kind + ":" + value;
+    if (seen.has(dedupeKey)) continue;
+    seen.add(dedupeKey);
+    out.push({ kind, value, redacted: redact(value) });
+  }
+}
+function extractSecrets(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  pushAll(out, seen, "anthropic-key", text.match(ANTHROPIC_RE) ?? []);
+  const anthropicValues = new Set(out.filter((h) => h.kind === "anthropic-key").map((h) => h.value));
+  const openaiMatches = (text.match(OPENAI_RE) ?? []).filter(
+    (m) => ![...anthropicValues].some((a) => a.startsWith(m) || m.startsWith("sk-ant"))
+  );
+  pushAll(out, seen, "openai-key", openaiMatches);
+  pushAll(out, seen, "stripe-secret", text.match(STRIPE_SECRET_RE) ?? []);
+  pushAll(out, seen, "stripe-publishable", text.match(STRIPE_PUB_RE) ?? []);
+  pushAll(out, seen, "aws-access-key", text.match(AWS_RE) ?? []);
+  pushAll(out, seen, "google-api-key", text.match(GOOGLE_API_RE) ?? []);
+  pushAll(out, seen, "github-token", text.match(GITHUB_RE) ?? []);
+  pushAll(out, seen, "resend-key", text.match(RESEND_RE) ?? []);
+  pushAll(out, seen, "sendgrid-key", text.match(SENDGRID_RE) ?? []);
+  pushAll(out, seen, "twilio-key", text.match(TWILIO_KEY_RE) ?? []);
+  pushAll(out, seen, "mailgun-key", text.match(MAILGUN_RE) ?? []);
+  pushAll(out, seen, "groq-key", text.match(GROQ_RE) ?? []);
+  pushAll(out, seen, "replicate-key", text.match(REPLICATE_RE) ?? []);
+  if (/"type"\s*:\s*"service_account"/.test(text) && /"private_key"\s*:/.test(text) && !seen.has("gcp-service-account:present")) {
+    seen.add("gcp-service-account:present");
+    out.push({
+      kind: "gcp-service-account",
+      value: "[not captured]",
+      redacted: "service-account JSON with private_key"
+    });
+  }
+  for (const m of new Set(text.match(SUPABASE_URL_RE) ?? [])) {
+    if (!seen.has("supabase-url:" + m)) {
+      seen.add("supabase-url:" + m);
+      out.push({ kind: "supabase-url", value: m, redacted: m });
+    }
+  }
+  for (const token of new Set(text.match(JWT_RE) ?? [])) {
+    const payload = decodeJwt(token);
+    const role = payload?.["role"];
+    let kind = "generic-jwt";
+    if (role === "service_role") kind = "supabase-service-key";
+    else if (role === "anon") kind = "supabase-anon-key";
+    if (!seen.has(kind + ":" + token)) {
+      seen.add(kind + ":" + token);
+      out.push({ kind, value: token, redacted: redact(token) });
+    }
+  }
+  return out;
+}
+function getSupabaseConnection(hits) {
+  const url = hits.find((h) => h.kind === "supabase-url")?.value;
+  const anonKey2 = hits.find((h) => h.kind === "supabase-anon-key")?.value;
+  if (url && anonKey2) return { url, anonKey: anonKey2 };
+  return null;
+}
+var CRITICAL_LEAK_META = {
+  "supabase-service-key": {
+    title: "Supabase service_role key exposed in the browser",
+    why: "The service_role key bypasses ALL Row-Level Security. Anyone reading your page source has full read/write admin access to your entire database.",
+    rotate: "Rotate the service_role key in Supabase \u2192 Settings \u2192 API immediately, and remove it from all client-side code \u2014 it must only ever live in server/edge functions."
+  },
+  "stripe-secret": {
+    title: "Stripe secret key exposed in the browser",
+    why: "A Stripe secret key lets anyone create charges, refunds, and read customer/payment data on your account.",
+    rotate: "Roll the key now in the Stripe Dashboard \u2192 Developers \u2192 API keys, and move it to a server-side environment variable."
+  },
+  "openai-key": {
+    title: "OpenAI API key exposed in the browser",
+    why: "Anyone can run up unlimited billed usage on your OpenAI account with this key.",
+    rotate: "Revoke the key at platform.openai.com/api-keys and call OpenAI only from a server/edge function."
+  },
+  "anthropic-key": {
+    title: "Anthropic API key exposed in the browser",
+    why: "Anyone can run up unlimited billed usage on your Anthropic account with this key.",
+    rotate: "Revoke the key in the Anthropic Console and call the API only from a server/edge function."
+  },
+  "aws-access-key": {
+    title: "AWS access key exposed in the browser",
+    why: "Depending on its IAM permissions this can grant access to your cloud resources and data.",
+    rotate: "Deactivate the key in AWS IAM immediately and audit CloudTrail for misuse."
+  },
+  "github-token": {
+    title: "GitHub token exposed in the browser",
+    why: "Can grant read/write access to your repositories.",
+    rotate: "Revoke the token in GitHub \u2192 Settings \u2192 Developer settings immediately."
+  },
+  "resend-key": {
+    title: "Resend API key exposed in the browser",
+    why: "Anyone can use this key to send email as your Resend account \u2014 running up usage or sending spam/phishing that appears to come from you.",
+    rotate: "Revoke the key in the Resend dashboard \u2192 API Keys and issue a new one."
+  },
+  "sendgrid-key": {
+    title: "SendGrid API key exposed in the browser",
+    why: "Anyone can send email through your SendGrid account with this key, and depending on its scopes may also read your contacts and stats.",
+    rotate: "Revoke the key in SendGrid \u2192 Settings \u2192 API Keys and create a new one."
+  },
+  "twilio-key": {
+    title: "Twilio API key exposed in the browser",
+    why: "This key can send SMS/voice messages and access your Twilio account, running up charges on your bill.",
+    rotate: "Delete the key in Twilio Console \u2192 Account \u2192 API keys & tokens and create a new one."
+  },
+  "mailgun-key": {
+    title: "Mailgun API key exposed in the browser",
+    why: "Anyone can send email through your Mailgun account with this key.",
+    rotate: "Rotate the key in the Mailgun dashboard \u2192 API Keys."
+  },
+  "groq-key": {
+    title: "Groq API key exposed in the browser",
+    why: "Anyone can run up unlimited billed usage on your Groq account with this key.",
+    rotate: "Revoke the key at console.groq.com/keys and call Groq only from a server/edge function."
+  },
+  "replicate-key": {
+    title: "Replicate API key exposed in the browser",
+    why: "Anyone can run models on your Replicate account with this key, running up your bill.",
+    rotate: "Revoke the key at replicate.com/account/api-tokens and create a new one."
+  },
+  "gcp-service-account": {
+    title: "Google Cloud service-account key exposed in the browser",
+    why: "A service-account JSON key can grant broad, standing access to your Google Cloud project's resources and data \u2014 far more than a normal API key.",
+    rotate: "Delete or disable this service-account key in Google Cloud Console \u2192 IAM & Admin \u2192 Service Accounts immediately, and check Cloud Audit Logs for misuse."
+  }
+};
+function secretFindings(hits, location) {
+  const findings = [];
+  for (const hit of hits) {
+    const meta = CRITICAL_LEAK_META[hit.kind];
+    if (meta) {
+      findings.push({
+        id: `secret:${hit.kind}:${hit.redacted}`,
+        category: "secret",
+        severity: "critical",
+        confidence: "proven",
+        title: meta.title,
+        description: meta.why,
+        location,
+        proof: {
+          summary: `Found ${hit.kind} (${hit.redacted}) in publicly served code.`,
+          evidence: hit.redacted
+        },
+        fix: {
+          steps: [meta.rotate],
+          aiPrompt: `Security fix: a secret key (${meta.title.replace(/ exposed in the browser$/, "")}) is shipped in my app's frontend code, where anyone can read it. Move every use of this key into a server-side function or API route that reads it from an environment variable, remove it from all client-side code, and make sure it is never bundled into the browser again. I will rotate the key myself.`
+        },
+        reverify: { check: "secret-scan", target: hit.kind }
+      });
+    }
+    if (hit.kind === "google-api-key") {
+      findings.push({
+        id: `secret:google-api-key:${hit.redacted}`,
+        category: "secret",
+        severity: "low",
+        confidence: "info",
+        title: "Google API key present in client code",
+        description: "A Google API key is in your bundle. This is normal for Firebase and Maps keys, but only if the key is restricted. An unrestricted key can be abused to run up billed usage.",
+        location,
+        proof: { summary: `Found google-api-key (${hit.redacted}) in publicly served code.` },
+        fix: {
+          steps: [
+            "In Google Cloud Console \u2192 Credentials, add HTTP-referrer and API restrictions to this key so only your domain and intended APIs can use it."
+          ],
+          aiPrompt: "My app ships a Google API key in its frontend. Tell me exactly which HTTP-referrer and API restrictions to set on this key in Google Cloud Console so only my domain and the APIs my app actually uses can call it, and check the code uses no other Google APIs that would break."
