shippingszn 0.8.3 → 0.8.4

package/README.md

@@ -36,7 +36,7 @@ fields:
     "proofUploadHint": "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON in the web scan proof flow to create a shareable launch proof result.",
     "proofUrl": "https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123",
     "proofResultId": "00000000-0000-4000-8000-000000000123",
-    "badgeMarkdown": "[![Launch readiness proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
+    "badgeMarkdown": "[![shippingszn scan proof: 70%](https://shippingszn.com/api/badge.svg?...)](https://shippingszn.com/proof/00000000-0000-4000-8000-000000000123)",
     "wallUrl": "https://shippingszn.com/wall",
     "reportUrl": "https://shippingszn.com/report?scanResultId=00000000-0000-4000-8000-000000000123"
   },
@@ -93,6 +93,9 @@ maps back to one of the items on the checklist.
 - Missing security-header middleware in common server configs.
 - Dangerous code patterns: unsafe HTML injection in React, runtime
   code-execution calls, wildcard CORS.
+- OTP/auth readiness signals: phone normalization, resend/cooldown behavior,
+  anti-enumeration copy, mobile one-time-code input, delivery-smoke evidence,
+  recovery paths, and paid report access that depends on OTP.
 - Python: common debug-mode slip-ups, hardcoded framework secrets, missing
   env-var loading.
 - Ruby: unsafe string rendering, hardcoded Rails secrets.
@@ -104,6 +107,32 @@ maps back to one of the items on the checklist.
 Each finding is tagged Critical, High, Medium, or Lower and links back to the
 relevant checklist item on shippingszn.com.
 
+## Suppressing false positives
+
+Two opt-out mechanisms, both off by default:
+
+- **`.gitignore` is respected.** Files your repo gitignores (build output,
+  generated reports, local `.env`, vendored sub-projects) are skipped.
+  This works automatically inside any git repo; outside a git repo the
+  scanner falls back to walking the full directory.
+- **Inline ignore markers.** For one-off cases where a file legitimately
+  contains a pattern the scanner detects (a regex literal, copy that
+  describes a placeholder, a test fixture), add one of:
+
+  ```ts
+  // shippingszn:ignore — placed on the same line as the match
+  const x = "lorem ipsum"; // shippingszn:ignore — fixture text
+
+  // shippingszn:ignore-next-line — placed on the line above the match
+  // shippingszn:ignore-next-line
+  const greeting = "hello placeholder";
+  ```
+
+  Markers apply to substring/regex checks (placeholder content, dangerous
+  patterns, language patterns). They deliberately do **not** apply to
+  hardcoded-secret detection — false positives there should be addressed
+  by removing the secret pattern, not by allowlisting.
+
 ## What does NOT get checked
 
 These are deliberately out of scope for v1:

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 import * as process2 from "node:process";
 import { createRequire } from "node:module";
 
@@ -246,6 +246,7 @@ var PATTERN_DEFINITION_FILES = /* @__PURE__ */ new Set([
   "tools/cli/src/checks/dangerous.ts",
   "tools/cli/src/checks/quality.ts",
   "tools/cli/src/checks/language.ts",
+  "tools/cli/src/checks/otp-auth.ts",
   "tools/cli/README.md",
   // Test fixture for the redaction module: contains intentional fake
   // secret patterns whose whole purpose is to verify the redactor scrubs
@@ -1164,6 +1165,258 @@ async function checkPlaceholderContent(ctx) {
   return findings.concat(placeholderHits.slice(0, 25));
 }
 
+// src/checks/otp-auth.ts
+import * as path9 from "node:path";
+var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".md",
+  ".mdx",
+  ".html",
+  ".htm",
+  ".vue",
+  ".svelte",
+  ".astro",
+  ".py",
+  ".rb",
+  ".go",
+  ".php",
+  ".java",
+  ".kt",
+  ".swift",
+  ".cs"
+]);
+var OTP_CONTEXT = /\b(otp|one[-\s]?time(?: password| code)?|verification code|verify code|login code|magic code|passcode|2fa|mfa|two[-\s]?factor)\b/i;
+var AUTH_CONTEXT = /\b(auth|sign[-\s]?in|signin|login|session|protected route|private route)\b/i;
+var SMS_OR_PHONE_CONTEXT = /\b(sms|text message|twilio|phone|mobile number|mobile phone|PhoneInput)\b/i;
+var PAID_REPORT_CONTEXT = /\b(paid report|report access|checkout handoff|checkoutHandoff|Stripe checkout|checkout email|checkout phone|checkout mobile|retrieve your report|account\/purchases|report session)\b/i;
+var FRONTEND_PATH_CONTEXT = /(^|\/)(login|signin|sign-in|auth|account|report|checkout)[^/]*\.(tsx|jsx|html|vue|svelte|astro)$/i;
+var PHONE_NORMALIZATION = /\b(normalizePhone|libphonenumber|parsePhoneNumber|isValidPhoneNumber|PhoneInput|E\.164|e164|react-phone-number-input|AsYouType)\b/i;
+var RESEND_BEHAVIOR = /\b(resend|send another|send a new code|request another|retry-after|try again in|wait a minute|cooldown|backoff)\b/i;
+var RATE_LIMIT = /\b(rateLimit|rate limit|Too many requests|retry-after|429|throttl|attempt limit|cooldown)\b/i;
+var ANTI_ENUMERATION = /\b(anti[-\s]?enumeration|success[-\s]?shaped|generic response|do not reveal|without revealing|hasPaidPurchase|no paid purchase|paid purchases|return\s+\{?\s*ok:\s*true|res\.json\(\s*\{\s*ok:\s*true)\b/i;
+var ENUMERATION_LEAK = /\b(?:user|account|email|phone|checkout|purchase|report)\s+(?:not\s+found|does\s+not\s+exist|not\s+recognized|not\s+registered|has no paid|has no purchase|not paid)|\bno\s+(?:account|user|purchase|paid checkout)\b/i;
+var MOBILE_OTP_INPUT = /\b(inputMode|inputmode|one-time-code|autocomplete=["']one-time-code|maxLength\s*=\s*\{?\s*6|type=["']tel|pattern=["'][^"']*\\d|InputOTP|numeric)\b/i;
+var CLEAR_COPY = /\b(6[-\s]?digit|six[-\s]?digit|verification code|one[-\s]?time code|code expires|expires? in|latest code|checkout email|checkout mobile|same email|same mobile|SMS code|Email code|Stripe receipt)\b/i;
+var RECOVERY_PATH = /\b(support|receipt|fallback|email fallback|alternate channel|try email|try sms|contact us|restart checkout|fulfillment|purchase history|account\/purchases|returnTo|different contact)\b/i;
+var DELIVERY_VERIFICATION = /\b(deliverability|delivery|delivered|arrives?|smoke|gateway|Twilio Verify|Email OTP Gateway|verifyGateway|requestGateway|mail[-\s]?tester|SPF|DKIM|DMARC|branded)\b/i;
+function shouldScan(file) {
+  if (!isTextFile(file)) return false;
+  if (isScanExempt(file.relPath)) return false;
+  const ext = path9.extname(file.relPath).toLowerCase();
+  return SCANNABLE_EXTENSIONS.has(ext);
+}
+function firstHit(file, content, regex) {
+  const match = regex.exec(content);
+  if (!match) return void 0;
+  if (lineContainsIgnoreMarker(content, match.index)) return void 0;
+  return {
+    file: relPosix(file.relPath),
+    line: findLine(content, match.index),
+    text: match[0]
+  };
+}
+function pick(existing, next) {
+  return existing ?? next;
+}
+function evidence(hit, fallback) {
+  if (!hit) return fallback;
+  return `${hit.file}:${hit.line} matched "${hit.text}".`;
+}
+function finding(input) {
+  return {
+    checkId: input.checkId,
+    itemId: "secure-auth",
+    severity: input.severity,
+    message: input.message,
+    evidence: input.evidence,
+    ...input.hit ? { file: input.hit.file, line: input.hit.line } : {}
+  };
+}
+async function collectOtpAuthSignals(ctx) {
+  const signals = {
+    hasOtp: false,
+    hasSmsOrPhone: false,
+    hasPaidReportOtp: false,
+    hasFrontendOtp: false
+  };
+  for (const file of ctx.files) {
+    if (!shouldScan(file)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const rel = relPosix(file.relPath);
+    const otpHit = firstHit(file, content, OTP_CONTEXT);
+    const authHit = firstHit(file, content, AUTH_CONTEXT);
