shippingszn 0.8.2 → 0.8.4

package/README.md

@@ -36,7 +36,7 @@ fields:
     "proofUploadHint": "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.",
     "proofUrl": "https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123",
     "proofResultId": "00000000-0000-4000-8000-000000000123",
-    "badgeMarkdown": "[![Launch readiness proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
+    "badgeMarkdown": "[![shippingszn scan proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
     "wallUrl": "https://shippingszn.com/wall",
     "reportUrl": "https://shippingszn.com/report?scanResultId=00000000-0000-4000-8000-000000000123"
   },
@@ -93,6 +93,9 @@ maps back to one of the items on the checklist.
 - Missing security-header middleware in common server configs.
 - Dangerous code patterns: unsafe HTML injection in React, runtime
   code-execution calls, wildcard CORS.
+- OTP/auth readiness signals: phone normalization, resend/cooldown behavior,
+  anti-enumeration copy, mobile one-time-code input, delivery-smoke evidence,
+  recovery paths, and paid report access that depends on OTP.
 - Python: common debug-mode slip-ups, hardcoded framework secrets, missing
   env-var loading.
 - Ruby: unsafe string rendering, hardcoded Rails secrets.
@@ -104,6 +107,32 @@ maps back to one of the items on the checklist.
 Each finding is tagged Critical, High, Medium, or Lower and links back to the
 relevant checklist item on shippingszn.com.
 
+## Suppressing false positives
+
+Two opt-out mechanisms, both off by default:
+
+- **`.gitignore` is respected.** Files your repo gitignores (build output,
+  generated reports, local `.env`, vendored sub-projects) are skipped.
+  This works automatically inside any git repo; outside a git repo the
+  scanner falls back to walking the full directory.
+- **Inline ignore markers.** For one-off cases where a file legitimately
+  contains a pattern the scanner detects (a regex literal, copy that
+  describes a placeholder, a test fixture), add one of:
+
+  ```ts
+  // shippingszn:ignore — placed on the same line as the match
+  const x = "lorem ipsum"; // shippingszn:ignore — fixture text
+
+  // shippingszn:ignore-next-line — placed on the line above the match
+  // shippingszn:ignore-next-line
+  const greeting = "hello placeholder";
+  ```
+
+  Markers apply to substring/regex checks (placeholder content, dangerous
+  patterns, language patterns). They deliberately do **not** apply to
+  hardcoded-secret detection — false positives there should be addressed
+  by removing the secret pattern, not by allowlisting.
+
 ## What does NOT get checked
 
 These are deliberately out of scope for v1: