shipready 1.3.0 → 1.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/scanner.js +9 -1
  2. package/package.json +1 -1
package/dist/scanner.js CHANGED
@@ -34,6 +34,12 @@ export function scanFiles(root, files, secretAllowlist = []) {
34
34
  const envUsages = [];
35
35
  const secrets = [];
36
36
  const todos = [];
37
+ /**
38
+ * Directories where console.log and friends are intentional (demo code,
39
+ * benchmarks, scripts). Secrets are still scanned there - a leaked key in
40
+ * an example is just as dangerous - but hygiene noise is skipped.
41
+ */
42
+ const HYGIENE_EXEMPT_RE = /(?:^|\/)(?:examples?|demos?|benchmarks?|scripts?|playground)\//;
37
43
  for (const file of files) {
38
44
  const base = path.basename(file);
39
45
  // Never flag .env files themselves for secrets/todos; they are expected
@@ -48,7 +54,9 @@ export function scanFiles(root, files, secretAllowlist = []) {
48
54
  continue;
49
55
  if (isCode) {
50
56
  envUsages.push(...extractEnvUsages(content, file));
51
- todos.push(...scanContentForTodos(content, file));
57
+ if (!HYGIENE_EXEMPT_RE.test(file)) {
58
+ todos.push(...scanContentForTodos(content, file));
59
+ }
52
60
  }
53
61
  if (!isEnvFile && base !== ".env.example" && base !== ".env.sample") {
54
62
  secrets.push(...scanContentForSecrets(content, file, secretAllowlist));
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "shipready",
3
- "version": "1.3.0",
3
+ "version": "1.3.1",
4
4
  "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
5
5
  "type": "module",
6
6
  "license": "MIT",