shippingszn 0.1.0

package/dist/checks/language.js

@@ -0,0 +1,275 @@
+import * as path from "node:path";
+import { isTextFile, readFileSafe } from "../scan.js";
+import { findLine, relPosix } from "./helpers.js";
+const PYTHON_PATTERNS = [
+    {
+        id: "py-pickle-loads",
+        regex: /\bpickle\s*\.\s*loads?\s*\(/,
+        itemId: "common-attacks",
+        severity: "high",
+        message: "Use of pickle.loads / pickle.load — deserializing pickle data from untrusted sources allows arbitrary code execution. Use json or another safe format.",
+    },
+    {
+        id: "py-subprocess-shell-true",
+        regex: /\bshell\s*=\s*True\b/,
+        itemId: "common-attacks",
+        severity: "high",
+        message: "subprocess call with shell=True — if any argument is user-controlled this is a shell injection. Pass an argv list instead.",
+    },
+    {
+        id: "py-flask-debug-true",
+        regex: /\.run\s*\([^)]*\bdebug\s*=\s*True/,
+        itemId: "dev-prod-data",
+        severity: "high",
+        message: "Flask app.run(debug=True) — Werkzeug's debugger exposes a remote Python shell. Never enable this in production; gate on an env var.",
+    },
+    {
+        id: "py-django-debug-true",
+        regex: /^\s*DEBUG\s*=\s*True\b/m,
+        itemId: "dev-prod-data",
+        severity: "high",
+        message: "Django DEBUG = True at module scope — leaks stack traces, settings, and SQL to anyone who hits an error page in production. Read it from an env var.",
+    },
+    {
+        id: "py-hardcoded-secret-key",
+        regex: /^\s*SECRET_KEY\s*=\s*['"][^'"\n]{8,}['"]/m,
+        itemId: "secrets",
+        severity: "critical",
+        message: "Hardcoded SECRET_KEY in a Django/Flask settings file. Load it from os.environ / os.getenv instead and keep the real value out of source control.",
+    },
+];
+const RUBY_PATTERNS = [
+    {
+        id: "rb-eval",
+        regex: /(^|[^A-Za-z0-9_])eval\s*\(/,
+        itemId: "common-attacks",
+        severity: "high",
+        message: "Use of eval in Ruby — executes arbitrary code and is almost always avoidable. Replace with safer alternatives like send, public_send, or a hash lookup.",
+    },
+    {
+        id: "rb-html-safe",
+        regex: /\.html_safe\b/,
+        itemId: "common-attacks",
+        severity: "medium",
+        message: "Call to .html_safe in Ruby/Rails — bypasses ERB's automatic HTML escaping. Make sure the string isn't user-controlled or you'll have an XSS hole.",
+    },
+    {
+        id: "rb-hardcoded-secret-key-base",
+        regex: /^\s*secret_key_base\s*:\s*['"]?[A-Za-z0-9]{16,}['"]?/m,
+        itemId: "secrets",
+        severity: "critical",
+        message: "Hardcoded secret_key_base in a Rails config/credentials file. Move it to ENV['SECRET_KEY_BASE'] or Rails' encrypted credentials.",
+    },
+];
+const GO_PATTERNS = [
+    {
+        id: "go-listen-and-serve-no-tls",
+        regex: /\bhttp\s*\.\s*ListenAndServe\s*\(/,
+        itemId: "https-headers",
+        severity: "high",
+        message: "http.ListenAndServe — serves plain HTTP with no TLS. Use http.ListenAndServeTLS, terminate TLS at a proxy, or run behind a managed host that does.",
+    },
+    {
+        id: "go-hardcoded-token-literal",
+        regex: /\b(?:token|apiKey|api_key|secret)\s*(?::=|=)\s*"[A-Za-z0-9_\-]{20,}"/i,
+        itemId: "secrets",
+        severity: "high",
+        message: "Hardcoded token/secret literal in Go source. Read it from os.Getenv or a secret manager instead of compiling it into the binary.",
+    },
+];
+const RAILS_YAML_PATTERNS = [
+    RUBY_PATTERNS.find((p) => p.id === "rb-hardcoded-secret-key-base"),
+];
+const LANG_PATTERN_SETS = [
+    { exts: [".py"], patterns: PYTHON_PATTERNS },
+    { exts: [".rb", ".erb"], patterns: RUBY_PATTERNS },
+    { exts: [".yml", ".yaml"], patterns: RAILS_YAML_PATTERNS },
+    { exts: [".go"], patterns: GO_PATTERNS },
+];
+export async function checkLanguagePatterns(ctx) {
+    const findings = [];
+    for (const file of ctx.files) {
+        if (!isTextFile(file))
+            continue;
+        const ext = path.extname(file.relPath).toLowerCase();
+        const set = LANG_PATTERN_SETS.find((s) => s.exts.includes(ext));
+        if (!set)
+            continue;
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        for (const pat of set.patterns) {
+            const m = pat.regex.exec(content);
+            if (!m)
+                continue;
+            const line = findLine(content, m.index);
+            findings.push({
+                checkId: pat.id,
+                itemId: pat.itemId,
+                severity: pat.severity,
+                message: pat.message,
+                file: relPosix(file.relPath),
+                line,
+            });
+        }
+    }
+    return findings;
+}
+function isPythonSettingsLike(relPath, content) {
+    const base = path.basename(relPath).toLowerCase();
+    if (base === "settings.py" || base === "config.py" || base === "app.py" || base === "wsgi.py" || base === "asgi.py") {
+        return true;
+    }
+    if (/\bfrom\s+django\b/.test(content) || /\bimport\s+django\b/.test(content))
+        return true;
+    if (/\bfrom\s+flask\s+import\b/.test(content) || /\bFlask\s*\(/.test(content))
+        return true;
+    return false;
+}
+function pythonReadsSecretKeyFromEnv(content) {
+    const envRefs = [