+        },
+        reverify: { check: "secret-scan", target: "google-api-key" }
+      });
+    }
+  }
+  return findings;
+}
+
+// ../engine/src/checks/harvest.ts
+var NAME_RE = /^[A-Za-z_][A-Za-z0-9_-]{0,62}$/;
+function isValidName(name) {
+  return NAME_RE.test(name);
+}
+function dedupeNames(names) {
+  return [...new Set(names)];
+}
+function extractQuoted(re, text) {
+  const out = /* @__PURE__ */ new Set();
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name = m[2];
+    if (name && isValidName(name)) out.add(name);
+  }
+  return out;
+}
+var SUPABASE_FROM_RE = /\.from\(\s*(["'`])([^"'`]{0,80})\1\s*\)/g;
+var SUPABASE_RPC_RE = /\.rpc\(\s*(["'`])([^"'`]{0,80})\1/g;
+var FIRESTORE_COLLECTION_CALL_RE = /\bcollection\(\s*[A-Za-z_$][\w$]*\s*,\s*(["'`])([^"'`]{0,80})\1/g;
+var FIRESTORE_DOC_CALL_RE = /\bdoc\(\s*[A-Za-z_$][\w$]*\s*,\s*(["'`])([^"'`]{0,80})\1/g;
+var FIRESTORE_NAMESPACED_RE = /\.collection\(\s*(["'`])([^"'`]{0,80})\1/g;
+function harvestSupabaseTableNames(text) {
+  return dedupeNames([...extractQuoted(SUPABASE_FROM_RE, text)]);
+}
+function harvestSupabaseRpcNames(text) {
+  return dedupeNames([...extractQuoted(SUPABASE_RPC_RE, text)]);
+}
+function harvestFirestoreCollectionNames(text) {
+  const out = /* @__PURE__ */ new Set();
+  for (const n of extractQuoted(FIRESTORE_COLLECTION_CALL_RE, text)) out.add(n);
+  for (const n of extractQuoted(FIRESTORE_DOC_CALL_RE, text)) out.add(n);
+  for (const n of extractQuoted(FIRESTORE_NAMESPACED_RE, text)) out.add(n);
+  return dedupeNames([...out]);
+}
+
+// ../engine/src/checks/supabase.ts
+var MAX_TABLE_PROBES = 25;
+function authHeaders(conn) {
+  return {
+    apikey: conn.anonKey,
+    Authorization: `Bearer ${conn.anonKey}`
+  };
+}
+function restBase(conn) {
+  return conn.url.replace(/\/+$/, "") + "/rest/v1";
+}
+function parseTables(openApiText) {
+  let doc;
+  try {
+    doc = JSON.parse(openApiText);
+  } catch {
+    return [];
+  }
+  if (typeof doc !== "object" || doc === null) return [];
+  const tables = /* @__PURE__ */ new Set();
+  const defs = doc["definitions"];
+  if (defs && typeof defs === "object") {
+    for (const name of Object.keys(defs)) {
+      if (!name.startsWith("(") && !name.startsWith("rpc")) tables.add(name);
+    }
+  }
+  const paths = doc["paths"];
+  if (paths && typeof paths === "object") {
+    for (const p of Object.keys(paths)) {
+      if (p === "/") continue;
+      if (p.startsWith("/rpc/")) continue;
+      const name = p.replace(/^\//, "");
+      if (name && !name.includes("/")) tables.add(name);
+    }
+  }
+  return [...tables];
+}
+function parseRpcFunctions(openApiText) {
+  let doc;
+  try {
+    doc = JSON.parse(openApiText);
+  } catch {
+    return [];
+  }
+  if (typeof doc !== "object" || doc === null) return [];
+  const paths = doc["paths"];
+  const fns = /* @__PURE__ */ new Set();
+  if (paths && typeof paths === "object") {
+    for (const p of Object.keys(paths)) {
+      if (p.startsWith("/rpc/")) {
+        const name = p.slice("/rpc/".length);
+        if (name) fns.add(name);
+      }
+    }
+  }
+  return [...fns];
+}
+async function fetchOpenApiDocText(ctx, conn) {
+  const res = await ctx.http(restBase(conn) + "/", {
+    method: "GET",
+    headers: authHeaders(conn)
+  });
+  if (res.status >= 400) return null;
+  return res.text;
+}
+var FALLBACK_TABLE_WORDLIST = [
+  // English
+  "users",
+  "user",
+  "profiles",
+  "profile",
+  "accounts",
+  "posts",
+  "projects",
+  "orders",
+  "payments",
+  "subscriptions",
+  "invoices",
+  "customers",
+  "waitlist",
+  "contacts",
+  "leads",
+  "messages",
+  "chats",
+  "images",
+  "files",
+  "uploads",
+  "comments",
+  "quotes",
+  "bookings",
+  "reviews",
+  "notifications",
+  "sessions",
+  "teams",
+  "organizations",
+  "members",
+  "settings",
+  "logs",
+  "events",
+  "todos",
+  "products",
+  "carts",
+  "transactions",
+  "api_keys",
+  "tokens",
+  "secrets",
+  // Portuguese (BR)
+  "usuarios",
+  "usuario",
+  "clientes",
+  "cliente",
+  "pedidos",
+  "pagamentos",
+  "projetos",
+  "projeto",
+  "produtos",
+  "contatos",
+  "mensagens",
+  "orcamentos",
+  "assinaturas",
+  "faturas",
+  "renders",
+  "imagens",
+  "arquivos"
+];
+async function tableReachable(ctx, conn, table) {
+  try {
+    const res = await ctx.http(
+      `${restBase(conn)}/${encodeURIComponent(table)}?select=*&limit=1`,
+      { method: "GET", headers: authHeaders(conn) }
+    );
+    return res.status >= 200 && res.status < 300;
+  } catch {
+    return false;
+  }
+}
+async function discoverTables(ctx, conn, harvestedTables = []) {
+  const text = await fetchOpenApiDocText(ctx, conn);
+  const introspected = text ? parseTables(text) : [];
+  if (introspected.length > 0) {
+    const tables = dedupeNames([...introspected, ...harvestedTables]).slice(0, MAX_TABLE_PROBES);
+    return { tables, viaFallback: false, rpcFunctions: text ? parseRpcFunctions(text) : [] };
+  }
+  const candidates = dedupeNames([...harvestedTables, ...FALLBACK_TABLE_WORDLIST]).slice(
+    0,
+    MAX_TABLE_PROBES
+  );
+  const reachable = [];
+  for (const t of candidates) {
+    if (await tableReachable(ctx, conn, t)) reachable.push(t);
+  }
+  return { tables: reachable, viaFallback: true, rpcFunctions: [] };
+}
+function parseContentRangeTotal(headers) {
+  const cr = headers["content-range"] ?? headers["Content-Range"];
+  if (!cr) return null;
+  const m = cr.match(/\/(\d+)$/);
+  return m && m[1] ? Number(m[1]) : null;
+}
+function firstRowKeys(text) {
+  try {
+    const arr = JSON.parse(text);
+    if (Array.isArray(arr) && arr.length > 0 && typeof arr[0] === "object" && arr[0]) {
+      return Object.keys(arr[0]).slice(0, 12);
+    }
+  } catch {
+  }
+  return [];
+}
+function rowCount(text) {
+  try {
+    const arr = JSON.parse(text);
+    return Array.isArray(arr) ? arr.length : 0;
+  } catch {
+    return 0;
+  }
+}
+async function probeTableRead(ctx, conn, table) {
+  const url = `${restBase(conn)}/${encodeURIComponent(table)}?select=*&limit=3`;
+  let res;
+  try {
+    res = await ctx.http(url, {
+      method: "GET",
+      headers: { ...authHeaders(conn), Prefer: "count=estimated" }
+    });
+  } catch {
+    return {
+      table,
+      readable: false,
+      rowsReturned: 0,
+      totalEstimate: null,
+      sampleKeys: [],
+      blocked: true,
+      status: 0
+    };
+  }
+  const blocked = res.status === 401 || res.status === 403;
+  const rows = res.status >= 200 && res.status < 300 ? rowCount(res.text) : 0;
+  return {
+    table,
+    readable: rows > 0,
+    rowsReturned: rows,
+    totalEstimate: parseContentRangeTotal(res.headers),
+    sampleKeys: rows > 0 ? firstRowKeys(res.text) : [],
+    blocked,
+    status: res.status
+  };
+}
+var SENSITIVE_COLUMN_PATTERNS = [
+  /email/i,
+  /phone/i,
+  /pass(word)?/i,
+  /hash/i,
+  /token/i,
+  /secret/i,
+  /api[_-]?key/i,
+  /ssn/i,
+  /tax/i,
+  /address/i,
+  /\bdob\b/i,
+  /birth/i,
+  /stripe/i,
+  /card/i,
+  /payment/i,
+  /iban/i
+];
+function sensitiveColumns(keys) {
+  return keys.filter((k) => SENSITIVE_COLUMN_PATTERNS.some((re) => re.test(k)));
+}
+function rlsSql(table) {
+  return [
+    `-- 1. Turn on Row-Level Security for the exposed table:`,
+    `ALTER TABLE public.${table} ENABLE ROW LEVEL SECURITY;`,
+    ``,
+    `-- 2. Add a policy that grants ONLY the access you intend. Example:`,
+    `--    (assumes the table has a user_id column identifying the owner)`,
+    `CREATE POLICY "${table}_owner_can_read"`,
+    `  ON public.${table} FOR SELECT`,
+    `  USING (auth.uid() = user_id);`,
+    ``,
+    `-- If this table is meant to be fully public, that is fine \u2014 but confirm`,
+    `-- it contains no private data before leaving it open.`
+  ].join("\n");
+}
+function rlsAiPrompt(table) {
+  return `Security fix: the Supabase table "${table}" is currently readable by anyone on the internet using the public anon key, because Row-Level Security is not restricting it. Enable RLS on public.${table} and add policies so each user can only read and write their own rows (match auth.uid() to the owner column). Do not allow anonymous or cross-user access to this table.`;
+}
+function rpcFindings(conn, rpcFunctions) {
+  if (rpcFunctions.length === 0) return [];
+  return [
+    {
+      id: "rls:rpc-functions",
+      category: "rls",
+      severity: "low",
+      confidence: "info",
+      title: `${rpcFunctions.length} database function(s) callable by anyone with the public key`,
+      description: "Your Supabase project exposes these Postgres functions (RPC endpoints) to anyone holding the public anon key \u2014 which includes every visitor to your site, since that key ships in your page source. We have not called any of them (that would not be read-only), but each one should check that the caller is allowed to do whatever it does.",
+      location: `${restBase(conn)}/rpc/`,
+      proof: { summary: `Function(s) exposed via PostgREST: ${rpcFunctions.join(", ")}.` },
+      fix: {
+        steps: [
+          "For each function, confirm it checks the caller's identity/permissions (e.g. auth.uid()) before doing anything sensitive, or revoke EXECUTE from the anon/authenticated roles if it shouldn't be public."
+        ],
+        aiPrompt: `My Supabase project exposes these database functions to anonymous users via PostgREST RPC: ${rpcFunctions.join(", ")}. For each one, check that the function body enforces proper authorization (e.g. an auth.uid() check) before doing anything sensitive, and lock down EXECUTE permissions from anon/public for any that shouldn't be callable by anyone.`
+      },
+      reverify: { check: "supabase-rpc-list" }
+    }
+  ];
+}
+async function probeRls(ctx, conn, harvestedTables = [], harvestedRpc = []) {
+  const findings = [];
+  const { tables, viaFallback, rpcFunctions } = await discoverTables(ctx, conn, harvestedTables);
+  const harvestedSet = new Set(harvestedTables);
+  ctx.log(
+    `Supabase: ${tables.length} table(s) reachable by the anon role` + (viaFallback ? " (via fallback wordlist \u2014 introspection was blocked)." : ".")
+  );
+  const reachableEmpty = [];
+  for (const table of tables) {
+    const r = await probeTableRead(ctx, conn, table);
+    if (!r.readable && r.status >= 200 && r.status < 300) {
+      reachableEmpty.push(table);
+    }
+    if (r.readable) {
+      const total = r.totalEstimate !== null ? ` (table holds ~${r.totalEstimate} rows total)` : "";
+      const sensitive = sensitiveColumns(r.sampleKeys);
+      const sensitivePhrase = sensitive.length > 0 ? ` It exposes ${sensitive.join(", ")}.` : "";
+      const fromCodePhrase = harvestedSet.has(table) ? " \u2014 a table name found in your app's code" : "";
+      const rowsPhrase = r.totalEstimate !== null ? `about ${r.totalEstimate.toLocaleString("en-US")} rows` : "rows";
+      const includingPhrase = sensitive.length > 0 ? `, including ${sensitive.join(", ")}` : "";
+      const impact = `Anyone can download ${rowsPhrase} from \`${table}\`${includingPhrase}.`;
+      findings.push({
+        id: `rls:${table}`,
+        category: "rls",
+        severity: "critical",
+        confidence: "proven",
+        title: `Table "${table}" is readable by anyone`,
+        description: `${impact} Using only the public anon key from your app's page source, an anonymous user can read rows from "${table}"${fromCodePhrase}, regardless of whether Row-Level Security is enabled on the table \u2014 a table can have RLS turned on and still carry a policy that allows public reads.${sensitivePhrase}`,
+        location: `${restBase(conn)}/${table}`,
+        proof: {
+          summary: `Read ${r.rowsReturned} row(s) from "${table}" anonymously${total}.` + (sensitive.length > 0 ? ` Exposes: ${sensitive.join(", ")}.` : ""),
+          evidence: r.sampleKeys.length > 0 ? `Columns exposed: ${r.sampleKeys.join(", ")}` : void 0
+        },
+        fix: { sql: rlsSql(table), aiPrompt: rlsAiPrompt(table) },
+        reverify: { check: "supabase-rls-read", target: table }
+      });
+    }
+  }
+  if (reachableEmpty.length > 0) {
+    findings.push({
+      id: "rls:reachable-empty",
+      category: "rls",
+      severity: "low",
+      confidence: "info",
+      title: `${reachableEmpty.length} table(s) reachable by anonymous users (no rows returned)`,
+      description: "The anon role can query these tables but they returned no rows \u2014 either Row-Level Security is correctly blocking anonymous reads, or the tables are empty. This is NOT proof of exposure, but confirm RLS is enabled and intentional on each: " + reachableEmpty.join(", ") + ". If any of these later hold data without RLS, they would become readable.",
+      location: restBase(conn),
+      proof: {
+        summary: `Anon SELECT returned 200 with 0 rows for: ${reachableEmpty.join(", ")}.`
+      },
+      fix: {
+        steps: [
+          "For each table, confirm in Supabase \u2192 Authentication \u2192 Policies that RLS is ENABLED and no policy grants anonymous read access to private data."
+        ],
+        aiPrompt: `Check these Supabase tables in my app: ${reachableEmpty.join(", ")}. For each one, make sure Row-Level Security is enabled and that no policy lets anonymous (anon) users read private data. Add owner-based policies (auth.uid()) where they're missing, and tell me which tables are intentionally public.`
+      },
+      reverify: { check: "supabase-rls-read" }
+    });
+  }
+  findings.push(...rpcFindings(conn, dedupeNames([...rpcFunctions, ...harvestedRpc])));
+  return findings;
+}
+async function probeAuthConfig(ctx, conn) {
+  const findings = [];
+  let res;
+  try {
+    res = await ctx.http(conn.url.replace(/\/+$/, "") + "/auth/v1/settings", {
+      method: "GET",
+      headers: authHeaders(conn)
+    });
+  } catch {
+    return findings;
+  }
+  if (res.status >= 400) return findings;
+  let cfg;
+  try {
+    cfg = JSON.parse(res.text);
+  } catch {
+    return findings;
+  }
+  if (cfg["mailer_autoconfirm"] === true || cfg["autoconfirm"] === true) {
+    findings.push({
+      id: "auth:autoconfirm",
+      category: "auth",
+      severity: "medium",
+      confidence: "proven",
+      title: "Email confirmation is disabled",
+      description: "New accounts are auto-confirmed without verifying the email address. Anyone can sign up as any email they don't own, which enables spoofing and spam.",
+      location: conn.url + "/auth/v1/settings",
+      proof: { summary: "auth settings report mailer_autoconfirm = true." },
+      fix: {
+        steps: [
+          "In Supabase \u2192 Authentication \u2192 Providers \u2192 Email, turn ON 'Confirm email'."
+        ],
+        aiPrompt: "Enable email confirmation for signups in my Supabase project so accounts must verify their email before they are active."
+      },
+      reverify: { check: "supabase-auth-config" }
+    });
+  }
+  return findings;
+}
+async function probeStorage(ctx, conn) {
+  const findings = [];
+  let res;
+  try {
+    res = await ctx.http(conn.url.replace(/\/+$/, "") + "/storage/v1/bucket", {
+      method: "GET",
+      headers: authHeaders(conn)
+    });
+  } catch {
+    return findings;
+  }
+  if (res.status >= 400) return findings;
+  let buckets;
+  try {
+    buckets = JSON.parse(res.text);
+  } catch {
+    return findings;
+  }
+  if (!Array.isArray(buckets)) return findings;
+  for (const b of buckets) {
+    if (b && typeof b === "object" && b["public"] === true) {
+      const name = String(b["name"] ?? "unknown");
+      findings.push({
+        id: `storage:${name}`,
+        category: "storage",
+        severity: "high",
+        confidence: "proven",
+        title: `Storage bucket "${name}" is public`,
+        description: `Anyone can access every file in the "${name}" storage bucket. The bucket is marked public, so its files are readable by anyone who knows or guesses an object path.`,
+        location: conn.url + "/storage/v1/bucket",
+        proof: { summary: `Bucket "${name}" listed anonymously with public=true.` },
+        fix: {
+          steps: [
+            `In Supabase \u2192 Storage, set the "${name}" bucket to Private unless it is truly meant to serve public assets, and add access policies.`
+          ],
+          aiPrompt: `Make the Supabase storage bucket "${name}" private and add storage policies so only authorized users can read their own files.`
+        },
+        reverify: { check: "supabase-storage", target: name }
+      });
+    }
+  }
+  return findings;
+}
+
+// ../engine/src/checks/headers.ts
+function get(headers, name) {
+  const lower = name.toLowerCase();
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === lower) return v;
+  }
+  return void 0;
+}
+function headerFindings(input) {
+  const findings = [];
+  const h = input.headers;
+  const acao = get(h, "access-control-allow-origin");
+  const acac = get(h, "access-control-allow-credentials");
+  if (acao === "*" && acac?.toLowerCase() === "true") {
+    findings.push({
+      id: "headers:cors-wildcard-credentials",
+      category: "headers",
+      severity: "high",
+      confidence: "proven",
+      title: "CORS allows any origin with credentials",
+      description: "The server returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true. Browsers block this exact combo, but if the origin is instead reflected per-request it lets any website make authenticated requests as your logged-in users.",
+      location: input.url,
+      proof: { summary: "Response sent ACAO: * with ACAC: true." },
+      fix: {
+        steps: [
+          "Never combine a wildcard/reflected origin with credentials. Allow-list the specific origins that may send credentialed requests."
+        ],
+        aiPrompt: "Security fix: my server returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true. Change the CORS config so credentialed requests are only allowed from an explicit list of my own origins, and never reflect or wildcard the origin when credentials are enabled."
+      },
+      reverify: { check: "headers" }
+    });
+  }
+  if (!get(h, "content-security-policy")) {
+    findings.push({
+      id: "headers:no-csp",
+      category: "headers",
+      severity: "low",
+      confidence: "info",
+      title: "No Content-Security-Policy header",
+      description: "A Content-Security-Policy meaningfully reduces the impact of cross-site scripting (XSS) by controlling what scripts can run. None was set.",
+      location: input.url,
+      proof: { summary: "No content-security-policy header in the response." },
+      fix: {
+        steps: [
+          "Add a Content-Security-Policy header. Start in report-only mode, then tighten script-src to your own origin and required CDNs."
+        ],
+        aiPrompt: "Add a Content-Security-Policy header to every response of my app. First list every external domain the app loads scripts, styles, images, fonts and API calls from, then set a policy that allows only my own origin plus those domains. Start with Content-Security-Policy-Report-Only so nothing breaks, and tell me how to switch it to enforcing once no violations show up."
+      },
+      reverify: { check: "headers" }
+    });
+  }
+  if (!get(h, "strict-transport-security")) {
+    findings.push({
+      id: "headers:no-hsts",
+      category: "headers",
+      severity: "low",
+      confidence: "info",
+      title: "No HSTS header",
+      description: "Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade and cookie-interception attacks. It was not set.",
+      location: input.url,
+      proof: { summary: "No strict-transport-security header in the response." },
+      fix: {
+        steps: [
+          "Add Strict-Transport-Security: max-age=63072000; includeSubDomains once you are confident everything is served over HTTPS."
+        ],
+        aiPrompt: "Add the header Strict-Transport-Security: max-age=63072000; includeSubDomains to every response of my app, but only after confirming every page, API and asset (including subdomains) is served over HTTPS."
+      },
+      reverify: { check: "headers" }
+    });
+  }
+  const xfo = get(h, "x-frame-options");
+  const csp = get(h, "content-security-policy");
+  const hasFrameAncestors = !!csp && /frame-ancestors/i.test(csp);
+  if (!xfo && !hasFrameAncestors) {
+    findings.push({
+      id: "headers:clickjacking",
+      category: "headers",
+      severity: "low",
+      confidence: "info",
+      title: "No clickjacking protection",
+      description: "Neither X-Frame-Options nor a Content-Security-Policy frame-ancestors directive is set, so your site can be embedded in an invisible iframe on another site and tricked into accepting clicks meant for something else (clickjacking).",
+      location: input.url,
+      proof: { summary: "No x-frame-options header and no frame-ancestors in the CSP." },
+      fix: {
+        steps: [
+          "Add X-Frame-Options: DENY (or SAMEORIGIN), or a CSP with frame-ancestors 'none' (or 'self')."
+        ],
+        aiPrompt: "Add clickjacking protection to every response of my app: either the header X-Frame-Options: DENY, or a Content-Security-Policy with frame-ancestors 'none' (use 'self' instead if the app legitimately needs to be embedded on its own domain)."
