shipped-secrets 1.0.0 → 1.0.1

package/README.md

@@ -22,7 +22,7 @@ Secrets are always masked in the output. Nothing is sent anywhere unless you ask
 
 ## What it checks
 
-1. **Your real secret values.** It reads your `.env*` files (not `.env.example`), Cloudflare's `.dev.vars`, and in CI the environment variables whose names look secret. Then it searches every file the browser gets, source maps included, for each server value. This catches any secret, whatever it looks like, including your own tokens that no pattern knows.
+1. **Your real secret values.** It reads your `.env*` files (not `.env.example`), Cloudflare's `.dev.vars`, and in CI the environment variables whose names look secret. Then it searches every file the browser gets, source maps included, for each server value. This catches any secret, whatever it looks like, including your own tokens that no pattern knows. It also looks for each value in base64 (standard and URL-safe, with or without padding), so a key put through `btoa()` on its way into the bundle is still found.
 2. **Known key shapes**, for keys that are not in your local files: Stripe secret and restricted keys, Supabase service_role keys and `sb_secret_` keys, OpenAI, Anthropic, AWS, GitHub, SendGrid, Mailgun, Resend, Twilio, Slack, private keys, and database URLs with a password. Google API keys are a warning, because Maps and Firebase browser keys are meant to be public.
 3. **Supabase keys are decoded.** The anon key and the service_role key look the same. `shipped-secrets` reads the role inside the key, so the anon key is never reported and the service_role key always is.
 4. **Risky names.** A public prefix on a name that sounds secret (`VITE_STRIPE_SECRET`, `NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY`) is a warning. Names meant for browsers (anon key, publishable key, client ID, client token, site key) are not.
@@ -115,6 +115,7 @@ Checked: Stripe (`/v1/balance`), OpenAI and Anthropic (list models), GitHub (`/u
 
 ## What it does not do
 
+- It does not find a secret that was split into pieces, encrypted, or encoded some other way before it reached the bundle. It matches the exact value, its base64 forms and the known key shapes.
 - It does not fix anything. A shipped or committed secret must be rotated at the provider: deleting it from the code, or rewriting history, does not take it back from anyone who already has it.
 - `--verify` does not check AWS, Twilio, private keys or database URLs: checking those safely needs more than one harmless call.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipped-secrets",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Find secrets that ship to the browser or sit in git history, and check whether they still work: your real .env values, known key shapes and risky public env names, in any framework's build output, source maps included.",
   "type": "module",
   "exports": {

package/src/history.js

@@ -7,7 +7,7 @@ import { spawn } from 'node:child_process'
 import { createInterface } from 'node:readline'
 import { findShapes, withKey } from './shapes.js'
 import { isSecretLine, mask, parseDotenv } from './env.js'
-import { keyOf } from './scan.js'
+import { forms, keyOf } from './scan.js'
 
 const ENV_FILE = /(^|\/)(\.env(\.[^/]*)?|\.dev\.vars)$/
 const SAFE_ENV = /\.(example|sample|template|dist|defaults)$/i
@@ -70,8 +70,10 @@ export function scanHistory(root, secrets = []) {
         return
       }
       for (const s of secrets) {
-        if (added.includes(s.value)) {
-          add(keyOf({ level: 'error', kind: 'history-value', file, line, commit: commit.slice(0, 8), date, what: `${s.name} was committed in ${file} (${commit.slice(0, 8)}, ${date})`, sample: mask(s.value) }, s.value))
+        for (const { text: form, how } of forms(s.value)) {
+          if (added.includes(form)) {
+            add(keyOf({ level: 'error', kind: 'history-value', file, line, commit: commit.slice(0, 8), date, what: `${s.name}${how ? ` (${how.slice(2)})` : ''} was committed in ${file} (${commit.slice(0, 8)}, ${date})`, sample: mask(s.value) }, s.value))
+          }
         }
       }
       for (const f of findShapes(added)) {

package/src/scan.js

@@ -73,14 +73,27 @@ export function keyOf(finding, value) {
   return shape && shape.match === value ? withKey(Object.assign(finding, { shapeId: shape.shape.id }), value) : finding
 }
 
+/**
+ * The value as written, and base64 of it, so a key put through btoa() or
+ * Buffer.toString('base64') on its way into the bundle is still found. The
+ * padding is dropped, so it matches with or without the trailing "=".
+ */
+export function forms(value) {
+  const b64 = Buffer.from(value, 'utf8').toString('base64').replace(/=+$/, '')
+  const url = b64.replace(/\+/g, '-').replace(/\//g, '_')
+  return [{ text: value, how: '' }, { text: b64, how: ', base64' }, ...(url !== b64 ? [{ text: url, how: ', base64url' }] : [])]
+}
+
 export function scanText(text, secrets) {
   const found = []
   for (const s of secrets) {
-    let at = text.indexOf(s.value)
-    while (at !== -1) {
-      found.push(keyOf({ level: 'error', kind: 'value', what: `${s.name} from ${s.source.split(/[\\/]/).pop()}`, sample: mask(s.value), line: lineAt(text, at) }, s.value))
-      at = text.indexOf(s.value, at + s.value.length)
-      if (found.length > 50) break
+    for (const { text: form, how } of forms(s.value)) {
+      let at = text.indexOf(form)
+      while (at !== -1) {
+        found.push(keyOf({ level: 'error', kind: 'value', what: `${s.name} from ${s.source.split(/[\\/]/).pop()}${how}`, sample: mask(s.value), line: lineAt(text, at) }, s.value))
+        at = text.indexOf(form, at + form.length)
+        if (found.length > 50) break
+      }
     }
   }
   for (const f of findShapes(text)) {