shippingszn 0.1.0 → 0.3.0

package/dist/checks/headers.js

@@ -7,48 +7,104 @@ const SECURITY_HEADER_NAMES = [
     "X-Frame-Options",
     "Referrer-Policy",
 ];
+const CANDIDATE_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".mts",
+    ".cts",
+    ".json",
+    ".toml",
+]);
+const CANDIDATE_BASENAMES = new Set([
+    "vite.config.ts",
+    "vite.config.js",
+    "vite.config.mjs",
+    "vite.config.cjs",
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.ts",
+    "nuxt.config.ts",
+    "svelte.config.js",
+    "astro.config.mjs",
+    "astro.config.ts",
+    "vercel.json",
+    "netlify.toml",
+]);
+// Directories whose files commonly define server / middleware / route /
+// header code. We scan every eligible file under these trees, not just a
+// single "entry" file, so hand-rolled security-header middleware (e.g.
+// a dedicated server/security.ts) is detected just as reliably as helmet().
+const CANDIDATE_DIR_SEGMENTS = [
+    "server/",
+    "api/",
+    "backend/",
+    "middleware/",
+    "middlewares/",
+    "lib/server/",
+    "src/server/",
+    "src/api/",
+    "src/middleware/",
+    "src/middlewares/",
+    "apps/server/",
+    "apps/api/",
+    "packages/server/",
+    "packages/api/",
+    "artifacts/server/",
+    "artifacts/api-server/",
+];
+function isCandidateFile(relPath) {
+    const lower = relPath.replace(/\\/g, "/").toLowerCase();
+    if (lower.includes("/node_modules/") ||
+        lower.includes("/dist/") ||
+        lower.includes("/build/") ||
+        lower.includes("/.next/") ||
+        lower.endsWith(".test.ts") ||
+        lower.endsWith(".spec.ts") ||
+        lower.endsWith(".test.tsx") ||
+        lower.endsWith(".spec.tsx") ||
+        lower.endsWith(".test.js") ||
+        lower.endsWith(".spec.js")) {
+        return false;
+    }
+    const base = path.basename(lower);
+    if (CANDIDATE_BASENAMES.has(base))
+        return true;
+    const ext = path.extname(lower);
+    if (!CANDIDATE_EXTENSIONS.has(ext))
+        return false;
+    if (/\b(?:server|index|app|main|bootstrap|middleware|security)\.(?:t|j|m|c)?sx?$/.test(base)) {
+        return true;
+    }
+    for (const seg of CANDIDATE_DIR_SEGMENTS) {
+        if (lower.includes("/" + seg) || lower.startsWith(seg))
+            return true;
+    }
+    return false;
+}
 export async function checkSecurityHeaders(ctx) {
-    const candidateFiles = ctx.files.filter((f) => {
-        const rp = f.relPath.toLowerCase();
-        if (rp.endsWith(".test.ts") || rp.endsWith(".spec.ts"))
-            return false;
-        return (rp.endsWith("vite.config.ts") ||
-            rp.endsWith("vite.config.js") ||
-            rp.endsWith("next.config.js") ||
-            rp.endsWith("next.config.mjs") ||
-            rp.endsWith("next.config.ts") ||
-            rp.endsWith("nuxt.config.ts") ||
-            rp.endsWith("svelte.config.js") ||
-            rp.endsWith("astro.config.mjs") ||
-            rp.endsWith("astro.config.ts") ||
-            rp.endsWith("vercel.json") ||
-            rp.endsWith("netlify.toml") ||
-            /server\/index\.(t|j)s$/.test(rp) ||
-            /^server\.(t|j)s$/.test(path.basename(rp)) ||
-            /\bapp\.(t|j)s$/.test(rp) ||
-            /\bindex\.(t|j)s$/.test(rp));
-    });
-    if (candidateFiles.length === 0)
+    const candidates = ctx.files.filter((f) => isCandidateFile(f.relPath));
+    if (candidates.length === 0)
         return [];
-    let foundAny = false;
-    for (const file of candidateFiles) {
+    for (const file of candidates) {
         const content = await readFileSafe(file);
         if (!content)
             continue;
+        const lower = content.toLowerCase();
         for (const h of SECURITY_HEADER_NAMES) {
-            if (content.toLowerCase().includes(h.toLowerCase())) {
-                foundAny = true;
-                break;
-            }
+            if (lower.includes(h.toLowerCase()))
+                return [];
         }
-        if (content.includes("helmet(") || content.includes('require("helmet")') || content.includes('from "helmet"')) {
-            foundAny = true;
+        if (lower.includes("helmet(") ||
+            lower.includes('require("helmet")') ||
+            lower.includes('from "helmet"') ||
+            lower.includes("from 'helmet'")) {
+            return [];
         }
-        if (foundAny)
-            break;
     }
-    if (foundAny)
-        return [];
     return [
         {
             checkId: "missing-security-headers",

