shipwarden 0.0.0-stage → 0.2.0

package/src/rules/secrets.js

@@ -0,0 +1,121 @@
+import { isClientCode, lineAt, looksLikePlaceholder, makeFinding } from '../util.js';
+
+const ROTATE = 'Removing it from the code is not enough: it stays in git history and in any build you already deployed.';
+
+const PATTERNS = [
+  { name: 'Stripe live secret key', re: /\b[sr]k_live_[0-9a-zA-Z]{20,}\b/g, severity: 'critical', where: 'the Stripe dashboard (Developers → API keys)' },
+  { name: 'OpenAI API key', re: /\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{30,}|\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/g, severity: 'critical', where: 'platform.openai.com → API keys' },
+  { name: 'Anthropic API key', re: /\bsk-ant-(?:api|admin)\d{2}-[A-Za-z0-9_-]{40,}/g, severity: 'critical', where: 'the Claude Console → API keys' },
+  { name: 'Supabase secret key', re: /\bsb_secret_[A-Za-z0-9_-]{20,}/g, severity: 'critical', where: 'Supabase → Project Settings → API Keys' },
+  { name: 'AWS access key', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, severity: 'high', where: 'the AWS IAM console' },
+  { name: 'GitHub token', re: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{50,})\b/g, severity: 'high', where: 'GitHub → Settings → Developer settings' },
+  { name: 'Slack token', re: /\bxox[abposr]-[A-Za-z0-9-]{10,}/g, severity: 'high', where: 'your Slack app settings' },
+  { name: 'SendGrid API key', re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/g, severity: 'high', where: 'SendGrid → Settings → API Keys' },
+  // Header plus an actual key body (also as an escaped "\\n" in JSON), not code that builds a PEM at runtime.
+  { name: 'private key', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----(?:\s|\\n)*[A-Za-z0-9+/=]{40,}/g, severity: 'critical', where: 'wherever it was issued' },
+];
+
+const JWT = /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g;
+
+function jwtPayload(token) {
+  try {
+    return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString('utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export const serviceRoleKey = {
+  id: 'supabase-service-role-key',
+  title: 'Supabase service_role key is in the code',
+  severity: 'critical',
+  check(file, ctx) {
+    const findings = [];
+    for (const m of file.content.matchAll(JWT)) {
+      if (jwtPayload(m[0])?.role !== 'service_role') continue;
+      const inBrowser = isClientCode(file, ctx);
+      findings.push(
+        makeFinding(this, file.path, lineAt(file.content, m.index), {
+          message:
+            'This is your Supabase `service_role` key. It skips every Row Level Security rule, so anyone who gets it can read, change or delete everything in your database' +
+            (inBrowser ? ', and this file is shipped to every visitor\'s browser.' : '.'),
+          fix: `Rotate the key now in Supabase (Project Settings → API Keys), delete it from the code, and only use it in server code through an environment variable with no NEXT_PUBLIC_/VITE_ prefix. ${ROTATE}`,
+        }),
+      );
+    }
+    return findings;
+  },
+};
+
+export const hardcodedSecret = {
+  id: 'hardcoded-secret',
+  title: 'Secret key committed to the repo',
+  severity: 'critical',
+  check(file) {
+    // Docs are full of illustrative keys; a real one there is rare enough to accept missing.
+    if (/\.md$|(^|\/)docs?\//i.test(file.path)) return [];
+    const findings = [];
+    for (const p of PATTERNS) {
+      for (const m of file.content.matchAll(p.re)) {
+        // Skip placeholders and regex literals such as a secret scanner's own patterns.
+        if (looksLikePlaceholder(m[0]) || file.content[m.index - 1] === '/') continue;
+        findings.push(
+          makeFinding(this, file.path, lineAt(file.content, m.index), {
+            severity: p.severity,
+            title: `${p.name[0].toUpperCase()}${p.name.slice(1)} committed to the repo`,
+            message: `A ${p.name} is written directly in this file. Anyone who can see the repo, or your shipped JavaScript if this runs in the browser, can use it on your account.`,
+            fix: `Revoke it in ${p.where}, then load the new one from a server-side environment variable. ${ROTATE}`,
+          }),
+        );
+      }
+    }
+    return findings;
+  },
+};
+
+const PUBLIC_VAR = /\b(NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|REACT_APP_|NUXT_PUBLIC_|PUBLIC_)([A-Z0-9_]+)/g;
+const CRITICAL_NAME = /SERVICE_ROLE|(^|_)SECRET(_|$)|PRIVATE_KEY|DATABASE_URL$|DB_URL$|POSTGRES_URL$|PASSWORD$/;
+const AI_KEY_NAME = /(^|_)(OPENAI|ANTHROPIC|CLAUDE|GEMINI|GOOGLE_AI|GROQ|MISTRAL|REPLICATE|ELEVENLABS|RESEND|SENDGRID|TWILIO|DEEPSEEK|PERPLEXITY|OPENROUTER|XAI|TOGETHER|FAL|COHERE|HUGGINGFACE|HF)_(API_)?(KEY|TOKEN)$/;
+
+export const publicEnvSecret = {
+  id: 'public-env-secret',
+  title: 'Secret exposed through a public env variable',
+  severity: 'critical',
+  check(file) {
+    const findings = [];
+    const seen = new Set();
+    for (const m of file.content.matchAll(PUBLIC_VAR)) {
+      const [name, prefix, rest] = m;
+      if (seen.has(name) || /PUBLISHABLE|ANON/.test(rest)) continue;
+      const critical = CRITICAL_NAME.test(rest);
+      if (!critical && !AI_KEY_NAME.test(rest)) continue;
+      // The ai-key-in-browser finding already covers an AI key used from browser code.
+      if (!critical && /dangerouslyAllowBrowser\s*:\s*true/.test(file.content)) continue;
+      seen.add(name);
+      findings.push(
+        makeFinding(this, file.path, lineAt(file.content, m.index), {
+          severity: critical ? 'critical' : 'high',
+          title: `\`${name}\` is exposed to the browser`,
+          message: `Variables starting with \`${prefix}\` are copied into your frontend JavaScript at build time, so anyone can open dev tools and read \`${name}\`.`,
+          fix: `Rename it without the \`${prefix}\` prefix and only use it in server code (API routes, server actions, edge functions). Then rotate the value, because every deployed build already contains it.`,
+        }),
+      );
+    }
+    return findings;
+  },
+};
+
+export const aiKeyInBrowser = {
+  id: 'ai-key-in-browser',
+  title: 'AI API key is sent to the browser',
+  severity: 'high',
+  message:
+    'The AI client is created with `dangerouslyAllowBrowser` switched on, so your API key ships to every visitor. Anyone can copy it and run up your bill.',
+  fix: 'Move the AI call into a server route, server action or edge function, and call that from the browser instead.',
+  check(file) {
+    const m = /dangerouslyAllowBrowser\s*:\s*true/.exec(file.content);
+    return m ? [makeFinding(this, file.path, lineAt(file.content, m.index))] : [];
+  },
+};
+
+export default [serviceRoleKey, hardcodedSecret, publicEnvSecret, aiKeyInBrowser];

package/src/rules/supabase.js

@@ -0,0 +1,293 @@
+import { blank, lineAt, makeFinding } from '../util.js';
+
+const IDENT = String.raw`(?:"[^"]+"|[A-Za-z_][\w$]*)`;
+const QNAME = String.raw`(?<name>${IDENT}(?:\s*\.\s*${IDENT})?)`;
+
+const STATEMENTS = {
+  createTable: new RegExp(String.raw`\bcreate\s+(?:(?:global|local)\s+)?(?<temp>temp(?:orary)?\s+)?(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${QNAME}`, 'gi'),
+  dropTable: new RegExp(String.raw`\bdrop\s+table\s+(?:if\s+exists\s+)?${QNAME}`, 'gi'),
+  toggleRls: new RegExp(String.raw`\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${QNAME}\s+(?<mode>enable|disable)\s+row\s+level\s+security`, 'gi'),
+  createView: new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?(?<mat>materialized\s+)?view\s+(?:if\s+not\s+exists\s+)?${QNAME}(?<rest>[^;]*)`, 'gi'),
+  alterView: new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${QNAME}\s+set\s*\((?<opts>[^)]*)\)`, 'gi'),
+  dropView: new RegExp(String.raw`\bdrop\s+(?:materialized\s+)?view\s+(?:if\s+exists\s+)?${QNAME}`, 'gi'),
+};
+
+// Matched with DO-block bodies kept: Lovable/AI migrations often wrap these in `DO $$ BEGIN ... END $$`.
+const IN_BLOCKS = {
+  toggleRls: STATEMENTS.toggleRls,
+  createPolicy: new RegExp(String.raw`\bcreate\s+policy\s+(?<policy>"[^"]+"|[\w$]+)\s+on\s+${QNAME}(?<body>[^;]*)`, 'gi'),
+  dropPolicy: new RegExp(String.raw`\bdrop\s+policy\s+(?:if\s+exists\s+)?(?<policy>"[^"]+"|[\w$]+)\s+on\s+${QNAME}`, 'gi'),
+};
+delete STATEMENTS.toggleRls;
+
+const DYNAMIC_RLS = /format\s*\(\s*'+[^']*?%I\s+enable\s+row\s+level\s+security/gi;
+const DO_START = /\bdo\s*(\$\w*\$)/gi;
+
+/**
+ * `execute format('alter table public.%I enable row level security', t)` inside a DO block.
+ * Returns the tables it covers: explicit names from the loop's array, or every table when it
+ * iterates over the catalog.
+ */
+function dynamicRls(text) {
+  const out = [];
+  for (const m of text.matchAll(DYNAMIC_RLS)) {
+    let start = Math.max(0, m.index - 3000);
+    let end = m.index + 500;
+    for (const d of text.matchAll(DO_START)) {
+      if (d.index > m.index) break;
+      start = d.index;
+      const close = text.indexOf(d[1], d.index + d[0].length);
+      end = close === -1 ? text.length : close;
+    }
+    const block = text.slice(start, end);
+    const all = /pg_tables|information_schema\.tables|pg_class/i.test(block);
+    const names = [...block.matchAll(/'([A-Za-z_][\w$]*)'/g)].map((n) => n[1].toLowerCase()).filter((n) => n !== 'public');
+    out.push({ index: m.index, all, names });
+  }
+  return out;
+}
+
+/** Blank out comments and (unless keepBodies) dollar-quoted bodies, keeping offsets intact. */
+export function cleanSql(sql, { keepBodies = false } = {}) {
+  let out = '';
+  let i = 0;
+  while (i < sql.length) {
+    const c = sql[i];
+    const n = sql[i + 1];
+    let j;
+    if (c === '-' && n === '-') {
+      j = sql.indexOf('\n', i);
+      if (j === -1) j = sql.length;
+      out += blank(sql.slice(i, j));
+    } else if (c === '/' && n === '*') {
+      j = sql.indexOf('*/', i + 2);
+      j = j === -1 ? sql.length : j + 2;
+      out += blank(sql.slice(i, j));
+    } else if (c === "'") {
+      j = i + 1;
+      while (j < sql.length && !(sql[j] === "'" && sql[j + 1] !== "'")) j += sql[j] === "'" ? 2 : 1;
+      j = Math.min(j + 1, sql.length);
+      out += sql.slice(i, j);
+    } else if (!keepBodies && c === '$' && /^\$(?:[A-Za-z_]\w*)?\$/.test(sql.slice(i, i + 64))) {
+      const tag = /^\$(?:[A-Za-z_]\w*)?\$/.exec(sql.slice(i, i + 64))[0];
+      const end = sql.indexOf(tag, i + tag.length);
+      j = end === -1 ? sql.length : end + tag.length;
+      out += blank(sql.slice(i, j));
+    } else {
+      j = i + 1;
+      out += c;
+    }
+    i = j;
+  }
+  return out;
+}
+
+function parseName(raw) {
+  const parts = raw.match(/"[^"]+"|[A-Za-z_][\w$]*/g).map((p) => (p.startsWith('"') ? p.slice(1, -1) : p.toLowerCase()));
+  return parts.length > 1 ? { schema: parts[0], name: parts[1] } : { schema: 'public', name: parts[0] };
+}
+
+function invokerOn(opts) {
+  const m = /security_invoker(?:\s*=\s*'?(\w+)'?)?/i.exec(opts ?? '');
+  return !!m && (!m[1] || /^(true|on|1|yes)$/i.test(m[1]));
+}
+
+const cache = new WeakMap();
+
+/**
+ * Replay the migrations in order to work out the final state of tables, views and policies.
+ * When the repo has supabase/migrations, only those count: other .sql files are usually
+ * backups, snapshots or docs. RLS enabled in *any* .sql file still clears a table, because a
+ * false "your data is public" alarm costs more trust than a missed one.
+ */
+function analyze(files) {
+  if (cache.has(files)) return cache.get(files);
+  const sql = files.filter((f) => f.path.endsWith('.sql'));
+  const migrations = sql.filter((f) => /(^|\/)supabase\/(migrations|schemas)\//.test(f.path));
+  const replayed = (migrations.length ? migrations : sql).sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+
+  const enabledAnywhere = new Set();
+  for (const file of sql) {
+    for (const m of cleanSql(file.content, { keepBodies: true }).matchAll(IN_BLOCKS.toggleRls)) {
+      const { schema, name } = parseName(m.groups.name);
+      if (m.groups.mode.toLowerCase() === 'enable') enabledAnywhere.add(`${schema}.${name}`);
+    }
+    for (const d of dynamicRls(cleanSql(file.content, { keepBodies: true }))) {
+      for (const n of d.names) enabledAnywhere.add(`public.${n}`);
+    }
+  }
+
+  const events = [];
+  replayed.forEach((file, fi) => {
+    const groups = [
+      [cleanSql(file.content), STATEMENTS],
+      [cleanSql(file.content, { keepBodies: true }), IN_BLOCKS],
+    ];
+    for (const [text, statements] of groups) {
+      for (const [kind, re] of Object.entries(statements)) {
+        for (const m of text.matchAll(re)) events.push({ fi, kind, m, file });
+      }
+    }
+    for (const d of dynamicRls(groups[1][0])) events.push({ fi, kind: 'dynamicRls', m: { index: d.index }, d, file });
+  });
+  events.sort((a, b) => a.fi - b.fi || a.m.index - b.m.index);
+
+  const tables = new Map();
+  const views = new Map();
+  const policies = new Map();
+  for (const { kind, m, file, d } of events) {
+    if (kind === 'dynamicRls') {
+      for (const t of tables.values()) if (t.schema === 'public' && (d.all || d.names.includes(t.name.toLowerCase()))) t.rls = true;
+      continue;
+    }
+    const { schema, name } = parseName(m.groups.name);
+    const key = `${schema}.${name}`;
+    const loc = { file: file.path, line: lineAt(file.content, m.index) };
+    if (kind === 'createTable') {
+      const parent = new RegExp(String.raw`^\s*partition\s+of\s+${QNAME}`, 'i').exec(file.content.slice(m.index + m[0].length, m.index + m[0].length + 300));
+      const partitionOf = parent && parseName(parent.groups.name).name;
+      if (!m.groups.temp && !tables.has(key)) tables.set(key, { schema, name, rls: false, partitionOf, ...loc });
+    } else if (kind === 'dropTable') {
+      tables.delete(key);
+    } else if (kind === 'toggleRls') {
+      const enable = m.groups.mode.toLowerCase() === 'enable';
+      const table = tables.get(key) ?? { schema, name, ...loc };
+      table.rls = enable;
+      if (!enable) Object.assign(table, loc, { disabledExplicitly: true });
+      tables.set(key, table);
+    } else if (kind === 'createView') {
+      const withOpts = /^\s*with\s*\(([^)]*)\)/i.exec(m.groups.rest)?.[1];
+      views.set(key, { schema, name, materialized: !!m.groups.mat, invoker: invokerOn(withOpts), ...loc });
+    } else if (kind === 'alterView') {
+      const view = views.get(key);
+      if (view && invokerOn(m.groups.opts)) view.invoker = true;
+    } else if (kind === 'dropView') {
+      views.delete(key);
+    } else if (kind === 'createPolicy') {
+      policies.set(`${key}:${m.groups.policy}`, { schema, name, body: m.groups.body, ...loc });
+    } else if (kind === 'dropPolicy') {
+      policies.delete(`${key}:${m.groups.policy}`);
+    }
+  }
+  for (const [key, t] of tables) {
+    if (!t.rls && !t.disabledExplicitly && enabledAnywhere.has(key)) t.rls = true;
+  }
+  const result = { tables, views, policies: [...policies.values()] };
+  cache.set(files, result);
+  return result;
+}
+
+export const rlsDisabled = {
+  id: 'supabase-rls-disabled',
+  title: 'Row Level Security is off',
+  severity: 'critical',
+  checkAll(files, ctx) {
+    if (!ctx.usesSupabase) return [];
+    const findings = [];
+    const partitions = new Map();
+    for (const t of analyze(files).tables.values()) {
+      if (t.rls || t.schema !== 'public') continue;
+      if (t.partitionOf) {
+        if (!partitions.has(t.partitionOf)) partitions.set(t.partitionOf, []);
+        partitions.get(t.partitionOf).push(t);
+        continue;
+      }
+      findings.push(
+        makeFinding(this, t.file, t.line, {
+          title: `Row Level Security is off for table \`${t.name}\``,
+          message:
+            `${t.disabledExplicitly ? 'This migration turns Row Level Security off' : 'This table is created without Row Level Security'}. ` +
+            'Supabase serves every table in the `public` schema through its API, and your anon key is public (it is in your frontend), ' +
+            `so anyone can read, change or delete every row in \`${t.name}\`.`,
+          fix:
+            `Add a migration with \`alter table public.${t.name} enable row level security;\` and then policies that limit rows to their owner, ` +
+            `e.g. \`create policy "Owners can read" on public.${t.name} for select using (auth.uid() = user_id);\``,
+        }),
+      );
+    }
+    for (const [parent, parts] of partitions) {
+      const [first] = parts;
+      findings.push(
+        makeFinding(this, first.file, first.line, {
+          title: `Row Level Security is off for ${parts.length} partition${parts.length === 1 ? '' : 's'} of \`${parent}\``,
+          message:
+            `${parts.map((t) => `\`${t.name}\``).slice(0, 4).join(', ')}${parts.length > 4 ? ` and ${parts.length - 4} more` : ''} have no Row Level Security. ` +
+            "Supabase's API serves each partition as its own table, and the parent table's policies don't apply when a partition is queried directly.",
+          fix: `Enable RLS on every partition (\`alter table public.<partition> enable row level security;\`), or revoke API access to them: \`revoke all on public.<partition> from anon, authenticated;\``,
+        }),
+      );
+    }
+    return findings;
+  },
+};
+
+export const permissivePolicy = {
+  id: 'supabase-permissive-policy',
+  title: 'RLS policy allows everyone',
+  severity: 'high',
+  checkAll(files, ctx) {
+    if (!ctx.usesSupabase) return [];
+    const findings = [];
+    for (const p of analyze(files).policies) {
+      if (p.schema !== 'public' || /\bas\s+restrictive\b/i.test(p.body)) continue;
+      const cmd = (/\bfor\s+(all|select|insert|update|delete)\b/i.exec(p.body)?.[1] ?? 'all').toLowerCase();
+      const rolesRaw = /\bto\s+((?:"[^"]+"|[\w$]+)(?:\s*,\s*(?:"[^"]+"|[\w$]+))*)/i.exec(p.body)?.[1];
+      const roles = rolesRaw ? rolesRaw.split(',').map((r) => r.trim().replace(/"/g, '').toLowerCase()) : ['public'];
+      if (roles.every((r) => ['service_role', 'postgres', 'supabase_admin'].includes(r))) continue;
+      const usingTrue = /\busing\s*\(\s*true\s*\)/i.test(p.body);
+      const checkTrue = /\bwith\s+check\s*\(\s*true\s*\)/i.test(p.body);
+      const anyone = roles.some((r) => r === 'public' || r === 'anon');
+      const who = anyone ? 'anyone, even logged-out visitors,' : 'any logged-in user';
+      const whoShort = anyone ? 'anyone' : 'any logged-in user';
+
+      if (['all', 'update', 'delete'].includes(cmd) && usingTrue) {
+        const verb = { all: 'read, change and delete', update: 'change', delete: 'delete' }[cmd];
+        findings.push(
+          makeFinding(this, p.file, p.line, {
+            title: `RLS policy lets ${whoShort} ${verb} any row in \`${p.name}\``,
+            message: `\`using (true)\` never checks who owns the row, so this policy lets ${who} ${verb} every row in \`${p.name}\`.`,
+            fix: 'Replace `true` with an ownership check, e.g. `using (auth.uid() = user_id) with check (auth.uid() = user_id)`.',
+          }),
+        );
+      } else if (cmd === 'insert' && checkTrue) {
+        findings.push(
+          makeFinding(this, p.file, p.line, {
+            severity: 'low',
+            confidence: 'medium',
+            title: `RLS policy lets ${whoShort} insert anything into \`${p.name}\``,
+            message: `\`with check (true)\` lets ${who} insert rows with any values, including someone else's \`user_id\`. Fine for a public form, risky for user-owned data.`,
+            fix: 'If rows belong to a user, use `with check (auth.uid() = user_id)`.',
+          }),
+        );
+      }
+    }
+    return findings;
+  },
+};
+
+export const unsafeView = {
+  id: 'supabase-view-bypasses-rls',
+  title: 'View bypasses Row Level Security',
+  severity: 'medium',
+  checkAll(files, ctx) {
+    if (!ctx.usesSupabase) return [];
+    const findings = [];
+    for (const v of analyze(files).views.values()) {
+      if (v.schema !== 'public' || v.invoker) continue;
+      findings.push(
+        makeFinding(this, v.file, v.line, {
+          title: `View \`${v.name}\` bypasses Row Level Security`,
+          message: v.materialized
+            ? `Materialized views ignore RLS, and \`${v.name}\` is in the \`public\` schema, so anyone with your anon key can read all of it through the API.`
+            : `Views run with their creator's permissions by default, so \`${v.name}\` ignores the RLS policies on the tables it reads and anyone with your anon key can query it.`,
+          fix: v.materialized
+            ? `Move it to a schema that isn't exposed (e.g. \`private\`), or revoke access: \`revoke select on public.${v.name} from anon, authenticated;\``
+            : `Recreate it with \`create view public.${v.name} with (security_invoker = true) as ...\` (Postgres 15+), or \`alter view public.${v.name} set (security_invoker = true);\``,
+        }),
+      );
+    }
+    return findings;
+  },
+};
+
+export default [rlsDisabled, permissivePolicy, unsafeView];

package/src/rules/web.js

@@ -0,0 +1,193 @@
+import { EDGE_FUNCTION, ROUTE_HANDLER, hasDirective, isServerEndpoint, lineAt, makeFinding } from '../util.js';
+
+const MUTATING_EXPORT = /export\s+(?:async\s+)?function\s+(POST|PUT|PATCH|DELETE)\b|export\s+const\s+(POST|PUT|PATCH|DELETE)\s*=|\bas\s+(POST|PUT|PATCH|DELETE)\b/;
+
+const AUTH_CHECK = new RegExp(
+  [
+    String.raw`\b(?:getUser|getClaims|getSession|getServerSession|getServerAuthSession|currentUser|getAuth|verifyIdToken|verifySessionCookie|validateRequest|getToken|getKindeServerSession|jwtVerify|constructEvent|constructEventAsync|verifyWebhook|timingSafeEqual)\s*\(`,
+    String.raw`\b(?:require|check|ensure|assert|verify|with|is)(?:Auth|Authenticated|User|Admin|Session|Signature)\w*\s*\(`,
+    String.raw`\bauth\s*\(\s*\)`,
+    String.raw`\.protect\s*\(`,
+    String.raw`\bjwt\.verify\s*\(`,
+    String.raw`(?:===|!==)\s*(?:process\.env|Deno\.env\.get)\b`,
+    String.raw`[!=]==\s*\x60Bearer\s`,
+    String.raw`headers\.get\(\s*['"]x-[\w-]*(?:secret|token|key|signature)['"]\s*\)`,
+    String.raw`\.rpc\(\s*['"](?:has_role|is_admin|has_permission|check_\w+)['"]`,
+  ].join('|'),
+  'i',
+);
+const GUARD_NAME = /auth|guard|verif|require|protect|permission|assert|ensure|check/i;
+const CLIENT_FACTORY = /client$|^(create|get|new|init|make)\w*(client|supabase|stripe|db)/i;
+
+/** Calls an auth helper it imports or defines, e.g. `await authorize(req)` from ../_shared/authorize.ts. */
+function callsGuardHelper(code) {
+  const names = new Set();
+  for (const m of code.matchAll(/import\s*\{([^}]*)\}\s*from/g)) {
+    for (const part of m[1].split(',')) names.add(part.trim().split(/\s+as\s+/).pop());
+  }
+  for (const m of code.matchAll(/import\s+(\w+)\s*(?:,|from)/g)) names.add(m[1]);
+  for (const m of code.matchAll(/(?:function\s+|const\s+)(\w+)\s*(?:=\s*(?:async\s*)?\(|\()/g)) names.add(m[1]);
+  return [...names].some((n) => n && GUARD_NAME.test(n) && !CLIENT_FACTORY.test(n) && new RegExp(String.raw`\b${n}\s*\(`).test(code.replace(/import[^;]*;/g, '')));
+}
+
+const ADMIN_CLIENT = /service[_-]?role|supabaseAdmin|createAdminClient|createServiceClient|createServiceRoleClient|adminClient|SUPABASE_SECRET_KEY|\.auth\.admin\./i;
+const SUPABASE_WRITE = /\.from\(\s*['"`][^'"`]+['"`]\s*\)\s*\.(insert|update|upsert|delete)\s*\(|\.auth\.admin\.(deleteUser|updateUserById|createUser|inviteUserByEmail)\s*\(/;
+const ORM_WRITE = /\bprisma\.\w+\.(create|createMany|update|updateMany|upsert|delete|deleteMany)\s*\(|\bdb\.(insert|update|delete)\s*\(|\.(insertOne|insertMany|updateOne|updateMany|deleteOne|deleteMany|findOneAndUpdate|findOneAndDelete|findByIdAndUpdate|findByIdAndDelete)\s*\(|\bsql`\s*(insert|update|delete)\b/i;
+
+function endpointLabel(file) {
+  if (EDGE_FUNCTION.test(file.path)) return 'Supabase Edge Function';
+  if (ROUTE_HANDLER.test(file.path) || /pages\/api\//.test(file.path)) return 'API route';
+  return "server action (every exported function in a 'use server' file is a public endpoint anyone can call)";
+}
+
+export const unauthenticatedWrite = {
+  id: 'unauthenticated-write',
+  title: 'Endpoint changes data without checking who is calling',
+  severity: 'medium',
+  confidence: 'medium',
+  check(file) {
+    if (!isServerEndpoint(file)) return [];
+    const c = file.content;
+    if (ROUTE_HANDLER.test(file.path) && !MUTATING_EXPORT.test(c)) return [];
+    if (AUTH_CHECK.test(c) || callsGuardHelper(c)) return [];
+
+    // A plain Supabase client is still protected by RLS; the admin client is not.