+        /SECRET_KEY\s*=\s*os\.environ(?:\.get)?\b/,
+        /SECRET_KEY\s*=\s*os\.getenv\b/,
+        /SECRET_KEY\s*=\s*environ(?:\.get)?\b/,
+        /SECRET_KEY\s*=\s*getenv\b/,
+        /SECRET_KEY\s*=\s*config\s*\(/,
+        /SECRET_KEY\s*=\s*decouple\.config\s*\(/,
+        /SECRET_KEY\s*=\s*env\s*\(/,
+        /SECRET_KEY\s*=\s*env\.str\s*\(/,
+        /app\.config\[\s*['"]SECRET_KEY['"]\s*\]\s*=\s*os\.(?:environ|getenv)\b/,
+    ];
+    return envRefs.some((r) => r.test(content));
+}
+export async function checkPythonSecretKeyEnv(ctx) {
+    const candidates = [];
+    let anyPython = false;
+    for (const file of ctx.files) {
+        if (path.extname(file.relPath).toLowerCase() !== ".py")
+            continue;
+        anyPython = true;
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        if (isPythonSettingsLike(file.relPath, content)) {
+            candidates.push({ file, content });
+        }
+    }
+    if (!anyPython || candidates.length === 0)
+        return [];
+    let mentionsSecretKey = false;
+    let envBacked = false;
+    let firstMention = null;
+    for (const { file, content } of candidates) {
+        const m = /\bSECRET_KEY\b/.exec(content);
+        if (m) {
+            mentionsSecretKey = true;
+            if (!firstMention)
+                firstMention = { file, line: findLine(content, m.index) };
+        }
+        if (pythonReadsSecretKeyFromEnv(content)) {
+            envBacked = true;
+            break;
+        }
+    }
+    if (envBacked)
+        return [];
+    if (!mentionsSecretKey) {
+        return [
+            {
+                checkId: "py-missing-secret-key-env",
+                itemId: "secrets",
+                severity: "high",
+                message: "Detected a Django/Flask project but couldn't find SECRET_KEY anywhere in your settings. Configure it from an env var (e.g. os.environ['SECRET_KEY']) before deploying.",
+                file: relPosix(candidates[0].file.relPath),
+            },
+        ];
+    }
+    return [
+        {
+            checkId: "py-secret-key-not-from-env",
+            itemId: "secrets",
+            severity: "high",
+            message: "Django/Flask SECRET_KEY is set in source but not read from an environment variable. Pull it from os.environ / os.getenv (or python-decouple / django-environ) so the real value stays out of the repo.",
+            file: firstMention ? relPosix(firstMention.file.relPath) : undefined,
+            line: firstMention?.line,
+        },
+    ];
+}
+function isRailsProject(_ctx, files) {
+    for (const f of files) {
+        const rel = f.relPath.split(path.sep).join("/");
+        if (/(^|\/)config\/application\.rb$/.test(rel))
+            return true;
+        if (/(^|\/)config\/environments\/[a-z]+\.rb$/.test(rel))
+            return true;
+    }
+    return false;
+}
+async function gemfileMentionsRails(ctx) {
+    const gemfile = ctx.files.find((f) => path.basename(f.relPath) === "Gemfile");
+    if (!gemfile)
+        return false;
+    const content = await readFileSafe(gemfile);
+    if (!content)
+        return false;
+    return /\bgem\s+['"]rails['"]/m.test(content);
+}
+export async function checkRubySecretKeyBaseEnv(ctx) {
+    const isRails = isRailsProject(ctx, ctx.files) || (await gemfileMentionsRails(ctx));
+    if (!isRails)
+        return [];
+    const configFiles = [];
+    for (const file of ctx.files) {
+        const rel = file.relPath.split(path.sep).join("/");
+        const ext = path.extname(rel).toLowerCase();
+        const inConfig = /(^|\/)config\//.test(rel);
+        if (!inConfig)
+            continue;
+        if (![".rb", ".yml", ".yaml"].includes(ext))
+            continue;
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        configFiles.push({ file, content });
+    }
+    if (configFiles.length === 0)
+        return [];
+    let mentionsSecret = false;
+    let envBacked = false;
+    let firstMention = null;
+    for (const { file, content } of configFiles) {
+        const m = /\bsecret_key_base\b/.exec(content);
+        if (m) {
+            mentionsSecret = true;
+            if (!firstMention)
+                firstMention = { file, line: findLine(content, m.index) };
+        }
+        if (/ENV\[\s*['"]SECRET_KEY_BASE['"]\s*\]/.test(content) ||
+            /ENV\.fetch\(\s*['"]SECRET_KEY_BASE['"]/.test(content) ||
+            /Rails\.application\.credentials/.test(content)) {
+            envBacked = true;
+        }
+    }
+    if (envBacked)
+        return [];
+    if (!mentionsSecret) {
+        return [
+            {
+                checkId: "rb-missing-secret-key-base-env",
+                itemId: "secrets",
+                severity: "high",
+                message: "Detected a Rails project but couldn't find secret_key_base wired up to ENV['SECRET_KEY_BASE'] or Rails.application.credentials anywhere in config/. Configure it before deploying.",
+            },
+        ];
+    }
+    return [
+        {
+            checkId: "rb-secret-key-base-not-from-env",
+            itemId: "secrets",
+            severity: "high",
+            message: "Rails secret_key_base is referenced in config/ but not pulled from ENV['SECRET_KEY_BASE'] or Rails.application.credentials. Move the real value out of source.",
+            file: firstMention ? relPosix(firstMention.file.relPath) : undefined,
+            line: firstMention?.line,
+        },
+    ];
+}

package/dist/checks/public-assets.js

@@ -0,0 +1,54 @@
+import { findPublicDirs, isAssetEmittedDynamically } from "./helpers.js";
+export async function checkRobotsTxt(ctx) {
+    const has = ctx.files.some((f) => /(^|\/)robots\.txt$/i.test(f.relPath));
+    if (has)
+        return [];
+    if (await isAssetEmittedDynamically(ctx, "robots.txt"))
+        return [];
+    const dirs = await findPublicDirs(ctx);
+    if (dirs.length === 0)
+        return [];
+    return [
+        {
+            checkId: "missing-robots-txt",
+            itemId: "seo",
+            severity: "medium",
+            message: `No robots.txt found in any public directory (looked in: ${dirs.join(", ")}). Add one so search engines know what to crawl.`,
+        },
+    ];
+}
+export async function checkSitemapXml(ctx) {
+    const has = ctx.files.some((f) => /(^|\/)sitemap\.xml$/i.test(f.relPath));
+    if (has)
+        return [];
+    if (await isAssetEmittedDynamically(ctx, "sitemap.xml"))
+        return [];
+    const dirs = await findPublicDirs(ctx);
+    if (dirs.length === 0)
+        return [];
+    return [
+        {
+            checkId: "missing-sitemap-xml",
+            itemId: "seo",
+            severity: "medium",
+            message: `No sitemap.xml found in any public directory (looked in: ${dirs.join(", ")}). Add one to help search engines index your pages.`,
+        },
+    ];
+}
+export async function checkFavicon(ctx) {
+    const dirs = await findPublicDirs(ctx);
+    if (dirs.length === 0)
+        return [];
+    const faviconRegex = /(^|\/)(favicon\.(ico|png|svg)|apple-touch-icon\.png|icon\.svg)$/i;
+    const has = ctx.files.some((f) => faviconRegex.test(f.relPath));
+    if (has)
+        return [];
+    return [
+        {
+            checkId: "missing-favicon",
+            itemId: "launch-polish",
+            severity: "lower",
+            message: "No custom favicon found in your public directory. The default browser favicon (or the framework starter one) tells visitors this is a vibe-coded project.",
+        },
+    ];
+}

package/dist/checks/quality.js

@@ -0,0 +1,45 @@
+import * as path from "node:path";
+import { isTextFile, readFileSafe } from "../scan.js";
+import { findLine, isScanExempt, lineContainsIgnoreMarker, relPosix, } from "./helpers.js";
+const TODO_REGEX = /\b(?:TODO|FIXME|XXX|HACK)\b/;
+const PLACEHOLDER_REGEX = /\b(lorem ipsum|placeholder text|john doe|jane doe|test@example\.com)\b/i;
+export async function checkPlaceholderContent(ctx) {
+    const findings = [];
+    let todoCount = 0;
+    const placeholderHits = [];
+    for (const file of ctx.files) {
+        if (!isTextFile(file))
+            continue;
+        if (isScanExempt(file.relPath))
+            continue;
+        const ext = path.extname(file.relPath).toLowerCase();
+        if (![".ts", ".tsx", ".js", ".jsx", ".html", ".md", ".mdx"].includes(ext))
+            continue;
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        const todoMatch = TODO_REGEX.exec(content);
+        if (todoMatch && !lineContainsIgnoreMarker(content, todoMatch.index))
+            todoCount++;
+        const phMatch = PLACEHOLDER_REGEX.exec(content);
+        if (phMatch && !lineContainsIgnoreMarker(content, phMatch.index)) {
+            placeholderHits.push({
+                checkId: "placeholder-content",
+                itemId: "ai-audit",
+                severity: "medium",
+                message: `Placeholder content "${phMatch[0]}" found — make sure it isn't shown to real users.`,
+                file: relPosix(file.relPath),
+                line: findLine(content, phMatch.index),
+            });
+        }
+    }
+    if (todoCount > 0) {
+        findings.push({
+            checkId: "todo-comments",
+            itemId: "ai-audit",
+            severity: "lower",
+            message: `Found ${todoCount} file(s) with TODO/FIXME/XXX/HACK comments. Walk through them before launch and decide which are real work.`,
+        });
+    }
+    return findings.concat(placeholderHits.slice(0, 25));
+}

package/dist/checks/secrets.js

@@ -0,0 +1,271 @@
+import * as path from "node:path";
+import { fileExists, isTextFile, readFileSafe } from "../scan.js";
+import { findLine, isScanExempt, relPosix } from "./helpers.js";
+const SECRET_PATTERNS = [
+    {
+        id: "openai-key",
+        name: "OpenAI API key",
+        regex: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/,
+        severity: "critical",
+    },
+    {
+        id: "anthropic-key",
+        name: "Anthropic API key",
+        regex: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/,
+        severity: "critical",
+    },
+    {
+        id: "stripe-live-secret",
+        name: "Stripe live secret key",
+        regex: /\bsk_live_[A-Za-z0-9]{16,}\b/,
+        severity: "critical",
+    },
+    {
+        id: "stripe-live-publishable",
+        name: "Stripe live publishable key",
+        regex: /\bpk_live_[A-Za-z0-9]{16,}\b/,
+        severity: "high",
+    },
+    {
+        id: "aws-access-key",
+        name: "AWS access key id",
+        regex: /\bAKIA[0-9A-Z]{16}\b/,
+        severity: "critical",
+    },
+    {
+        id: "google-api-key",
+        name: "Google API key",
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/,
+        severity: "critical",
+    },
+    {
+        id: "github-token",
+        name: "GitHub personal access token",
+        regex: /\bghp_[A-Za-z0-9]{30,}\b/,
+        severity: "critical",
+    },
+    {
+        id: "slack-token",
+        name: "Slack token",
+        regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/,
+        severity: "high",
+    },
+    {
+        id: "private-key-block",
+        name: "Private key block",
+        regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/,
+        severity: "critical",
+    },
+    {
+        id: "notion-token",
+        name: "Notion integration token",
+        regex: /\bsecret_[A-Za-z0-9]{43}\b/,
+        severity: "critical",
+    },
+    {
+        id: "vercel-token",
+        name: "Vercel token",
+        regex: /\b(?:VERCEL_TOKEN|vercel_token|vercelToken)\b\s*[:=]\s*['"]?[A-Za-z0-9]{24}['"]?/,
+        severity: "critical",
+    },
+    {
+        id: "sendgrid-api-key",
+        name: "SendGrid API key",
+        regex: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/,
+        severity: "critical",
+    },
+    {
+        id: "twilio-account-sid",
+        name: "Twilio Account SID",
+        regex: /\bAC[a-f0-9]{32}\b/,
+        severity: "high",
+    },
+];
+const JWT_REGEX = /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+function tryDecodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    let b = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    while (b.length % 4 !== 0)
+        b += "=";
+    try {
+        return Buffer.from(b, "base64").toString("utf8");
+    }
+    catch {
+        return null;
+    }
+}
+const SECRET_SCAN_SKIP_NAMES = new Set([
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lockb",
+]);
+export async function checkHardcodedSecrets(ctx) {
+    const findings = [];
+    for (const file of ctx.files) {
+        const base = path.basename(file.relPath);
+        if (SECRET_SCAN_SKIP_NAMES.has(base))
+            continue;
+        if (!isTextFile(file))
+            continue;
+        if (isScanExempt(file.relPath))
+            continue;
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        const isEnvExample = /\.example$|\.sample$|\.template$/i.test(base) || base === ".env.example";
+        if (isEnvExample)
+            continue;
+        const matchedRanges = [];
+        for (const pat of SECRET_PATTERNS) {
+            const m = pat.regex.exec(content);
+            if (!m)
+                continue;
+            const start = m.index;
+            const end = m.index + m[0].length;
+            if (matchedRanges.some(([s, e]) => start < e && end > s))
+                continue;
+            matchedRanges.push([start, end]);
+            const line = findLine(content, start);
+            findings.push({
+                checkId: `secret-${pat.id}`,
+                itemId: "secrets",
+                severity: pat.severity,
+                message: `Possible ${pat.name} hardcoded in source.`,
+                file: relPosix(file.relPath),
+                line,
+                evidence: `${m[0].slice(0, 6)}…${m[0].slice(-4)} (${m[0].length} chars)`,
+            });
+        }
+        JWT_REGEX.lastIndex = 0;
+        let jm;
+        while ((jm = JWT_REGEX.exec(content)) !== null) {
+            const start = jm.index;
+            const end = jm.index + jm[0].length;
+            if (matchedRanges.some(([s, e]) => start < e && end > s))
+                continue;
+            matchedRanges.push([start, end]);
+            const payload = tryDecodeJwtPayload(jm[0]);
+            const isServiceRole = !!payload && /"role"\s*:\s*"service_role"/.test(payload);
+            const line = findLine(content, start);
+            if (isServiceRole) {
+                findings.push({
+                    checkId: "secret-supabase-service-role-jwt",
+                    itemId: "secrets",
+                    severity: "critical",
+                    message: "Possible Supabase service-role JWT hardcoded in source.",
+                    file: relPosix(file.relPath),
+                    line,
+                    evidence: `${jm[0].slice(0, 6)}…${jm[0].slice(-4)} (${jm[0].length} chars)`,
+                });
+            }
+            else {
+                findings.push({