+      },
+      reverify: { check: "headers" }
+    });
+  }
+  findings.push(...cookieFindings(input.url, input.setCookie));
+  return findings;
+}
+function cookieFindings(url, setCookie) {
+  if (!setCookie || setCookie.length === 0) return [];
+  const isHttps = url.startsWith("https:");
+  const flagged = [];
+  for (const raw of setCookie) {
+    const name = raw.split("=")[0]?.trim();
+    if (!name) continue;
+    const missing = [];
+    if (isHttps && !/;\s*secure\b/i.test(raw)) missing.push("Secure");
+    if (!/;\s*httponly\b/i.test(raw)) missing.push("HttpOnly");
+    if (!/;\s*samesite\s*=/i.test(raw)) missing.push("SameSite");
+    if (missing.length > 0) flagged.push(`${name} (missing ${missing.join(", ")})`);
+  }
+  if (flagged.length === 0) return [];
+  return [
+    {
+      id: "headers:cookie-flags",
+      category: "headers",
+      severity: "low",
+      confidence: "proven",
+      title: "Cookies missing security flags",
+      description: "Your app sets cookies without all the recommended security attributes. Without Secure, HttpOnly, and SameSite, a cookie is more exposed to interception on the network, theft via a cross-site scripting bug, or being sent along with a forged cross-site request.",
+      location: url,
+      proof: { summary: `Cookie(s) with missing flags: ${flagged.join("; ")}.` },
+      fix: {
+        steps: [
+          "Set Secure, HttpOnly, and SameSite=Lax (or Strict) on every cookie your server sets."
+        ],
+        aiPrompt: "Add the Secure, HttpOnly, and SameSite=Lax attributes to every cookie my server sets (session/auth cookies especially), so they can't be read by JavaScript, aren't sent over plain HTTP, and aren't sent along with unrelated cross-site requests."
+      },
+      reverify: { check: "headers-cookies" }
+    }
+  ];
+}
+async function checkHttpDowngrade(ctx, targetUrl) {
+  let target;
+  try {
+    target = new URL(targetUrl);
+  } catch {
+    return null;
+  }
+  if (target.protocol !== "https:") return null;
+  const httpUrl = `http://${target.host}/`;
+  let res;
+  try {
+    res = await ctx.http(httpUrl, { method: "GET", redirect: "manual" });
+  } catch {
+    return null;
+  }
+  const location = get(res.headers, "location");
+  const redirectsToHttps = res.status >= 300 && res.status < 400 && !!location && location.toLowerCase().startsWith("https:");
+  if (redirectsToHttps) return null;
+  return {
+    id: "headers:http-not-upgraded",
+    category: "headers",
+    severity: "low",
+    confidence: "proven",
+    title: "HTTP does not redirect to HTTPS",
+    description: "Requesting the plain http:// address of your site does not redirect to https://. Anyone who types the address without 'https', or follows an old http:// link, stays on an unencrypted connection where traffic \u2014 including session cookies \u2014 can be intercepted.",
+    location: httpUrl,
+    proof: {
+      summary: `GET ${httpUrl} returned status ${res.status}` + (location ? ` with Location: ${location}` : ", no redirect to https.")
+    },
+    fix: {
+      steps: [
+        "Configure your host/CDN/reverse proxy to redirect every http:// request to the https:// equivalent (301), then add an HSTS header."
+      ],
+      aiPrompt: "Make sure every http:// request to my domain is redirected (301) to the https:// version at the hosting/CDN/reverse-proxy level, before any app code runs, and add a Strict-Transport-Security header once that's confirmed working."
+    },
+    reverify: { check: "headers-http-downgrade" }
+  };
+}
+
+// ../engine/src/checks/sourcemaps.ts
+var MAX_BUNDLES_TO_CHECK = 5;
+function sameOrigin2(a, b) {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
+function extractSourceMappingUrl(jsText) {
+  const re = /\/[/*][@#]\s*sourceMappingURL=([^\s*]+)/g;
+  let last = null;
+  let m;
+  while ((m = re.exec(jsText)) !== null) {
+    const raw = m[1];
+    if (raw && !raw.startsWith("data:")) last = raw;
+  }
+  return last;
+}
+function looksLikeSourceMap(text) {
+  if (!text || text.length < 2) return false;
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    return false;
+  }
+  if (typeof doc !== "object" || doc === null) return false;
+  const d = doc;
+  return "mappings" in d || Array.isArray(d["sources"]);
+}
+async function sourceMapFindings(ctx, scripts) {
+  const findings = [];
+  for (const script of scripts.slice(0, MAX_BUNDLES_TO_CHECK)) {
+    const linked = extractSourceMappingUrl(script.text);
+    let mapUrl;
+    try {
+      mapUrl = linked ? new URL(linked, script.url).toString() : new URL(script.url + ".map").toString();
+    } catch {
+      continue;
+    }
+    if (!sameOrigin2(mapUrl, script.url)) continue;
+    let res;
+    try {
+      res = await ctx.http(mapUrl, { method: "GET" });
+    } catch {
+      continue;
+    }
+    if (res.status < 200 || res.status >= 300) continue;
+    if (res.text.length > ctx.maxBytesPerAsset) continue;
+    if (!looksLikeSourceMap(res.text)) continue;
+    findings.push({
+      id: `sourcemap:${script.url}`,
+      category: "config",
+      severity: "medium",
+      confidence: "proven",
+      title: "Your original source code is public",
+      description: "A source map for one of your JS bundles is publicly served. Source maps let anyone reconstruct your original, unminified source code \u2014 variable names, file structure, comments \u2014 straight from the browser dev tools, not just the compiled output.",
+      location: mapUrl,
+      proof: { summary: `GET ${mapUrl} returned a source map for ${script.url}.` },
+      fix: {
+        steps: [
+          "Disable source maps in production builds (Vite: build.sourcemap: false; Next.js: productionBrowserSourceMaps: false \u2014 the default), or make sure .map files are excluded from the deployed output. If you need maps for your own error tracking, upload them privately to that provider instead."
+        ],
+        aiPrompt: "My production build is serving JavaScript source maps (.map files) publicly, which exposes my original source code. Disable source maps in production (Vite: build.sourcemap: false, Next.js: productionBrowserSourceMaps: false), or make sure .map files are excluded from the deployed output, then redeploy."
+      },
+      reverify: { check: "sourcemap-exposure", target: script.url }
+    });
+    let doc;
+    try {
+      doc = JSON.parse(res.text);
+    } catch {
+      doc = null;
+    }
+    const sourcesContent = doc && typeof doc === "object" ? doc["sourcesContent"] : null;
+    if (Array.isArray(sourcesContent)) {
+      const combined = sourcesContent.filter((s) => typeof s === "string").join("\n");
+      findings.push(...secretFindings(extractSecrets(combined), mapUrl));
+    }
+    break;
+  }
+  return findings;
+}
+
+// ../engine/src/checks/configFiles.ts
+var CANDIDATE_PATHS = ["/.env", "/.env.local", "/.env.production", "/.git/config"];
+function looksLikeHtml(text) {
+  return /<html[\s>]|<!doctype\s+html/i.test(text.slice(0, 500));
+}
+function envVarNames(text) {
+  const names = [];
+  for (const line of text.split(/\r?\n/)) {
+    const m = /^([A-Z][A-Z0-9_]*)=/.exec(line.trim());
+    if (m?.[1]) names.push(m[1]);
+  }
+  return names;
+}
+function looksLikeDotenv(text) {
+  if (looksLikeHtml(text)) return false;
+  return envVarNames(text).length > 0;
+}
+function looksLikeGitConfig(text) {
+  if (looksLikeHtml(text)) return false;
+  return /\[core\]/.test(text);
+}
+function configFinding(path, url, summary, description) {
+  return {
+    id: `config:${path}`,
+    category: "config",
+    severity: "critical",
+    confidence: "proven",
+    title: `${path} is publicly readable`,
+    description,
+    location: url,
+    proof: { summary },
+    fix: {
+      steps: [
+        `Remove ${path} from your deployed output (exclude it in your build config, and/or block dotfiles at the host/CDN level), then rotate anything it exposed.`
+      ],
+      aiPrompt: `My deployed app is serving ${path} publicly. Make sure this file is never included in the production build/deploy output (exclude it in the build config and/or block dotfiles at the host/CDN level), and confirm the path returns 404 after redeploy. I will rotate any exposed secrets myself.`
+    },
+    reverify: { check: "config-exposure", target: path }
+  };
+}
+async function configFileFindings(ctx, pageUrl) {
+  const findings = [];
+  let origin;
+  try {
+    origin = new URL(pageUrl).origin;
+  } catch {
+    return findings;
+  }
+  for (const path of CANDIDATE_PATHS) {
+    const url = origin + path;
+    let res;
+    try {
+      res = await ctx.http(url, { method: "GET" });
+    } catch {
+      continue;
+    }
+    if (res.status < 200 || res.status >= 300) continue;
+    if (res.text.length > ctx.maxBytesPerAsset) continue;
+    const isEnv = path.startsWith("/.env");
+    if (isEnv && looksLikeDotenv(res.text)) {
+      const names = envVarNames(res.text);
+      const includingPhrase = names.length > 0 ? `: ${names.join(", ")}` : "";
+      findings.push(
+        configFinding(
+          path,
+          url,
+          `GET ${url} returned a plaintext env file defining: ${names.join(", ") || "(no variable names parsed)"}.`,
+          `Anyone can download ${path} and see ${names.length} secret variable name${names.length === 1 ? "" : "s"}${includingPhrase}. This environment file typically holds database URLs, API keys, and other secrets, all readable by anyone on the internet, no login required.`
+        )
+      );
+      findings.push(...secretFindings(extractSecrets(res.text), url));
+    } else if (!isEnv && looksLikeGitConfig(res.text)) {
+      findings.push(
+        configFinding(
+          path,
+          url,
+          `GET ${url} returned a git config file (contains a [core] section).`,
+          "Your app serves its .git/config file publicly. Combined with other exposed git internals this can let someone reconstruct your repository, including commit history and any secrets ever committed to it."
+        )
+      );
+      findings.push(...secretFindings(extractSecrets(res.text), url));
+    }
+  }
+  return findings;
+}
+
+// ../engine/src/checks/firebase.ts
+var MAX_COLLECTION_PROBES = 20;
+var PROJECT_ID_RE = /["']?projectId["']?\s*:\s*["']([^"']{1,80})["']/;
+var DATABASE_URL_RE = /["']?databaseURL["']?\s*:\s*["'](https:\/\/[^"']{1,120})["']/i;
+var STORAGE_BUCKET_RE = /["']?storageBucket["']?\s*:\s*["']([^"']{1,100})["']/;
+var API_KEY_RE = /["']?apiKey["']?\s*:\s*["']([^"']{1,100})["']/;
+var PROJECT_ID_VALID = /^[a-z0-9-]{4,40}$/;
+var RTDB_HOST_VALID = /^[a-z0-9-]{3,63}\.firebaseio\.com$|^[a-z0-9-]{3,63}\.[a-z0-9-]{1,30}\.firebasedatabase\.app$/;
+var BUCKET_VALID = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]\.appspot\.com$|^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]\.firebasestorage\.app$/;
+var API_KEY_VALID = /^[A-Za-z0-9_-]{10,100}$/;
+function extractFirebaseConfig(text) {
+  const config = {};
+  const projectId = PROJECT_ID_RE.exec(text)?.[1];
+  if (projectId && PROJECT_ID_VALID.test(projectId)) config.projectId = projectId;
+  const dbUrlRaw = DATABASE_URL_RE.exec(text)?.[1];
+  if (dbUrlRaw) {
+    try {
+      const u = new URL(dbUrlRaw);
+      if (u.protocol === "https:" && RTDB_HOST_VALID.test(u.hostname)) {
+        config.databaseURL = `https://${u.hostname}`;
+      }
+    } catch {
+    }
+  }
+  const bucket = STORAGE_BUCKET_RE.exec(text)?.[1];
+  if (bucket && BUCKET_VALID.test(bucket)) config.storageBucket = bucket;
+  const apiKey = API_KEY_RE.exec(text)?.[1];
+  if (apiKey && API_KEY_VALID.test(apiKey)) config.apiKey = apiKey;
+  const hasAny = config.projectId || config.databaseURL || config.storageBucket || config.apiKey;
+  return hasAny ? config : null;
+}
+function rtdbShallowUrl(databaseURL) {
+  return databaseURL.replace(/\/+$/, "") + "/.json?shallow=true";
+}
+function rtdbRulesSnippet() {
+  return [
+    `{`,
+    `  "rules": {`,
+    `    ".read": "auth != null",`,
+    `    ".write": "auth != null"`,
+    `  }`,
+    `}`,
+    ``,
+    `// Better: scope each branch to its owner, e.g. for a /users/$uid tree:`,
+    `// "users": { "$uid": { ".read": "auth != null && auth.uid == $uid", ".write": "auth != null && auth.uid == $uid" } }`
+  ].join("\n");
+}
+function rtdbAiPrompt() {
+  return "Security fix: my Firebase Realtime Database has no rules restricting reads, so anyone on the internet can read the entire database with no login. In the Firebase Console, go to Realtime Database \u2192 Rules and replace the rules so reads and writes require authentication, then scope each branch to its owner (match auth.uid() to the record's owner field) instead of allowing any signed-in user to read everything.";
+}
+async function probeRealtimeDatabase(ctx, databaseURL) {
+  const url = rtdbShallowUrl(databaseURL);
+  let res;
+  try {
+    res = await ctx.http(url, { method: "GET" });
+  } catch {
+    return [];
+  }
+  if (res.status === 401 || res.status === 403) return [];
+  if (res.status < 200 || res.status >= 300) return [];
+  if (res.text.length > ctx.maxBytesPerAsset) return [];
+  let data;
+  try {
+    data = JSON.parse(res.text);
+  } catch {
+    return [];
+  }
+  if (data === null) {
+    return [
+      {
+        id: "firebase-rtdb:reachable-empty",
+        category: "rls",
+        severity: "low",
+        confidence: "info",
+        title: "Realtime Database is reachable but currently empty",
+        description: "Your Firebase Realtime Database has no rules blocking anonymous reads \u2014 we could query its root with no login \u2014 but it currently holds no data. This is not proof of a leak, but confirm rules require authentication before you store anything in it.",
+        location: url,
+        proof: { summary: `GET ${url} returned 200 with an empty (null) database.` },
+        fix: { steps: [rtdbRulesSnippet()], aiPrompt: rtdbAiPrompt() },
+        reverify: { check: "firebase-rtdb-read" }
+      }
+    ];
+  }
+  const keys = typeof data === "object" && !Array.isArray(data) ? Object.keys(data).slice(0, 10) : [];
+  const includingPhrase = keys.length > 0 ? `, including ${keys.join(", ")}` : "";
+  return [
+    {
+      id: "firebase-rtdb:readable",
+      category: "rls",
+      severity: "critical",
+      confidence: "proven",
+      title: "Your Realtime Database is readable by anyone",
+      description: `Anyone can read your entire Firebase Realtime Database${includingPhrase}. This works with no login, because its security rules don't require authentication. We only listed top-level key names to prove this \u2014 we did not read any data.`,
+      location: url,
+      proof: {
+        summary: `GET ${url} returned 200 with a readable database.` + (keys.length > 0 ? ` Top-level keys: ${keys.join(", ")}.` : "")
+      },
+      fix: { steps: [rtdbRulesSnippet()], aiPrompt: rtdbAiPrompt() },
+      reverify: { check: "firebase-rtdb-read" }
+    }
+  ];
+}
+var FIRESTORE_COLLECTION_WORDLIST = [
+  "users",
+  "profiles",
+  "orders",
+  "payments",
+  "messages",
+  "posts",
+  "customers",
+  "accounts",
+  "subscriptions",
+  "invoices"
+];
+function firestoreLocation(projectId, collection) {
+  return `https://firestore.googleapis.com/v1/projects/${encodeURIComponent(projectId)}/databases/(default)/documents/${encodeURIComponent(collection)}`;
+}
+function firestoreRequestUrl(projectId, collection, apiKey) {
+  const base = firestoreLocation(projectId, collection) + "?pageSize=1";
+  return apiKey ? `${base}&key=${encodeURIComponent(apiKey)}` : base;
+}
+function firestoreRulesSnippet(collection) {
+  return [
+    `rules_version = '2';`,
+    `service cloud.firestore {`,
+    `  match /databases/{database}/documents {`,
+    `    match /${collection}/{docId} {`,
+    `      allow read, write: if request.auth != null && request.auth.uid == resource.data.ownerId;`,
+    `    }`,
+    `  }`,
+    `}`
+  ].join("\n");
+}
+function firestoreAiPrompt(collection) {
+  return `Security fix: my Firestore collection "${collection}" is readable by anyone with no login, because its security rules don't restrict access. In the Firebase Console, go to Firestore Database \u2192 Rules and add a rule for "${collection}" that only allows a document's owner to read or write it (match request.auth.uid to the document's owner field, e.g. ownerId), and denies everyone else, including other signed-in users.`;
+}
+async function probeFirestore(ctx, projectId, apiKey, harvestedCollections = []) {
+  const findings = [];
+  const reachableEmpty = [];
+  const harvestedSet = new Set(harvestedCollections);
+  const candidates = dedupeNames([
+    ...harvestedCollections,
+    ...FIRESTORE_COLLECTION_WORDLIST
+  ]).slice(0, MAX_COLLECTION_PROBES);
+  for (const collection of candidates) {
+    let res;
+    try {
+      res = await ctx.http(firestoreRequestUrl(projectId, collection, apiKey), { method: "GET" });
+    } catch {
+      continue;
+    }
+    if (res.status < 200 || res.status >= 300) continue;
+    if (res.text.length > ctx.maxBytesPerAsset) continue;
+    let body;
+    try {
+      body = JSON.parse(res.text);
+    } catch {
+      continue;
+    }
+    const documents = body && typeof body === "object" ? body["documents"] : void 0;
+    if (!Array.isArray(documents) || documents.length === 0) {
+      reachableEmpty.push(collection);
+      continue;
+    }
+    const first = documents[0];
+    const fields = first && typeof first === "object" ? first["fields"] : void 0;
+    const fieldNames = fields && typeof fields === "object" ? Object.keys(fields) : [];
+    const sensitive = sensitiveColumns(fieldNames);
+    const sensitivePhrase = sensitive.length > 0 ? ` It exposes fields: ${sensitive.join(", ")}.` : "";
+    const fromCodePhrase = harvestedSet.has(collection) ? " \u2014 a collection name found in your app's code" : "";
+    const includingPhrase = sensitive.length > 0 ? `, including ${sensitive.join(", ")}` : "";
+    const impact = `Anyone can read documents from \`${collection}\`${includingPhrase}.`;
+    findings.push({
+      id: `firebase-firestore:${collection}`,
+      category: "rls",
+      severity: "critical",
+      confidence: "proven",
+      title: `Firestore collection "${collection}" is readable by anyone`,
+      description: `${impact} Using only your app's public Firebase config, an anonymous user can read documents from the "${collection}" collection${fromCodePhrase} with no login, because its security rules don't restrict reads.${sensitivePhrase}`,
+      location: firestoreLocation(projectId, collection),
+      proof: {
+        summary: `Read 1 document from "${collection}" anonymously via the Firestore REST API.` + (fieldNames.length > 0 ? ` Fields present: ${fieldNames.join(", ")}.` : ""),
+        evidence: fieldNames.length > 0 ? `Fields exposed: ${fieldNames.join(", ")}` : void 0
+      },
+      fix: { steps: [firestoreRulesSnippet(collection)], aiPrompt: firestoreAiPrompt(collection) },
+      reverify: { check: "firebase-firestore-read", target: collection }
+    });
+  }
+  if (reachableEmpty.length > 0) {
+    findings.push({
+      id: "firebase-firestore:reachable-empty",
+      category: "rls",
+      severity: "low",
+      confidence: "info",
+      title: `${reachableEmpty.length} Firestore collection(s) reachable by anonymous users (no documents returned)`,
+      description: "These Firestore collections can be queried with no login but returned no documents \u2014 either their rules correctly block anonymous reads, or they're empty. This is NOT proof of exposure, but confirm the rules are intentional on each: " + reachableEmpty.join(", ") + ".",
+      location: `https://firestore.googleapis.com/v1/projects/${encodeURIComponent(projectId)}/databases/(default)/documents`,
+      proof: {
+        summary: `Anonymous query returned 200 with 0 documents for: ${reachableEmpty.join(", ")}.`
+      },
+      fix: {
+        steps: [
+          "For each collection, confirm in Firebase Console \u2192 Firestore Database \u2192 Rules that reads require request.auth != null and are scoped to the document owner."