+    const admin = ADMIN_CLIENT.test(c);
+    const m = (admin && SUPABASE_WRITE.exec(c)) || ORM_WRITE.exec(c);
+    if (!m) return [];
+    const viaAdmin = admin && SUPABASE_WRITE.test(m[0]);
+    const call = `${m[0].replace(/\s+/g, '').replace(/^\./, '')}${m[0].trim().endsWith('(') ? ')' : ''}`;
+    return [
+      makeFinding(this, file.path, lineAt(c, m.index), {
+        severity: viaAdmin ? 'high' : 'medium',
+        message:
+          `This ${endpointLabel(file)} writes to the database (\`${call}\`) but never checks who the caller is. ` +
+          (viaAdmin
+            ? 'It uses the Supabase admin/service-role client, which skips RLS, so anyone who finds the URL can change or delete any data.'
+            : 'Direct database clients skip Supabase RLS, so anyone who finds the URL can make this change.'),
+        fix:
+          'Check the user at the top of the handler and confirm they own the data before writing. For example: ' +
+          "`const { data: { user } } = await supabase.auth.getUser(); if (!user) return new Response('Unauthorized', { status: 401 })` " +
+          'If auth is enforced elsewhere (middleware, a wrapper), add a `shipwarden-ignore` comment above this line.',
+      }),
+    ];
+  },
+};
+
+const STRIPE_IMPORT = /import[^;]*['"][^'"]*\bstripe\b[^'"]*['"]|require\(\s*['"]stripe['"]\s*\)|new\s+Stripe\s*\(/;
+
+export const stripeWebhook = {
+  id: 'stripe-webhook-unverified',
+  title: 'Stripe webhook does not verify the signature',
+  severity: 'high',
+  message:
+    "This Stripe webhook handler never checks the `Stripe-Signature` header, so anyone can send it a fake \"payment succeeded\" event and unlock paid features for free.",
+  fix: "Verify every event: `const event = stripe.webhooks.constructEvent(rawBody, req.headers.get('stripe-signature'), process.env.STRIPE_WEBHOOK_SECRET)` (use `constructEventAsync` on Edge/Deno).",
+  check(file) {
+    if (!/webhook/i.test(file.path) || !/\.[cm]?[jt]sx?$/.test(file.path)) return [];
+    const c = file.content;
+    if (!STRIPE_IMPORT.test(c) || /constructEvent/.test(c)) return [];
+    const handler = /export\s+(?:async\s+)?function\s+POST\b|export\s+const\s+POST\b|export\s+default|\bserve\s*\(|Deno\.serve\s*\(/.exec(c);
+    return [makeFinding(this, file.path, handler ? lineAt(c, handler.index) : 1)];
+  },
+};
+
+export const getSessionOnServer = {
+  id: 'supabase-getsession-on-server',
+  title: 'Server trusts `getSession()` for auth',
+  severity: 'medium',
+  confidence: 'medium',
+  message:
+    "`supabase.auth.getSession()` reads the session from cookies without verifying it, so on the server a user can forge it. Supabase's docs say never to trust it in server code.",
+  fix: 'Use `supabase.auth.getUser()` (or `getClaims()`) for any auth decision on the server.',
+  check(file, ctx) {
+    if (!ctx.usesSupabase) return [];
+    const isServer =
+      isServerEndpoint(file) ||
+      /(^|\/)middleware\.[jt]s$/.test(file.path) ||
+      (/(^|\/)app\/(?:.*\/)?(page|layout)\.[jt]sx?$/.test(file.path) && !hasDirective(file.content, 'use client'));
+    if (!isServer || /\.auth\.(getUser|getClaims)\s*\(/.test(file.content)) return [];
+    const m = /\.auth\.getSession\s*\(/.exec(file.content);
+    return m ? [makeFinding(this, file.path, lineAt(file.content, m.index))] : [];
+  },
+};
+
+const SANITIZER = /DOMPurify|dompurify|sanitize-html|sanitizeHtml|isomorphic-dompurify|rehype-sanitize|\bxss\(/;
+
+export const unsafeHtml = {
+  id: 'xss-unsanitized-html',
+  title: 'Unsanitized HTML rendered with dangerouslySetInnerHTML',