+    const smsHit = firstHit(file, content, SMS_OR_PHONE_CONTEXT);
+    const paidHit = firstHit(file, content, PAID_REPORT_CONTEXT);
+    const frontendContext = FRONTEND_PATH_CONTEXT.test(rel);
+    signals.hasOtp = signals.hasOtp || Boolean(otpHit);
+    signals.hasSmsOrPhone = signals.hasSmsOrPhone || Boolean(smsHit);
+    signals.hasPaidReportOtp = signals.hasPaidReportOtp || Boolean(paidHit && (otpHit || authHit));
+    signals.hasFrontendOtp = signals.hasFrontendOtp || Boolean(frontendContext && (otpHit || authHit));
+    signals.contextHit = pick(
+      signals.contextHit,
+      otpHit ?? paidHit ?? authHit ?? smsHit
+    );
+    signals.phoneNormalization = pick(
+      signals.phoneNormalization,
+      firstHit(file, content, PHONE_NORMALIZATION)
+    );
+    signals.resendBehavior = pick(
+      signals.resendBehavior,
+      firstHit(file, content, RESEND_BEHAVIOR)
+    );
+    signals.rateLimit = pick(signals.rateLimit, firstHit(file, content, RATE_LIMIT));
+    signals.antiEnumeration = pick(
+      signals.antiEnumeration,
+      firstHit(file, content, ANTI_ENUMERATION)
+    );
+    signals.enumerationLeak = pick(
+      signals.enumerationLeak,
+      firstHit(file, content, ENUMERATION_LEAK)
+    );
+    signals.mobileOtpInput = pick(
+      signals.mobileOtpInput,
+      firstHit(file, content, MOBILE_OTP_INPUT)
+    );
+    signals.clearCopy = pick(
+      signals.clearCopy,
+      firstHit(file, content, CLEAR_COPY)
+    );
+    signals.recoveryPath = pick(
+      signals.recoveryPath,
+      firstHit(file, content, RECOVERY_PATH)
+    );
+    signals.deliveryVerification = pick(
+      signals.deliveryVerification,
+      firstHit(file, content, DELIVERY_VERIFICATION)
+    );
+  }
+  return signals;
+}
+async function checkOtpAuthReadiness(ctx) {
+  const signals = await collectOtpAuthSignals(ctx);
+  if (!signals.hasOtp && !signals.hasPaidReportOtp) return [];
+  const findings = [];
+  if (signals.hasSmsOrPhone && !signals.phoneNormalization) {
+    findings.push(
+      finding({
+        checkId: "otp-phone-normalization-missing",
+        severity: "high",
+        hit: signals.contextHit,
+        message: "OTP/auth flow mentions SMS or phone numbers but no phone normalization signal was found. Normalize to E.164 before lookup, delivery, and paid report access.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP/SMS context was found without a phone normalization signal."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.rateLimit) {
+    findings.push(
+      finding({
+        checkId: "otp-rate-limit-missing",
+        severity: "high",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show a rate limit, retry-after, or throttling signal. Launching without this invites brute-force code guessing and SMS/email abuse.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without a rate-limit signal."
+        )
+      })
+    );
+  }
+  if (signals.enumerationLeak && !signals.antiEnumeration) {
+    findings.push(
+      finding({
+        checkId: "otp-enumeration-leak",
+        severity: "high",
+        hit: signals.enumerationLeak,
+        message: "OTP/auth copy appears to reveal whether a user, purchase, or report exists. Use success-shaped start responses and generic failure copy before launch.",
+        evidence: evidence(
+          signals.enumerationLeak,
+          "Potential enumeration copy was found."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.resendBehavior) {
+    findings.push(
+      finding({
+        checkId: "otp-resend-behavior-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show resend, cooldown, or retry copy. Users need a clear path when an email/SMS code is delayed.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without resend or cooldown evidence."