+        ],
+        aiPrompt: `Check these Firestore collections in my app: ${reachableEmpty.join(", ")}. For each, make sure the security rules require authentication and only let a document's owner read or write it, and tell me which are intentionally public.`
+      },
+      reverify: { check: "firebase-firestore-read" }
+    });
+  }
+  return findings;
+}
+function storageListUrl(bucket) {
+  return `https://firebasestorage.googleapis.com/v0/b/${encodeURIComponent(bucket)}/o?maxResults=5`;
+}
+function storageRulesSnippet() {
+  return [
+    `rules_version = '2';`,
+    `service firebase.storage {`,
+    `  match /b/{bucket}/o {`,
+    `    match /{allPaths=**} {`,
+    `      allow read, write: if request.auth != null && request.auth.uid == resource.metadata.ownerId;`,
+    `    }`,
+    `  }`,
+    `}`
+  ].join("\n");
+}
+function storageAiPrompt() {
+  return "Security fix: my Firebase Storage bucket lets anyone list its files with no login, because its security rules don't restrict access. In the Firebase Console, go to Storage \u2192 Rules and require request.auth != null for read/write, scoped so each user can only access their own files (e.g. match auth.uid to an owner path or metadata field).";
+}
+async function probeFirebaseStorage(ctx, bucket) {
+  const url = storageListUrl(bucket);
+  let res;
+  try {
+    res = await ctx.http(url, { method: "GET" });
+  } catch {
+    return [];
+  }
+  if (res.status === 401 || res.status === 403) return [];
+  if (res.status < 200 || res.status >= 300) return [];
+  if (res.text.length > ctx.maxBytesPerAsset) return [];
+  let body;
+  try {
+    body = JSON.parse(res.text);
+  } catch {
+    return [];
+  }
+  const items = body && typeof body === "object" ? body["items"] : void 0;
+  if (!Array.isArray(items) || items.length === 0) return [];
+  const names = items.map((i) => i && typeof i === "object" ? i["name"] : void 0).filter((n) => typeof n === "string").slice(0, 5);
+  const countPhrase = items.length >= 5 ? "at least 5 files" : `${items.length} file${items.length === 1 ? "" : "s"}`;
+  return [
+    {
+      id: "firebase-storage:public-listing",
+      category: "storage",
+      severity: "high",
+      confidence: "proven",
+      title: "Your Firebase Storage files can be listed by anyone",
+      description: `Anyone can list ${countPhrase} in your Firebase Storage bucket. This works with no login, because its security rules don't restrict access. We only listed file names to prove this \u2014 we did not download any file contents.`,
+      location: storageListUrl(bucket).split("?")[0],
+      proof: {
+        summary: `Listed ${items.length} object(s) anonymously.` + (names.length > 0 ? ` Names: ${names.join(", ")}.` : "")
+      },
+      fix: { steps: [storageRulesSnippet()], aiPrompt: storageAiPrompt() },
+      reverify: { check: "firebase-storage-list" }
+    }
+  ];
+}
+
+// ../engine/src/checks/libraries.ts
+var KNOWN_LIBS = {
+  react: "react",
+  "react-dom": "react-dom",
+  jquery: "jquery",
+  lodash: "lodash",
+  "lodash-es": "lodash-es",
+  axios: "axios",
+  moment: "moment",
+  "moment.js": "moment",
+  vue: "vue",
+  "vue.js": "vue",
+  express: "express",
+  "socket.io": "socket.io",
+  d3: "d3",
+  "chart.js": "chart.js",
+  bootstrap: "bootstrap",
+  preact: "preact",
+  svelte: "svelte",
+  next: "next",
+  "next.js": "next",
+  dayjs: "dayjs",
+  underscore: "underscore"
+};
+var MAX_PACKAGES = 20;
+var OSV_URL = "https://api.osv.dev/v1/querybatch";
+function normalizeName(raw) {
+  return KNOWN_LIBS[raw.trim().toLowerCase()] ?? null;
+}
+function collect(source, text, location, out, seen) {
+  const re = new RegExp(source.source, source.flags);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const rawName = m[1];
+    const version = m[2];
+    if (!rawName || !version) continue;
+    const name = normalizeName(rawName);
+    if (!name) continue;
+    const key = `${name}@${version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ name, version, location });
+  }
+}
+var BANG_BANNER_RE = /\/\*!\s*([A-Za-z][\w.\/-]{1,30})\s+(?:JavaScript Library\s+)?v(\d+\.\d+\.\d+)/g;
+var LICENSE_RE = /@license\s+([A-Za-z][\w.\/-]{1,30})\s+v?(\d+\.\d+\.\d+)/g;
+function detectLibraries(scripts) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const script of scripts) {
+    collect(BANG_BANNER_RE, script.text, script.url, out, seen);
+    collect(LICENSE_RE, script.text, script.url, out, seen);
+    if (out.length >= MAX_PACKAGES) break;
+  }
+  return out.slice(0, MAX_PACKAGES);
+}
+function mapSeverity(vuln) {
+  const raw = vuln.database_specific?.severity;
+  if (typeof raw === "string") {
+    const s = raw.toUpperCase();
+    if (s === "CRITICAL") return "critical";
+    if (s === "HIGH") return "high";
+    if (s === "MODERATE" || s === "MEDIUM") return "medium";
+    if (s === "LOW") return "low";
+  }
+  return "medium";
+}
+function fixedVersionFor(pkgName, vuln) {
+  for (const affected of vuln.affected ?? []) {
+    if (affected.package?.name !== pkgName) continue;
+    for (const range of affected.ranges ?? []) {
+      for (const event of range.events ?? []) {
+        if (event.fixed) return event.fixed;
+      }
+    }
+  }
+  return null;
+}
+function libraryFinding(lib, vulns) {
+  const top = vulns.slice(0, 3);
+  const ids = top.map((v) => v.id).filter((id) => !!id);
+  let severity = "medium";
+  for (const v of vulns) {
+    const s = mapSeverity(v);
+    if (SEVERITY_RANK[s] > SEVERITY_RANK[severity]) severity = s;
+  }
+  const fixed = top.map((v) => fixedVersionFor(lib.name, v)).find((f) => !!f) ?? null;
+  const firstSummary = top.find((v) => typeof v.summary === "string")?.summary;
+  const countPhrase = `${vulns.length} known vulnerabilit${vulns.length === 1 ? "y" : "ies"}`;
+  return {
+    id: `dependency:${lib.name}@${lib.version}`,
+    category: "dependency",
+    severity,
+    confidence: "proven",
+    title: `${lib.name} ${lib.version} has known vulnerabilities`,
+    description: `Anyone can see your app ships ${lib.name} ${lib.version} in its public JS, which has ${countPhrase} on record` + (firstSummary ? `: ${firstSummary}` : "."),
+    location: lib.location,
+    proof: {
+      summary: `Detected ${lib.name} v${lib.version} from a preserved license banner in the shipped JS; OSV lists: ${ids.join(", ") || "(advisory ids unavailable)"}.`
+    },
+    fix: {
+      steps: [
+        fixed ? `Upgrade ${lib.name} to ${fixed} or later.` : `Upgrade ${lib.name} past ${lib.version} \u2014 check the advisories above for the fixed version.`
+      ],
+      aiPrompt: `My app uses ${lib.name} version ${lib.version}, which has known security vulnerabilities (${ids.join(", ") || "see OSV"}). Upgrade it${fixed ? ` to ${fixed} or later` : ""} and check the changelog/release notes for breaking changes before deploying.`
+    },
+    reverify: { check: "dependency-osv", target: `${lib.name}@${lib.version}` }
+  };
+}
+async function queryOsv(ctx, libs) {
+  if (libs.length === 0) return { findings: [] };
+  const capped = libs.slice(0, MAX_PACKAGES);
+  const queries = capped.map((l) => ({ package: { name: l.name, ecosystem: "npm" }, version: l.version }));
+  let res;
+  try {
+    res = await ctx.http(OSV_URL, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ queries })
+    });
+  } catch {
+    return { findings: [], note: "OSV vulnerability lookup failed (network error) \u2014 skipped." };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    return { findings: [], note: `OSV vulnerability lookup returned ${res.status} \u2014 skipped.` };
+  }
+  let body;
+  try {
+    body = JSON.parse(res.text);
+  } catch {
+    return { findings: [], note: "OSV vulnerability lookup returned an unreadable response \u2014 skipped." };
+  }
+  const results = body?.results;
+  if (!Array.isArray(results)) return { findings: [] };
+  const findings = [];
+  results.forEach((entry, i) => {
+    const lib = capped[i];
+    if (!lib) return;
+    const vulns = entry?.vulns;
+    if (!Array.isArray(vulns) || vulns.length === 0) return;
+    findings.push(libraryFinding(lib, vulns));
+  });
+  return { findings };
+}
+
+// ../engine/src/checks/endpoints.ts
+var MAX_ENDPOINTS = 50;
+var FETCH_RE = /\bfetch\(\s*["'`](\/[A-Za-z0-9_\-./]{1,200})["'`]/g;
+var METHOD_CALL_RE = /\.(?:get|post|put|patch|delete)\(\s*["'`](\/[A-Za-z0-9_\-./]{1,200})["'`]/g;
+var URL_KEY_RE = /\burl\s*:\s*["'`](\/[A-Za-z0-9_\-./]{1,200})["'`]/g;
+var API_PATH_LITERAL_RE = /["'`](\/api\/[A-Za-z0-9_\-./]{0,200})["'`]/g;
+var FUNCTIONS_INVOKE_RE = /\.functions\.invoke\(\s*["'`]([A-Za-z0-9_-]{1,80})["'`]/g;
+function isValidPath(p) {
+  return p.startsWith("/") && !p.includes("..") && !/\s/.test(p) && p.length <= 200;
+}
+function fresh(re) {
+  return new RegExp(re.source, re.flags);
+}
+function harvestEndpoints(text) {
+  const out = /* @__PURE__ */ new Set();
+  for (const re of [FETCH_RE, METHOD_CALL_RE, URL_KEY_RE, API_PATH_LITERAL_RE]) {
+    const r = fresh(re);
+    let m2;
+    while ((m2 = r.exec(text)) !== null) {
+      const p = m2[1];
+      if (p && isValidPath(p)) out.add(p);
+    }
+  }
+  const invokeRe = fresh(FUNCTIONS_INVOKE_RE);
+  let m;
+  while ((m = invokeRe.exec(text)) !== null) {
+    const name = m[1];
+    if (name) out.add(`functions/${name}`);
+  }
+  return [...out].slice(0, MAX_ENDPOINTS);
+}
+function endpointFindings(endpoints) {
+  if (endpoints.length === 0) return [];
+  const list = endpoints.slice(0, MAX_ENDPOINTS);
+  const plural = list.length === 1 ? "" : "s";
+  return [
+    {
+      id: "endpoints:list",
+      category: "config",
+      severity: "low",
+      confidence: "info",
+      title: `Your app calls ${list.length} API endpoint${plural}`,
+      description: `Your app's code calls ${list.length} endpoint${plural}. We only listed them here \u2014 we did not call any of them. Every one of these must check who is calling it, since each is reachable by anyone on the internet, not only through your app's own UI. Our AI Red Team (coming soon) will test them for real authorization gaps.`,
+      location: "client code",
+      proof: { summary: `Endpoints referenced in client code: ${list.join(", ")}.` },
+      fix: {
+        steps: [
+          "For each endpoint listed, confirm it checks authentication/authorization on the server side \u2014 never trust a check that only happens in the browser."