+  severity: 'medium',
+  confidence: 'medium',
+  check(file) {
+    if (!/\.[jt]sx$/.test(file.path) || SANITIZER.test(file.content)) return [];
+    const findings = [];
+    for (const m of file.content.matchAll(/dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:\s*([^}]*?)\s*\}\}/g)) {
+      const expr = m[1];
+      if (/^(['"`])[^$]*\1$/.test(expr) || /JSON\.stringify|sanitiz|purify|escape/i.test(expr)) continue;
+      findings.push(
+        makeFinding(this, file.path, lineAt(file.content, m.index), {
+          message: `\`${expr}\` is inserted as raw HTML. If any part of it comes from users (or from an AI model), an attacker can run JavaScript in other users' browsers and steal their sessions.`,
+          fix: 'Render it as text, or sanitize first: `dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }}`.',
+        }),
+      );
+    }
+    return findings;
+  },
+};
+
+const RAW_SQL = [
+  /\$(?:queryRawUnsafe|executeRawUnsafe)\s*\(\s*`[^`]*\$\{/g,
+  /\$(?:queryRawUnsafe|executeRawUnsafe)\s*\(\s*(['"])(?:(?!\1)[^\n])*\1\s*\+/g,
+  /\.(?:query|execute)\s*\(\s*`[^`]*\b(?:select|insert|update|delete)\b[^`]*\$\{/gi,
+  /\.(?:query|execute)\s*\(\s*(['"])(?:(?!\1)[^\n])*\b(?:select|insert|update|delete)\b(?:(?!\1)[^\n])*\1\s*\+/gi,
+  /\b(?:knex|db|sql)\.raw\s*\(\s*`[^`]*\$\{/g,
+];
+
+export const sqlInjection = {
+  id: 'sql-injection',
+  title: 'SQL query built from string interpolation',
+  severity: 'high',
+  confidence: 'medium',
+  message: 'This query is built by pasting values into the SQL text. If any value comes from the request, an attacker can rewrite the query and read or delete your data.',
+  fix: "Pass values as parameters instead: Prisma's `$queryRaw` tagged template, `db.query('select ... where id = $1', [id])`, or your ORM's query builder.",
+  check(file) {
+    if (!/\.[cm]?[jt]sx?$/.test(file.path)) return [];
+    const seen = new Set();
+    const findings = [];
+    for (const re of RAW_SQL) {
+      for (const m of file.content.matchAll(re)) {
+        const line = lineAt(file.content, m.index);
+        if (seen.has(line)) continue;
+        seen.add(line);
+        findings.push(makeFinding(this, file.path, line));
+      }
+    }
+    return findings;
+  },
+};
+
+const ENV_FILE = /(^|\/)\.env(\.[\w.-]+)?$/;
+const ENV_TEMPLATE = /\.(example|sample|template|defaults|dist|schema)$/i;
+const PUBLIC_PREFIX = /^(NEXT_PUBLIC_|VITE_|EXPO_PUBLIC_|REACT_APP_|NUXT_PUBLIC_|PUBLIC_)/;
+
+export const committedEnvFile = {
+  id: 'env-file-committed',
+  title: '.env file with secrets is committed',
+  severity: 'high',
+  check(file, ctx) {
+    if (!ctx.tracked || !ENV_FILE.test(file.path) || ENV_TEMPLATE.test(file.path)) return [];
+    const names = [...file.content.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*['"]?[^\s'"#]/gm)].map((m) => m[1]);
+    const secrets = names.filter((n) => !PUBLIC_PREFIX.test(n));
+    if (!secrets.length) return [];
+    const shown = secrets.slice(0, 5).map((n) => `\`${n}\``).join(', ');
+    return [
+      makeFinding(this, file.path, 1, {
+        message: `This file is in git, so everyone with access to the repo can read ${shown}${secrets.length > 5 ? ` and ${secrets.length - 5} more` : ''}.`,
+        fix: `Add \`${file.path.split('/').pop()}\` to .gitignore, run \`git rm --cached ${file.path}\`, and rotate every value in it. They stay in git history even after you delete the file.`,
+      }),
+    ];
+  },
+};
+
+export default [unauthenticatedWrite, stripeWebhook, getSessionOnServer, unsafeHtml, sqlInjection, committedEnvFile];