+        )
+      })
+    );
+  }
+  if (signals.hasFrontendOtp && !signals.mobileOtpInput) {
+    findings.push(
+      finding({
+        checkId: "otp-mobile-input-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "Frontend OTP/auth flow does not show mobile-friendly one-time-code input behavior. Use six numeric slots or inputMode/autocomplete support before launch.",
+        evidence: evidence(
+          signals.contextHit,
+          "Frontend OTP context was found without mobile one-time-code input evidence."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.clearCopy) {
+    findings.push(
+      finding({
+        checkId: "otp-copy-clarity-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show clear code copy. Say which contact receives the code, the expected code format, and what to do if the latest code fails.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without clear verification-code copy."
+        )
+      })
+    );
+  }
+  if (signals.hasPaidReportOtp && !signals.recoveryPath) {
+    findings.push(
+      finding({
+        checkId: "otp-paid-report-recovery-missing",
+        severity: "high",
+        hit: signals.contextHit,
+        message: "Paid report access appears to depend on OTP, but no recovery path was found. Add alternate contact, receipt/support, or purchase-history recovery before launch.",
+        evidence: evidence(
+          signals.contextHit,
+          "Paid report OTP context was found without recovery-path evidence."
+        )
+      })
+    );
+  }
+  if (signals.hasOtp && !signals.deliveryVerification) {
+    findings.push(
+      finding({
+        checkId: "otp-delivery-proof-missing",
+        severity: "medium",
+        hit: signals.contextHit,
+        message: "OTP/auth flow does not show delivery verification evidence. Treat gateway success as a start signal, then smoke a real delivered email/SMS code in the target environment.",
+        evidence: evidence(
+          signals.contextHit,
+          "OTP context was found without delivery smoke or gateway evidence."
+        )
+      })
+    );
+  }
+  return findings;
+}
+
 // src/checks/index.ts
 var ALL_CHECKS = [
   { id: "hardcoded-secrets", run: checkHardcodedSecrets },
@@ -1181,7 +1434,8 @@ var ALL_CHECKS = [
   { id: "language-patterns", run: checkLanguagePatterns },
   { id: "python-secret-key-env", run: checkPythonSecretKeyEnv },
   { id: "ruby-secret-key-base-env", run: checkRubySecretKeyBaseEnv },
-  { id: "placeholder-content", run: checkPlaceholderContent }
+  { id: "placeholder-content", run: checkPlaceholderContent },
+  { id: "otp-auth-readiness", run: checkOtpAuthReadiness }
 ];
 
 // src/items.ts
@@ -1206,6 +1460,11 @@ var CHECKLIST_ITEMS = {
     title: "Keep your test data away from real users",
     priority: "critical"
   },
+  "secure-auth": {
+    id: "secure-auth",
+    title: "Prove auth, OTP, and report access before launch",
+    priority: "critical"
+  },
   github: {
     id: "github",
     title: "Get your code into GitHub safely",
@@ -1244,7 +1503,7 @@ function permalinkFor(itemId, baseUrl) {
 
 // src/publish.ts
 import { promises as fs2 } from "node:fs";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var DEFAULT_BASE_URL = "https://shippingszn.com";
 var PUBLISH_TIMEOUT_MS = 3e3;
 function shouldPublish() {
@@ -1254,7 +1513,7 @@ function shouldPublish() {
 async function detectStack(cwd2) {
   const tags = /* @__PURE__ */ new Set();
   try {
-    const raw = await fs2.readFile(path9.join(cwd2, "package.json"), "utf8");
+    const raw = await fs2.readFile(path10.join(cwd2, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const has = (n) => n in deps;
@@ -1289,7 +1548,7 @@ async function detectStack(cwd2) {
   ];
   for (const [file, tag] of checks) {
     try {
-      await fs2.access(path9.join(cwd2, file));
+      await fs2.access(path10.join(cwd2, file));
       tags.add(tag);
     } catch {
     }
@@ -1336,7 +1595,7 @@ async function publishScan(totals, filesScanned, opts) {
 }
 
 // src/proof.ts
-import * as path10 from "node:path";
+import * as path11 from "node:path";
 var PROOF_TIMEOUT_MS = 5e3;
 var MAX_FINDINGS = 100;
 function shouldUploadProof() {
@@ -1347,9 +1606,9 @@ function clampText(value, max, fallback = "") {
   const text = value ?? fallback;
   return text.length > max ? text.slice(0, max - 3) + "..." : text;
 }
-function locationFromFinding(finding) {
-  if (!finding.file) return void 0;
-  return finding.line ? `${finding.file}:${finding.line}` : finding.file;
+function locationFromFinding(finding2) {
+  if (!finding2.file) return void 0;
+  return finding2.line ? `${finding2.file}:${finding2.line}` : finding2.file;
 }
 function buildBadgeMarkdown(baseUrl, id, score) {
   const params = new URLSearchParams({
@@ -1357,7 +1616,7 @@ function buildBadgeMarkdown(baseUrl, id, score) {
     theme: "dark"
   });
   const proofUrl = `${baseUrl}/proof/${encodeURIComponent(id)}`;
-  return `[![Launch readiness proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
+  return `[![shippingszn scan proof: ${score}%](${baseUrl}/api/badge.svg?${params.toString()})](${proofUrl})`;
 }
 function buildProofPayload(report, scannerVersion) {
   const counts = {
@@ -1370,7 +1629,7 @@ function buildProofPayload(report, scannerVersion) {
     version: 1,
     source: report.source ?? "cli",
     scanner: "shippingszn",
-    targetName: path10.basename(report.cwd) || "CLI scan",
+    targetName: path11.basename(report.cwd) || "CLI scan",
     score: report.launchReadiness.score,
     label: report.launchReadiness.label,
     decision: report.launchReadiness.decision,
@@ -1379,22 +1638,22 @@ function buildProofPayload(report, scannerVersion) {
     confidence: report.launchReadiness.confidence,
     checkedAt: report.generatedAt,
     counts,
-    findings: report.findings.slice(0, MAX_FINDINGS).map((finding) => ({
-      severity: finding.severity,
-      title: clampText(finding.itemTitle || finding.checkId, 160),
-      body: clampText(finding.message, 3e3),
-      whatFailed: clampText(finding.whatFailed, 3e3),
-      whyItBlocksLaunch: clampText(finding.whyItBlocksLaunch, 3e3),
-      fixInstructions: clampText(finding.fixInstructions, 4e3),
-      aiBuilderPrompt: clampText(finding.aiBuilderPrompt, 4e3),
-      evidence: clampText(finding.evidence, 3e3),
-      confidence: finding.confidence,
-      fixPrompt: clampText(finding.aiBuilderPrompt, 4e3),
-      verify: clampText(finding.verificationStep, 3e3),
-      verificationStep: clampText(finding.verificationStep, 3e3),
-      ...locationFromFinding(finding) ? { location: clampText(locationFromFinding(finding), 500) } : {},
-      permalink: finding.permalink,
-      itemTitle: clampText(finding.itemTitle, 160)
+    findings: report.findings.slice(0, MAX_FINDINGS).map((finding2) => ({
+      severity: finding2.severity,
+      title: clampText(finding2.itemTitle || finding2.checkId, 160),
+      body: clampText(finding2.message, 3e3),
+      whatFailed: clampText(finding2.whatFailed, 3e3),
+      whyItBlocksLaunch: clampText(finding2.whyItBlocksLaunch, 3e3),
+      fixInstructions: clampText(finding2.fixInstructions, 4e3),
+      aiBuilderPrompt: clampText(finding2.aiBuilderPrompt, 4e3),
+      evidence: clampText(finding2.evidence, 3e3),
+      confidence: finding2.confidence,
+      fixPrompt: clampText(finding2.aiBuilderPrompt, 4e3),
+      verify: clampText(finding2.verificationStep, 3e3),
+      verificationStep: clampText(finding2.verificationStep, 3e3),
+      ...locationFromFinding(finding2) ? { location: clampText(locationFromFinding(finding2), 500) } : {},
+      permalink: finding2.permalink,
+      itemTitle: clampText(finding2.itemTitle, 160)
     })),
     filesScanned: report.filesScanned,
     topNextStep: clampText(report.launchReadiness.topNextStep, 1e3),
@@ -1515,10 +1774,10 @@ var ESCALATION = {
   medium: "Escalate only if the fix changes routing, indexing, analytics, or public launch messaging.",
   lower: "Escalation is usually unnecessary unless this blocks installability, branding, or a promised launch surface."
 };
-function locationForPrompt(finding) {
-  if (!finding.file) return "No specific file was attached to the finding.";
-  const line = finding.line ? `:${finding.line}` : "";
-  return `Likely location: ${finding.file}${line}.`;
+function locationForPrompt(finding2) {
+  if (!finding2.file) return "No specific file was attached to the finding.";
+  const line = finding2.line ? `:${finding2.line}` : "";
+  return `Likely location: ${finding2.file}${line}.`;
 }
 function proofStepForSeverity(severity, proofCreatePath, reportUrl) {
   const proofStep = `After the fix verifies clean, run npx shippingszn --json and paste or upload the JSON at ${proofCreatePath} to create launch proof.`;
@@ -1528,20 +1787,20 @@ function proofStepForSeverity(severity, proofCreatePath, reportUrl) {
   return proofStep;
 }
 function buildRemediationPrompt({
-  finding,
+  finding: finding2,
   item,
   proofCreatePath,
   reportUrl
 }) {
-  const itemTitle = item?.title ?? finding.itemId;
-  const location = locationForPrompt(finding);
-  const intent = SEVERITY_INTENT[finding.severity];
+  const itemTitle = item?.title ?? finding2.itemId;
+  const location = locationForPrompt(finding2);
+  const intent = SEVERITY_INTENT[finding2.severity];
   return {
-    fixPrompt: `You are fixing a shippingszn launch-readiness finding. Severity: ${finding.severity}. Checklist area: ${itemTitle}. Finding: ${finding.message} ${location} ${intent} Make the smallest production-safe code or config change that removes the underlying risk, preserve existing behavior, and list the files changed. Do not suppress the scanner unless you can prove the finding is a false positive.`,
+    fixPrompt: `You are fixing a shippingszn launch-readiness finding. Severity: ${finding2.severity}. Checklist area: ${itemTitle}. Finding: ${finding2.message} ${location} ${intent} Make the smallest production-safe code or config change that removes the underlying risk, preserve existing behavior, and list the files changed. Do not suppress the scanner unless you can prove the finding is a false positive.`,
     verify: "Re-run npx shippingszn --json and confirm this exact finding is gone. Also run the app's normal typecheck/test/build command when the fix changes code, config, routing, security behavior, or public assets.",
-    escalation: ESCALATION[finding.severity],
+    escalation: ESCALATION[finding2.severity],
     proofNextStep: proofStepForSeverity(
-      finding.severity,
+      finding2.severity,
       proofCreatePath,
       reportUrl
     )
@@ -1599,7 +1858,7 @@ var COVERAGE_LABELS = {
   public_surface: "Public launch surface",
   repo_static: "Repository static scan",
   secrets: "Secrets and config exposure",
-  auth: "Auth and private surfaces",
+  auth: "Auth, OTP, and private surfaces",
   paid_api: "Paid API and abuse risk",
   deployment: "Deployment and runtime config",
   content: "Launch content and metadata",
@@ -1644,8 +1903,8 @@ function normalizeLaunchCounts(counts) {
 }
 function countLaunchFindings(findings) {
   const counts = emptyLaunchReadinessCounts();
-  for (const finding of findings) {
-    counts[canonicalSeverity(finding.severity)] += 1;
+  for (const finding2 of findings) {
+    counts[canonicalSeverity(finding2.severity)] += 1;
   }
   return counts;
 }
@@ -1663,12 +1922,12 @@ function sourceLabel(source) {
   if (source === "url") return "public URL scan";
   return "manual intake";
 }
-function coverageArea(id, status, evidence, confidence) {
+function coverageArea(id, status, evidence2, confidence) {
   return {
     id,
     label: COVERAGE_LABELS[id],
     status,
-    evidence,
+    evidence: evidence2,
     confidence: confidence ?? (status === "checked" ? "high" : status === "partial" ? "medium" : "low")
   };
 }
@@ -1694,7 +1953,7 @@ function coverageForSource(source) {
       coverageArea(
         "auth",
         "not_checked",
-        "Private routes and role guards cannot be proven from a public unauthenticated fetch."
