shipready 1.3.0 → 1.3.2

package/dist/checks/secrets.js

@@ -196,16 +196,19 @@ const PATTERNS = [
     {
         // Placeholder checks run against the password only (group 1), so
         // documentation hosts like db.example.com don't suppress real leaks.
+        // The host (group 2) downgrades localhost URLs to medium confidence.
         kind: "Database URL with password",
-        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqp):\/\/[^:\s"'@/]+:([^@\s"']+)@/,
+        re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|rediss|amqp):\/\/[^:\s"'@/]+:([^@\s"']+)@([^\s"'/:?]+)/,
         confidence: "high",
         group: 1,
+        hostGroup: 2,
     },
     {
         kind: "Basic auth in URL",
-        re: /https?:\/\/[^:\s"'/@]{3,}:([^@\s"']{8,})@/,
+        re: /https?:\/\/[^:\s"'/@]{3,}:([^@\s"']{8,})@([^\s"'/:?]+)/,
         confidence: "medium",
         group: 1,
+        hostGroup: 2,
         minEntropy: 3.0,
     },
     {
@@ -240,6 +243,13 @@ const PLACEHOLDER_VALUE_RE = /your[-_ ]?|example|sample|placeholder|change[-_ ]?
 const PLACEHOLDER_LINE_RE = /\b(?:do not commit|for docs only|shipready-ignore)\b|<[A-Z_][A-Z0-9_ -]*>/i;
 /** Paths whose findings are downgraded to medium confidence. */
 const TEST_PATH_RE = /(^|[/\\])(tests?|__tests__|__mocks__|spec|specs|fixtures?|mocks?|examples?|samples?|docs?)([/\\]|$)|\.(test|spec)\.[a-z]+$/i;
+/**
+ * Default/dev passwords that appear in scaffolding templates and docker
+ * compose files. A URL credential equal to one of these is not a leak.
+ */
+const COMMON_DEV_PASSWORD_RE = /^(?:password|passwd|pass|root|admin|postgres|mysql|mongo|redis|rabbitmq|secret|test|dev|guest|user|toor|changeit|letmein|qwerty)$/i;
+/** Hosts that indicate a local dev database, not a production leak. */
+const LOCAL_HOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[?::1\]?|host\.docker\.internal|db|database|postgres|mysql|mongo|redis)$/i;
 /** True when a matched value looks like a placeholder or templated string. */
 function isPlaceholderValue(value) {
     if (PLACEHOLDER_VALUE_RE.test(value))
@@ -293,7 +303,16 @@ export function scanContentForSecrets(content, file, allowlist = []) {
             if (allowlist.some((a) => match[0].includes(a) || line.includes(a))) {
                 continue;
             }
-            const confidence = isTestPath ? "medium" : pattern.confidence;
+            let effective = pattern.confidence;
+            if (pattern.hostGroup !== undefined) {
+                // Scaffolding defaults like root:password@localhost are not leaks.
+                if (COMMON_DEV_PASSWORD_RE.test(value))
+                    continue;
+                const host = match[pattern.hostGroup] ?? "";
+                if (LOCAL_HOST_RE.test(host))
+                    effective = "medium";
+            }
+            const confidence = isTestPath ? "medium" : effective;
             found.push({
                 kind: pattern.kind,
                 file,

package/dist/scanner.js

@@ -34,6 +34,12 @@ export function scanFiles(root, files, secretAllowlist = []) {
     const envUsages = [];
     const secrets = [];
     const todos = [];
+    /**
+     * Directories where console.log and friends are intentional (demo code,
+     * benchmarks, scripts). Secrets are still scanned there - a leaked key in
+     * an example is just as dangerous - but hygiene noise is skipped.
+     */
+    const HYGIENE_EXEMPT_RE = /(?:^|\/)(?:examples?|demos?|benchmarks?|scripts?|playground)\//;
     for (const file of files) {
         const base = path.basename(file);
         // Never flag .env files themselves for secrets/todos; they are expected
@@ -48,7 +54,9 @@ export function scanFiles(root, files, secretAllowlist = []) {
             continue;
         if (isCode) {
             envUsages.push(...extractEnvUsages(content, file));
-            todos.push(...scanContentForTodos(content, file));
+            if (!HYGIENE_EXEMPT_RE.test(file)) {
+                todos.push(...scanContentForTodos(content, file));
+            }
         }
         if (!isEnvFile && base !== ".env.example" && base !== ".env.sample") {
             secrets.push(...scanContentForSecrets(content, file, secretAllowlist));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",