shipready 1.5.0 → 1.5.1

package/README.md

@@ -363,13 +363,26 @@ pnpm dev      # run the CLI from source (tsx)
 
 See [CONTRIBUTING.md](./CONTRIBUTING.md) for project structure and how to add new checks or secret patterns.
 
+## How does it compare to gitleaks?
+
+Measured head-to-head on a corpus of 7 real-format leaks and 10 false-positive baits (gitleaks v8.24.3):
+
+| | shipready | gitleaks |
+| --- | --- | --- |
+| Real leaks caught | **7 / 7** | 4 / 7 |
+| Error-level false positives | **0** | 1 |
+| Newer key formats (`sk-proj-`, `sk-ant-`) | ✓ | missed |
+| Committed `.env.backup` | ✓ | partial |
+
+gitleaks remains more battle-tested for deep git-history forensics with hundreds of rules. shipready covers the leaks that actually happen in modern AI-assisted projects — plus README, env hygiene, and code hygiene that gitleaks doesn't check at all. Full methodology, fairness notes, and reproduction steps: [BENCHMARK.md](./BENCHMARK.md).
+
 ## Roadmap
 
 - [x] `shipready staged` for pre-commit hooks
 - [x] SARIF report output for GitHub code scanning
 - [x] Git history scanning (`--history`)
 - [x] Live key verification (`--verify`)
-- [ ] Benchmark against gitleaks/trufflehog with published numbers
+- [x] Benchmark against gitleaks with published numbers ([BENCHMARK.md](./BENCHMARK.md))
 - [ ] Framework-aware scoring (Next.js vs Vite vs Python have different needs)
 - [ ] Optional AI-powered fix suggestions (bring your own key)
 

package/dist/checks/secrets.js

@@ -232,6 +232,17 @@ const PATTERNS = [
         group: 1,
         minEntropy: 3.8,
     },
+    {
+        // Unquoted dotenv-style assignment (KEY=value at line start). Catches
+        // committed .env backups where values carry no quotes - a gap found by
+        // benchmarking against gitleaks. Anchored to line start so ordinary
+        // code assignments (always quoted) don't double-match.
+        kind: "Hardcoded credential",
+        re: /^[A-Z0-9_]*(?:API_?KEY|SECRET(?:_KEY)?|ACCESS_TOKEN|AUTH_TOKEN|PASSWORD|PASSWD|CREDENTIALS?)[A-Z0-9_]*=([A-Za-z0-9+/_.=-]{16,})\s*$/,
+        confidence: "medium",
+        group: 1,
+        minEntropy: 3.8,
+    },
 ];
 /** Words and shapes that indicate a placeholder, not a real secret. */
 const PLACEHOLDER_VALUE_RE = /your[-_ ]?|example|sample|placeholder|change[-_ ]?me|dummy|fake|insert|replace|redacted|deadbeef|lorem|goes[-_ ]?here|test[-_ ]?key|x{4,}|\*{3,}|\.\.\.|123456|abcdef/i;

package/dist/scanner.js

@@ -42,11 +42,18 @@ export function scanFiles(root, files, secretAllowlist = []) {
      * an example is just as dangerous - but hygiene noise is skipped.
      */
     const HYGIENE_EXEMPT_RE = /(?:^|\/)(?:examples?|demos?|benchmarks?|scripts?|playground)\//;
+    /**
+     * Standard env file names that legitimately hold real values and are
+     * expected to be gitignored - the env check owns those. Anything else
+     * that merely starts with ".env" (.env.backup, .env.old, .env.prod)
+     * is a copy someone made and MUST be scanned: benchmark testing showed
+     * gitleaks catches committed .env backups while we used to skip them.
+     */
+    const STANDARD_ENV_RE = /^\.env(?:\.(?:local|development|production|test|staging))?(?:\.local)?$/;
     for (const file of files) {
         const base = path.basename(file);
-        // Never flag .env files themselves for secrets/todos; they are expected
-        // to contain real values and are handled by the env check.
-        const isEnvFile = base.startsWith(".env");
+        const isStandardEnv = STANDARD_ENV_RE.test(base);
+        const isEnvTemplate = base === ".env.example" || base === ".env.sample" || base === ".env.template";
         const ext = path.extname(file).toLowerCase();
         const isCode = CODE_ONLY.has(ext);
         if (isProbablyBinary(root, file))
@@ -60,7 +67,7 @@ export function scanFiles(root, files, secretAllowlist = []) {
                 todos.push(...scanContentForTodos(content, file));
             }
         }
-        if (!isEnvFile && base !== ".env.example" && base !== ".env.sample") {
+        if (!isStandardEnv && !isEnvTemplate) {
             secrets.push(...scanContentForSecrets(content, file, secretAllowlist));
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",