+        "Private routes, role guards, OTP delivery, phone normalization, resend behavior, and recovery paths cannot be proven from a public unauthenticated fetch."
       ),
       coverageArea(
         "paid_api",
@@ -1741,7 +2000,7 @@ function coverageForSource(source) {
       coverageArea(
         "auth",
         "partial",
-        "Static auth-risk signals were checked; runtime role behavior still needs verification."
+        "Static auth and OTP-risk signals were checked; runtime role behavior and real email/SMS delivery still need verification."
       ),
       coverageArea(
         "paid_api",
@@ -1787,7 +2046,7 @@ function coverageForSource(source) {
     coverageArea(
       "auth",
       "partial",
-      "Manual evidence can mention auth risk; runtime verification is still required.",
+      "Manual evidence can mention auth and OTP risk; runtime verification and delivered-code smoke are still required.",
       "low"
     ),
     coverageArea(
@@ -1837,10 +2096,10 @@ function defaultWhy(severity, source) {
   }
   return `This is lower-priority readiness polish, but it still belongs in the fix queue before the launch proof is treated as clean.`;
 }
-function locationLine(finding) {
-  if (finding.location?.trim()) return finding.location.trim();
-  if (!finding.file?.trim()) return "";
-  return finding.line ? `${finding.file.trim()}:${finding.line}` : finding.file.trim();
+function locationLine(finding2) {
+  if (finding2.location?.trim()) return finding2.location.trim();
+  if (!finding2.file?.trim()) return "";
+  return finding2.line ? `${finding2.file.trim()}:${finding2.line}` : finding2.file.trim();
 }
 function defaultPrompt(input) {
   const where = input.location ? `Likely location: ${input.location}.` : "Inspect the relevant app, deploy, and configuration files before editing.";
@@ -1856,37 +2115,37 @@ function defaultPrompt(input) {
     "Make the smallest production-safe change, preserve existing behavior, list files changed, and do not suppress the scanner unless you prove a false positive."
   ].join(" ");
 }
-function normalizeLaunchFinding(finding, source = "manual") {
-  const severity = canonicalSeverity(finding.severity);
+function normalizeLaunchFinding(finding2, source = "manual") {
+  const severity = canonicalSeverity(finding2.severity);
   const title = clampText2(
-    finding.title ?? finding.itemTitle,
+    finding2.title ?? finding2.itemTitle,
     "Launch-readiness finding",
     160
   );
   const body = clampText2(
-    finding.body ?? finding.message,
+    finding2.body ?? finding2.message,
     "The scan flagged this as a launch-readiness risk.",
     3e3
   );
-  const whatFailed = clampText2(finding.whatFailed, body, 3e3);
+  const whatFailed = clampText2(finding2.whatFailed, body, 3e3);
   const whyItBlocksLaunch = clampText2(
-    finding.whyItBlocksLaunch,
+    finding2.whyItBlocksLaunch,
     body || defaultWhy(severity, source),
     3e3
   );
   const fixInstructions = clampText2(
-    finding.fixInstructions ?? finding.fixPrompt,
+    finding2.fixInstructions ?? finding2.fixPrompt,
     `Fix the underlying ${severity} launch-readiness risk and keep the app behavior intact.`,
     4e3
   );
   const verificationStep = clampText2(
-    finding.verificationStep ?? finding.verify,
+    finding2.verificationStep ?? finding2.verify,
     "Run the same scan again and confirm this finding is gone before launch.",
     3e3
   );
-  const location = locationLine(finding);
+  const location = locationLine(finding2);
   const aiBuilderPrompt = clampText2(
-    finding.aiBuilderPrompt,
+    finding2.aiBuilderPrompt,
     defaultPrompt({
       severity,
       title,
@@ -1898,13 +2157,13 @@ function normalizeLaunchFinding(finding, source = "manual") {
     }),
     4e3
   );
-  const evidence = clampText2(
-    finding.evidence,
+  const evidence2 = clampText2(
+    finding2.evidence,
     location ? `Observed at ${location}.` : body,
     3e3
   );
   const confidence = normalizeConfidence(
-    finding.confidence,
+    finding2.confidence,
     confidenceForSource(source)
   );
   return {
@@ -1915,21 +2174,21 @@ function normalizeLaunchFinding(finding, source = "manual") {
     fixInstructions,
     aiBuilderPrompt,
     verificationStep,
-    evidence,
+    evidence: evidence2,
     confidence,
     body,
     message: body,
     fixPrompt: aiBuilderPrompt,
     verify: verificationStep,
     ...location ? { location } : {},
-    ...finding.file ? { file: finding.file } : {},
-    ...finding.line ? { line: finding.line } : {},
-    ...finding.permalink ? { permalink: finding.permalink } : {},
-    ...finding.itemTitle ? { itemTitle: finding.itemTitle } : {}
+    ...finding2.file ? { file: finding2.file } : {},
+    ...finding2.line ? { line: finding2.line } : {},
+    ...finding2.permalink ? { permalink: finding2.permalink } : {},
+    ...finding2.itemTitle ? { itemTitle: finding2.itemTitle } : {}
   };
 }
 function prioritizeLaunchFindings(findings, source = "manual") {
-  return findings.map((finding) => normalizeLaunchFinding(finding, source)).sort((a, b) => {
+  return findings.map((finding2) => normalizeLaunchFinding(finding2, source)).sort((a, b) => {
     const bySeverity = SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
     if (bySeverity !== 0) return bySeverity;
     return a.title.localeCompare(b.title);
@@ -1986,7 +2245,7 @@ function topNextStep(blockers, counts, source) {
   return "Attach this clean scan proof to the launch record and keep monitoring the first production traffic.";
 }
 function aggregateConfidence(source, findings) {
-  if (findings.some((finding) => finding.confidence === "low")) return "low";
+  if (findings.some((finding2) => finding2.confidence === "low")) return "low";
   if (source === "url") return "medium";
   return "high";
 }
@@ -2003,7 +2262,7 @@ function assessLaunchReadiness(input) {
   const checkedAreas = coverage.filter((area) => area.status === "checked");
   const uncheckedAreas = coverage.filter((area) => area.status !== "checked");
   const blockers = findings.filter(
-    (finding) => finding.severity === "critical" || finding.severity === "high"
+    (finding2) => finding2.severity === "critical" || finding2.severity === "high"
   );
   const decision = decisionText(band, counts, source);
   const reportRecommended = counts.critical > 0 || counts.high > 0 || coveragePenalty > 0;
@@ -2080,8 +2339,8 @@ function parseArgs(argv2) {
     else if (a === "--proof") opts.proof = true;
     else if (a === "--no-color") opts.noColor = true;
     else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
-    else if (a === "--cwd") opts.cwd = path11.resolve(argv2[++i] ?? opts.cwd);
-    else if (!a.startsWith("-")) opts.cwd = path11.resolve(a);
+    else if (a === "--cwd") opts.cwd = path12.resolve(argv2[++i] ?? opts.cwd);
+    else if (!a.startsWith("-")) opts.cwd = path12.resolve(a);
   }
   return opts;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",