+                    checkId: "secret-jwt",
+                    itemId: "secrets",
+                    severity: "high",
+                    message: "Possible JWT hardcoded in source.",
+                    file: relPosix(file.relPath),
+                    line,
+                    evidence: `${jm[0].slice(0, 6)}…${jm[0].slice(-4)} (${jm[0].length} chars)`,
+                });
+            }
+            break;
+        }
+    }
+    return findings;
+}
+// ---------------------------------------------------------------------------
+// Config-file secret leaks
+//
+// Catches the class of bug where a credential-shaped value gets hardcoded into
+// a tracked config file (.env, *.toml) under an env-var assignment, and the
+// related anti-pattern of naming a browser-exposed VITE_ variable like a
+// secret (VITE_*_SECRET / TOKEN / KEY / PASSWORD). Anything with the VITE_
+// prefix is baked into the client bundle by Vite at build time and is
+// readable by every visitor — naming it like a secret gives false comfort.
+// ---------------------------------------------------------------------------
+const CONFIG_FILE_BASENAMES = new Set([
+    ".env",
+    ".env.local",
+    ".env.production",
+]);
+const CONFIG_FILE_EXTENSIONS = new Set([".toml"]);
+function looksLikeConfigFile(relPath) {
+    const base = path.basename(relPath);
+    if (CONFIG_FILE_BASENAMES.has(base))
+        return true;
+    const ext = path.extname(base).toLowerCase();
+    if (CONFIG_FILE_EXTENSIONS.has(ext))
+        return true;
+    return false;
+}
+const CONFIG_ASSIGNMENT_REGEX = /^[ \t]*([A-Za-z_][A-Za-z0-9_]*)[ \t]*=[ \t]*(?:"([^"\n]+)"|'([^'\n]+)'|([^\s#"'][^\s#]*))/gm;
+const VITE_SECRET_KEY_REGEX = /^VITE_[A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|CREDENTIAL|PRIVATE)$/;
+const HEX_SECRET_REGEX = /^[A-Fa-f0-9]{32,}$/;
+const BASE64_SECRET_REGEX = /^[A-Za-z0-9+/_-]{40,}={0,2}$/;
+const TEMPLATED_VALUE_REGEX = /\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*/;
+const CONFIG_KEY_ALLOWLIST = new Set([
+    "DATABASE_URL", // contains URL/host fragments, handled by other rules
+]);
+export async function checkConfigSecretLeaks(ctx) {
+    const findings = [];
+    for (const file of ctx.files) {
+        if (!looksLikeConfigFile(file.relPath))
+            continue;
+        if (!isTextFile(file))
+            continue;
+        const base = path.basename(file.relPath);
+        if (/\.example$|\.sample$|\.template$/i.test(base))
+            continue;
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        CONFIG_ASSIGNMENT_REGEX.lastIndex = 0;
+        let m;
+        while ((m = CONFIG_ASSIGNMENT_REGEX.exec(content)) !== null) {
+            const key = m[1];
+            const value = (m[2] ?? m[3] ?? m[4] ?? "").trim();
+            if (!value)
+                continue;
+            if (TEMPLATED_VALUE_REGEX.test(value))
+                continue;
+            const line = findLine(content, m.index);
+            // 1. Browser-exposed VITE_ variable named like a secret. Severity: high
+            //    regardless of value, because the *name* itself is the bug.
+            if (VITE_SECRET_KEY_REGEX.test(key)) {
+                findings.push({
+                    checkId: "config-vite-prefixed-secret",
+                    itemId: "secrets",
+                    severity: "high",
+                    message: `${key} is set in ${relPosix(file.relPath)}. Variables prefixed with VITE_ are baked into the browser bundle by Vite at build time and are readable by every visitor — they are not secrets. Rename the variable (drop VITE_) and access it server-side only, or move the signing/auth flow behind a backend endpoint.`,
+                    file: relPosix(file.relPath),
+                    line,
+                    evidence: `${key}=${value.slice(0, 4)}…${value.slice(-2)} (${value.length} chars)`,
+                });
+                continue;
+            }
+            // 2. Anything else: high-entropy hardcoded credential value.
+            if (CONFIG_KEY_ALLOWLIST.has(key))
+                continue;
+            const isHex = HEX_SECRET_REGEX.test(value);
+            const isBase64 = BASE64_SECRET_REGEX.test(value);
+            if (!isHex && !isBase64)
+                continue;
+            findings.push({
+                checkId: "config-hardcoded-credential",
+                itemId: "secrets",
+                severity: "critical",
+                message: `${key} in ${relPosix(file.relPath)} looks like a hardcoded credential (${value.length}-char ${isHex ? "hex" : "base64-shaped"} value). Move it to your platform's secret store (Railway / Vercel / Fly env vars, or a dedicated vault) and reference it from there. Rotate the leaked value at the source.`,
+                file: relPosix(file.relPath),
+                line,
+                evidence: `${key}=${value.slice(0, 4)}…${value.slice(-2)} (${value.length} chars)`,
+            });
+        }
+    }
+    return findings;
+}
+// fileExists is referenced indirectly only via env.ts; re-exported for backwards compat
+export { fileExists };

package/dist/checks/types.js

@@ -0,0 +1 @@
+export {};

package/dist/checks.js

@@ -0,0 +1,8 @@
+/**
+ * Backwards-compatible barrel for the scanner checks.
+ *
+ * The implementation lives in `./checks/`, split per domain (secrets, env,
+ * headers, dangerous patterns, language patterns, public assets, content
+ * quality). Importers should prefer `./checks/index` directly going forward.
+ */
+export * from "./checks/index.js";