package/dist/index.js

@@ -2,10 +2,35 @@
 import * as path from "node:path";
 import * as process from "node:process";
 import { ALL_CHECKS } from "./checks.js";
-import { listFiles } from "./scan.js";
+import { listFiles, getTrackedFiles } from "./scan.js";
 import { CHECKLIST_ITEMS, permalinkFor } from "./items.js";
+const UNTRACKED_DOWNGRADE = {
+    critical: "lower",
+    high: "lower",
+    medium: "lower",
+    lower: "lower",
+};
+const UNTRACKED_SUFFIX = " (Note: this file is not tracked in git — it can't leak through a repo push, so severity is softened. If you ever commit it or ship it in a public artifact, re-scan.)";
+function applyTrackingAwareSeverity(findings, tracked) {
+    if (!tracked)
+        return findings;
+    return findings.map((f) => {
+        if (!f.file)
+            return f;
+        if (tracked.has(f.file))
+            return f;
+        const nextSeverity = UNTRACKED_DOWNGRADE[f.severity];
+        if (nextSeverity === f.severity)
+            return f;
+        return {
+            ...f,
+            severity: nextSeverity,
+            message: f.message + UNTRACKED_SUFFIX,
+        };
+    });
+}
 const DEFAULT_BASE_URL = "https://shippingszn.com";
-const PKG_VERSION = "0.1.0";
+const PKG_VERSION = "0.3.0";
 function parseArgs(argv) {
     const opts = {
         cwd: process.cwd(),
@@ -89,6 +114,7 @@ async function run() {
     }
     const c = color(!opts.noColor && process.stdout.isTTY === true && !opts.json);
     const files = await listFiles(opts.cwd);
+    const tracked = getTrackedFiles(opts.cwd);
     const ctx = { rootDir: opts.cwd, files };
     const all = [];
     for (const check of ALL_CHECKS) {
@@ -106,7 +132,8 @@ async function run() {
             });
         }
     }
-    const enriched = all.map((f) => {
+    const tracked_aware = applyTrackingAwareSeverity(all, tracked);
+    const enriched = tracked_aware.map((f) => {
         const item = CHECKLIST_ITEMS[f.itemId];
         return {
             ...f,

package/dist/scan.js

@@ -1,5 +1,26 @@
 import { promises as fs } from "node:fs";
 import * as path from "node:path";
+import { spawnSync } from "node:child_process";
+/**
+ * Ask git for the list of tracked files. Returns null when the directory
+ * isn't a git work tree (or git isn't available) — callers treat that as
+ * "don't know, assume tracked" so we never weaken a finding's severity
+ * on a non-git project.
+ */
+export function getTrackedFiles(rootDir) {
+    const result = spawnSync("git", ["-C", rootDir, "ls-files", "-z"], {
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.status !== 0 || !result.stdout)
+        return null;
+    const out = new Set();
+    for (const rel of result.stdout.split("\0")) {
+        if (rel)
+            out.add(rel);
+    }
+    return out;
+}
 const DEFAULT_IGNORES = new Set([
     "node_modules",
     ".git",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",