shippingszn 0.6.0 → 0.7.1

package/dist/checks/dangerous.js

@@ -23,6 +23,13 @@ const DANGEROUS_PATTERNS = [
         severity: "medium",
         message: "Wildcard CORS (Access-Control-Allow-Origin: *). Lock this down to specific origins for any authenticated endpoint.",
     },
+    {
+        id: "shell-exec-call",
+        regex: /(^|[^A-Za-z0-9_$.])(exec|execSync)\s*\(/,
+        itemId: "common-attacks",
+        severity: "high",
+        message: "Shell execution via exec/execSync — if any argument includes user input, this is a command-injection path. Prefer execFile with an argument array, or validate input strictly against an allowlist.",
+    },
 ];
 export async function checkDangerousPatterns(ctx) {
     const findings = [];
@@ -32,7 +39,16 @@ export async function checkDangerousPatterns(ctx) {
         if (isScanExempt(file.relPath))
             continue;
         const ext = path.extname(file.relPath).toLowerCase();
-        if (![".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".json", ".html"].includes(ext))
+        if (![
+            ".ts",
+            ".tsx",
+            ".js",
+            ".jsx",
+            ".mjs",
+            ".cjs",
+            ".json",
+            ".html",
+        ].includes(ext))
             continue;
         const content = await readFileSafe(file);
         if (!content)

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import * as path from "node:path";
 import * as process from "node:process";
+import { createRequire } from "node:module";
 import { ALL_CHECKS } from "./checks.js";
 import { listFiles, getTrackedFiles } from "./scan.js";
 import { CHECKLIST_ITEMS, permalinkFor } from "./items.js";
@@ -31,7 +32,11 @@ function applyTrackingAwareSeverity(findings, tracked) {
     });
 }
 const DEFAULT_BASE_URL = "https://shippingszn.com";
-const PKG_VERSION = "0.6.0";
+const PKG_VERSION = (() => {
+    const require = createRequire(import.meta.url);
+    const pkg = require("../package.json");
+    return pkg.version;
+})();
 function parseArgs(argv) {
     const opts = {
         cwd: process.cwd(),

package/dist/items.js

@@ -39,6 +39,16 @@ export const CHECKLIST_ITEMS = {
         title: "Audit what your AI builder actually shipped",
         priority: "critical",
     },
+    aeo: {
+        id: "aeo",
+        title: "Make AI assistants able to recommend you",
+        priority: "lower",
+    },
+    "installable-app": {
+        id: "installable-app",
+        title: "Make your app installable on phones",
+        priority: "lower",
+    },
 };
 export function permalinkFor(itemId, baseUrl) {
     const trimmed = baseUrl.replace(/\/+$/, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",