+        ],
+        aiPrompt: `My app's frontend calls these API endpoints: ${list.join(", ")}. For each one, review the server-side handler and confirm it verifies the caller is authenticated and authorized for that specific action/data before doing anything, never trusting a check that only happens in frontend code.`
+      },
+      reverify: { check: "endpoints-list" }
+    }
+  ];
+}
+
+// ../engine/src/engine.ts
+function sortFindings(findings) {
+  return [...findings].sort(
+    (a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]
+  );
+}
+function dedupe(findings) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const f of findings) {
+    if (seen.has(f.id)) continue;
+    seen.add(f.id);
+    out.push(f);
+  }
+  return out;
+}
+async function scan(ctx, target, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  const startedAt = now();
+  const findings = [];
+  const notes = [];
+  const app = await fetchApp(ctx, target.url);
+  notes.push(...app.notes);
+  ctx.log(
+    `Fetched page (status ${app.finalStatus}) + ${app.scriptsFetched.length} script(s).`
+  );
+  const hits = extractSecrets(app.combinedSource);
+  findings.push(...secretFindings(hits, target.url));
+  const harvestedTables = harvestSupabaseTableNames(app.combinedSource);
+  const harvestedRpc = harvestSupabaseRpcNames(app.combinedSource);
+  const harvestedCollections = harvestFirestoreCollectionNames(app.combinedSource);
+  const conn = getSupabaseConnection(hits);
+  if (conn) {
+    ctx.log(`Supabase detected at ${conn.url} \u2014 running read-only RLS sweep.`);
+    findings.push(...await probeRls(ctx, conn, harvestedTables, harvestedRpc));
+    findings.push(...await probeStorage(ctx, conn));
+    findings.push(...await probeAuthConfig(ctx, conn));
+  } else {
+    notes.push("No Supabase anon connection found in client code.");
+  }
+  const fbConfig = extractFirebaseConfig(app.combinedSource);
+  if (fbConfig) {
+    ctx.log("Firebase config detected \u2014 running read-only rules sweep.");
+    if (fbConfig.databaseURL) {
+      findings.push(...await probeRealtimeDatabase(ctx, fbConfig.databaseURL));
+    }
+    if (fbConfig.projectId) {
+      findings.push(
+        ...await probeFirestore(ctx, fbConfig.projectId, fbConfig.apiKey, harvestedCollections)
+      );
+    }
+    if (fbConfig.storageBucket) {
+      findings.push(...await probeFirebaseStorage(ctx, fbConfig.storageBucket));
+    }
+  } else {
+    notes.push("No Firebase config found in client code.");
+  }
+  if (target.local) {
+    notes.push("Local scan: skipped headers, HTTPS, source maps and exposed files. Those depend on your host, so scan the deployed URL for them.");
+  } else {
+    findings.push(
+      ...headerFindings({ url: target.url, headers: app.headers, setCookie: app.setCookie })
+    );
+    const downgrade = await checkHttpDowngrade(ctx, target.url);
+    if (downgrade) findings.push(downgrade);
+    findings.push(...await sourceMapFindings(ctx, app.scripts));
+    findings.push(...await configFileFindings(ctx, target.url));
+  }
+  const detectedLibs = detectLibraries(app.scripts);
+  if (detectedLibs.length > 0) {
+    const { findings: libFindings, note } = await queryOsv(ctx, detectedLibs);
+    findings.push(...libFindings);
+    if (note) notes.push(note);
+  }
+  const endpoints = harvestEndpoints(app.combinedSource);
+  findings.push(...endpointFindings(endpoints));
+  const deduped = sortFindings(dedupe(findings));
+  return {
+    target,
+    startedAt,
+    finishedAt: now(),
+    findings: deduped,
+    notes,
+    worst: worstSeverity(deduped),
+    endpoints
+  };
+}
+
+// ../engine/src/report.ts
+var COLOR = {
+  critical: "\x1B[41m\x1B[97m",
+  high: "\x1B[31m",
+  medium: "\x1B[33m",
+  low: "\x1B[36m",
+  info: "\x1B[90m"
+};
+var RESET = "\x1B[0m";
+var BOLD = "\x1B[1m";
+function countBySeverity(findings) {
+  const c = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of findings) c[f.severity]++;
+  return c;
+}
+function renderTerminal(result, opts = {}) {
+  const color = opts.color ?? true;
+  const paint = (s, sev) => color ? `${COLOR[sev]}${s}${RESET}` : s;
+  const b = (s) => color ? `${BOLD}${s}${RESET}` : s;
+  const lines = [];
+  lines.push("");
+  lines.push(b(`  Shippable scan \u2014 ${result.target.url}`));
+  lines.push(`  ${result.startedAt}`);
+  lines.push("");
+  if (result.findings.length === 0) {
+    lines.push("  \u2713 No issues found. (A shallow pass finding nothing is not a guarantee.)");
+  } else {
+    const c = countBySeverity(result.findings);
+    const summary = ["critical", "high", "medium", "low", "info"].filter((s) => c[s]).map((s) => paint(` ${c[s]} ${s} `, s)).join(" ");
+    lines.push(`  ${summary}`);
+    lines.push("");
+    for (const f of result.findings) {
+      lines.push(`  ${paint(` ${f.severity.toUpperCase()} `, f.severity)} ${b(f.title)}`);
+      lines.push(`     ${f.description}`);
+      lines.push(`     ${b("Proof:")} ${f.proof.summary}`);
+      if (f.proof.evidence) lines.push(`     ${f.proof.evidence}`);
+      if (f.fix.sql) {
+        lines.push(`     ${b("Fix (SQL):")}`);
+        for (const l of f.fix.sql.split("\n")) lines.push(`       ${l}`);
+      }
+      if (f.fix.aiPrompt) {
+        lines.push(`     ${b("Fix (paste into your AI tool):")}`);
+        lines.push(`       ${f.fix.aiPrompt}`);
+      }
+      if (f.fix.steps) {
+        lines.push(`     ${b("Fix:")}`);
+        for (const s of f.fix.steps) lines.push(`       \u2022 ${s}`);
+      }
+      lines.push("");
+    }
+  }
+  if (result.notes.length) {
+    lines.push(b("  Notes:"));
+    for (const n of result.notes) lines.push(`     - ${n}`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// ../engine/src/http.ts
+var MAX_REDIRECTS = 5;
+function createHttpClient(opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 15e3;
+  const maxBytes = opts.maxBytes ?? 5e6;
+  const userAgent = opts.userAgent ?? "Shippable-Scanner/0.1 (+https://shippable.example)";
+  return async (url, init) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      let current = url;
+      let res;
+      for (let hop = 0; ; hop++) {
+        if (opts.isAllowed && !await opts.isAllowed(current)) {
+          throw new Error(`Blocked request to disallowed address: ${new URL(current).host}`);
+        }
+        res = await fetch(current, {
+          method: init?.method ?? "GET",
+          headers: { "user-agent": userAgent, ...init?.headers ?? {} },
+          body: init?.body,
+          redirect: "manual",
+          signal: controller.signal
+        });
+        const location = res.headers.get("location");
+        const isRedirect = res.status >= 300 && res.status < 400 && location;
+        if (!isRedirect || init?.redirect === "manual") break;
+        if (hop >= MAX_REDIRECTS) throw new Error("Too many redirects.");
+        await res.body?.cancel();
+        current = new URL(location, current).toString();
+      }
+      const headers = {};
+      res.headers.forEach((v, k) => {
+        headers[k.toLowerCase()] = v;
+      });
+      const reader = res.body?.getReader();
+      let text = "";
+      if (reader) {
+        const decoder = new TextDecoder();
+        let total = 0;
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          total += value.byteLength;
+          text += decoder.decode(value, { stream: true });
+          if (total >= maxBytes) {
+            await reader.cancel();
+            break;
+          }
+        }
+        text += decoder.decode();
+      } else {
+        text = await res.text();
+      }
+      const setCookie = res.headers.getSetCookie ? res.headers.getSetCookie() : [];
+      return { status: res.status, headers, text, setCookie };
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+}
+
+// ../engine/src/demo.ts
+function b64url(obj) {
+  return Buffer.from(JSON.stringify(obj), "utf8").toString("base64url");
+}
+var anonKey = `${b64url({ alg: "HS256", typ: "JWT" })}.${b64url({
+  role: "anon",
+  iss: "supabase",
+  ref: "demoproject0000000000"
+})}.c2lnbmF0dXJlZm9yZGVtb29ubHk`;
+var DEMO_URL = "https://demo-vuln-app.lovable.app";
+var PAGE = `<!doctype html><html><head>
+  <title>My Startup</title>
+  <script src="/assets/index-demo.js"></script>
+</head><body><div id="root"></div></body></html>`;
+var BUNDLE = `
+  /*! react-dom v16.0.0 */
+  var SUPABASE_URL = "https://demoproject0000000000.supabase.co";
+  var SUPABASE_ANON_KEY = "${anonKey}";
+  var STRIPE_SECRET = "sk_live_51DEMOabcdefghijklmnopqrst";
+  var supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
+  var firebaseConfig = {projectId:"demo-firebase-app",databaseURL:"https://demo-firebase-app.firebaseio.com",storageBucket:"demo-firebase-app.appspot.com",apiKey:"AIzaSyDEMOFIREBASEKEY0000000000000"};
+  fetch("/api/checkout", { method: "POST" });
+  fetch("/api/admin/export-users");
+  supabase.functions.invoke("send-receipt");
+  // The billing screen is lazy-loaded \u2014 its own chunk is only fetched by the
+  // browser once a user navigates there, so it never appears above.
+  import("./chunk-billing-demo.js");
+  //# sourceMappingURL=index-demo.js.map
+`;
+var OSV_RESPONSE = JSON.stringify({
+  results: [
+    {
+      vulns: [
+        {
+          id: "GHSA-demo-0001",
+          summary: "Demo advisory: a cross-site-scripting issue fixed in a later release.",
+          database_specific: { severity: "HIGH" },
+          affected: [
+            {
+              package: { name: "react-dom", ecosystem: "npm" },
+              ranges: [{ type: "SEMVER", events: [{ introduced: "0" }, { fixed: "16.0.1" }] }]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+});
+var LAZY_CHUNK = `
+  var s2 = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
+  s2.from("invoices").select("*");
+  var BILLING_PROVIDER_KEY = "sk_live_51DEMOCHUNKabcdefghijklmnopqr";
+`;
+var SOURCE_MAP = JSON.stringify({
+  version: 3,
+  sources: ["src/App.tsx"],
+  sourcesContent: ["const key = 'sk_live_51DEMOMAPLEAKabcdefghijklmno';"],
+  mappings: "AAAA"
+});
+var DOTENV = "DATABASE_URL=postgres://user:pass@host:5432/db\nSTRIPE_SECRET_KEY=sk_live_51DEMOENVabcdefghijklmnop\n";
+var OPENAPI = JSON.stringify({
+  definitions: { users: {}, orders: {}, waitlist: {} },
+  paths: { "/": {}, "/users": {}, "/orders": {}, "/waitlist": {}, "/rpc/reset_password": {} }
+});
+function demoHttpClient() {
+  const routes = [
+    // More specific needles must come before the generic "lovable.app" catch-all below,
+    // since routes are matched in order by substring.
+    ["/assets/index-demo.js.map", { status: 200, headers: {}, text: SOURCE_MAP }],
+    ["/assets/index-demo.js", { status: 200, headers: {}, text: BUNDLE }],
+    ["/assets/chunk-billing-demo.js", { status: 200, headers: {}, text: LAZY_CHUNK }],
+    ["/.env", { status: 200, headers: {}, text: DOTENV }],
+    [
+      "/rest/v1/invoices",
+      {
+        status: 200,
+        headers: { "content-range": "0-0/312" },
+        text: '[{"id":1,"customer_email":"jane@example.com","amount_cents":4900}]'
+      }
+    ],
+    [
+      "/rest/v1/users",
+      {
+        status: 200,
+        headers: { "content-range": "0-2/1284" },
+        text: '[{"id":1,"email":"jane@example.com","full_name":"Jane Doe","stripe_customer":"cus_x"},{"id":2,"email":"bob@example.com","full_name":"Bob Roe","stripe_customer":"cus_y"}]'
+      }
+    ],
+    [
+      "/rest/v1/orders",
+      {
+        status: 200,
+        headers: { "content-range": "0-2/57" },
+        text: '[{"id":1,"user_email":"jane@example.com","amount_cents":4900,"card_last4":"4242"}]'
+      }
+    ],
+    ["/rest/v1/waitlist", { status: 200, headers: {}, text: "[]" }],
+    // properly locked
+    ["/rest/v1/", { status: 200, headers: {}, text: OPENAPI }],
+    [
+      "/storage/v1/bucket",
+      { status: 200, headers: {}, text: '[{"name":"user-uploads","public":true}]' }
+    ],
+    ["/auth/v1/settings", { status: 200, headers: {}, text: '{"mailer_autoconfirm":true}' }],
+    // Firebase Realtime Database: no rules restricting reads — readable by anyone.
+    ["firebaseio.com/.json", { status: 200, headers: {}, text: '{"users":true,"config":true}' }],
+    // Firestore + Storage rules are locked down in this demo, so only the RTDB
+    // finding fires — keeps the demo output focused on one Firebase issue.
+    ["firestore.googleapis.com", { status: 403, headers: {}, text: '{"error":{"status":"PERMISSION_DENIED"}}' }],
+    ["firebasestorage.googleapis.com", { status: 403, headers: {}, text: '{"error":{"code":403}}' }],
+    ["api.osv.dev", { status: 200, headers: {}, text: OSV_RESPONSE }],
+    [
+      "lovable.app",
+      { status: 200, headers: {}, text: PAGE, setCookie: ["session=demo-token; Path=/"] }
+    ]
+  ];
+  return async (url) => {
+    for (const [needle, r] of routes) if (url.includes(needle)) return r;
+    return { status: 404, headers: {}, text: "" };
+  };
+}
+
+// ../engine/src/verify.ts
+import { randomBytes } from "node:crypto";
+var META_NAME = "shippable-site-verification";
+function generateToken() {
+  return "sv_" + randomBytes(24).toString("hex");
+}
+function verificationTagFor(token) {
+  return `<meta name="${META_NAME}" content="${token}">`;
+}
+function verificationPromptFor(token) {
+  return `Add this exact meta tag inside the <head> of my app's HTML and redeploy:
+
+${verificationTagFor(token)}
+
+Do not change the name or content values.`;
+}
+function htmlContainsToken(html, token) {
+  const metaRe = /<meta\b[^>]*>/gi;
+  let m;
+  while ((m = metaRe.exec(html)) !== null) {
+    const tag = m[0];
+    const nameMatch = /name\s*=\s*["']([^"']+)["']/i.exec(tag);
+    const contentMatch = /content\s*=\s*["']([^"']+)["']/i.exec(tag);
+    if (nameMatch?.[1]?.toLowerCase() === META_NAME && contentMatch?.[1] === token) {
+      return true;
+    }
+  }
+  return false;
+}
+async function verifyOwnership(ctx, url, token) {
+  let res;
+  try {
+    res = await ctx.http(url, { method: "GET" });
+  } catch {
+    return { verified: false, reason: "Could not reach the site." };
+  }
+  if (res.status >= 400) {
+    return { verified: false, reason: `Site returned status ${res.status}.` };
+  }
+  if (htmlContainsToken(res.text, token)) {
+    return { verified: true, reason: "Verification tag found." };
+  }
+  return {
+    verified: false,
+    reason: "Verification tag not found. Add it to your <head> and redeploy."
+  };
+}
+
+// ../engine/src/target.ts
+function isLocalHost(hostname) {
+  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return h === "localhost" || h.endsWith(".localhost") || h === "::1" || h === "0.0.0.0" || /^127\.\d+\.\d+\.\d+$/.test(h);
+}
+function parseTarget(input) {
+  const bare = !/^https?:\/\//i.test(input);
+  try {
+    const u = new URL(bare ? `https://${input}` : input);
+    if (bare && isLocalHost(u.hostname)) u.protocol = "http:";
+    return u;
+  } catch {
+    return null;
+  }
+}
+var LOCAL_SCAN_BACKENDS = /(^|\.)(supabase\.co|supabase\.in|firebaseio\.com|firebasedatabase\.app)$|^(firebasestorage\.googleapis\.com|firestore\.googleapis\.com|api\.osv\.dev)$/;
+function localScanAllows(url) {
+  try {
+    const host = new URL(url).hostname;
+    return isLocalHost(host) || LOCAL_SCAN_BACKENDS.test(host.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
+// ../engine/src/cli.ts
+function makeCtx(http, verbose) {
+  return {
+    http,
+    readOnly: true,
+    maxBytesPerAsset: 5e6,
+    log: (m) => {
+      if (verbose) console.error(`  \xB7 ${m}`);
+    }
+  };
+}
+var TOKENS_FILE = join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "shippable", "tokens.json");
+async function tokenFor(host) {
+  let tokens = {};
+  try {
+    tokens = JSON.parse(await readFile(TOKENS_FILE, "utf8"));
+  } catch {
+  }
+  if (tokens[host]) return tokens[host];
+  tokens[host] = generateToken();
+  await mkdir(join(TOKENS_FILE, ".."), { recursive: true });
+  await writeFile(TOKENS_FILE, JSON.stringify(tokens, null, 2) + "\n", { mode: 384 });
+  return tokens[host];
+}
+async function main() {
+  const [cmd, ...rest] = process.argv.slice(2);
+  const verbose = rest.includes("--verbose") || rest.includes("-v");
+  switch (cmd) {
+    case "demo": {
+      const result = await scan(makeCtx(demoHttpClient(), verbose), { url: DEMO_URL });
+      console.log(renderTerminal(result));
+      return 0;
+    }
+    case "scan": {
+      const input = rest.find((a) => !a.startsWith("-"));
+      const target = input ? parseTarget(input) : null;
+      if (!target) {
+        console.error("usage: shippable scan <url>   e.g. shippable scan localhost:5173");
+        return 2;
+      }
+      const local = isLocalHost(target.hostname);
+      const http = createHttpClient({
+        userAgent: "Shippable-CLI/0.1 (+https://shippable.dev)",
+        isAllowed: local ? async (u) => localScanAllows(u) : void 0
+      });
+      const ctx = makeCtx(http, verbose);
+      if (!local) {
+        const token = await tokenFor(target.host);
+        const v = await verifyOwnership(ctx, target.origin, token);
+        if (!v.verified) {
+          console.log(`
+  First, prove you own ${target.host}. ${v.reason}
+`);
+          console.log("  Paste this into your AI tool (Lovable, Bolt, Cursor\u2026):\n");
+          for (const line of verificationPromptFor(token).split("\n")) console.log("    " + line);
+          console.log(`
+  Once it's deployed, run this again: shippable scan ${target.origin}
+`);
+          return 2;
+        }
+      }
+      const result = await scan(ctx, { url: target.toString(), local });
+      console.log(renderTerminal(result));
+      return result.worst === "critical" || result.worst === "high" ? 1 : 0;
+    }
+    default:
+      console.log(
+        "\n  Shippable: find the leaks in your AI-built app before someone else does.\n\n    shippable scan localhost:5173      scan your dev server before you push\n    shippable scan https://myapp.com   scan your live app (asks you to verify ownership once)\n    shippable demo                     see a scan of a deliberately leaky test app\n\n  Read-only: we look, never change anything. https://shippable.dev\n"
+      );
+      return cmd ? 1 : 0;
+  }
+}
+main().then(
+  (code) => process.exit(code),
+  (err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    const off = /^Blocked request to disallowed address: (.+)$/.exec(msg);
+    console.error(
+      off ? `
+  Local scans stay on your machine, but this one tried to reach ${off[1]}.
+  To scan a live site, run: shippable scan https://${off[1]}
+` : `Fatal: ${msg}`
+    );
+    process.exit(1);
+  }
+);
+/**
+ * Outdated-library detection + OSV lookup.
+ *
+ * Detection is deliberately conservative: minifiers strip ordinary comments
+ * but preserve "banner" comments (`/*! ... *\/` or anything containing
+ * `@license`), which is exactly why a name+version pulled from one of those
+ * banners is trustworthy — it's the library author's own declared version,
+ * not a guess. We only trust a banner whose library name is in our small
+ * known-library allowlist (KNOWN_LIBS); anything else is skipped rather than
+ * reported, because a wrong version turns into a false vulnerability claim,
+ * which is worse than saying nothing.
+ *
+ * The one OSV request is the sole exception to this scanner's "GET the
+ * target only" rule: a single POST to api.osv.dev (our own lookup, never the
+ * scanned app) batching every detected package. Routed through ctx.http like
+ * every other request, so it's still bound by the same timeout and the
+ * production SSRF allowlist.
+ */
+// `@license lodash 4.17.20`, `@license Chart.js v4.4.0`.