shipwarden 0.1.0 → 0.2.1

package/README.md

@@ -47,6 +47,35 @@ Try it on the bundled demo: `npx shipwarden examples/vulnerable-demo`
 | Raw SQL built from string interpolation | SQL injection. |
 | `dangerouslySetInnerHTML` without sanitizing | XSS. |
 
+## Launch checklist
+
+On a full scan, ShipWarden also checks for the launch basics AI tools usually skip. Each check only runs when it applies: password reset only matters if users log in with a password, and terms of service only matter if you take payments. These never fail a build.
+
+| Item | Checked when | Priority |
+|---|---|---|
+| 404 page | always | must have for single-page apps |
+| Error page / error boundary | Next.js and React apps | must have for single-page apps |
+| Privacy policy | the app has accounts, payments or analytics | must have |
+| Terms of service | the app takes payments | must have |
+| Password reset | users sign in with a password | must have |
+| Rate limits on paid AI calls | server code calls OpenAI, Anthropic, Gemini, the Lovable AI gateway and similar | must have |
+| Your own title, description and favicon | always (catches Lovable, v0, Vite and Create Next App defaults) | must have |
+| Account deletion | the app has accounts | nice to have |
+| Social preview image | always | nice to have |
+| robots.txt and sitemap | always | nice to have |
+| Error monitoring | the app has accounts or payments | nice to have |
+
+```
+Launch checklist · 3 of 10 done · 4 must-haves missing
+
+  MUST HAVE  No rate limit on paid AI calls  supabase/functions/chat/index.ts:2
+  Your server calls a paid AI API with nothing limiting how often. One script hitting that
+  endpoint in a loop can run up a bill of thousands overnight.
+  Fix: Limit requests per user or IP (e.g. @upstash/ratelimit, or a daily quota per user ...
+```
+
+Turn an item off with `--skip-check <id>` or a `check:<id>` line in `.shipwardenignore`, or the whole checklist with `--no-checklist`. Libraries and CLIs (anything that isn't a web app) get no checklist.
+
 ## Add it to GitHub (runs on every pull request)
 
 Create `.github/workflows/shipwarden.yml`:
@@ -70,7 +99,7 @@ jobs:
       - uses: patrickballard/shipwarden@v0
 ```
 
-On a pull request, ShipWarden only reports problems in files the PR changes. It flags them inline on the diff and keeps one summary comment up to date instead of posting a new one on every push. It fails the check on critical findings.
+On a pull request, ShipWarden only reports security problems in files the PR changes, and leaves out the launch checklist, which is about the whole codebase. Pushes to `main` run a full scan with the checklist in the job summary. It flags them inline on the diff and keeps one summary comment up to date instead of posting a new one on every push. It fails the check on critical findings.
 
 | Input | Default | |
 |---|---|---|
@@ -78,6 +107,8 @@ On a pull request, ShipWarden only reports problems in files the PR changes. It
 | `scope` | `changed` | `all` reports on the whole repo on pull requests too. |
 | `comment` | `true` | Post the summary comment on pull requests. |
 | `ignore` | | Extra globs to skip, comma or newline separated. |
+| `checklist` | `true` | Run the launch checklist on full scans (pushes, schedules, `scope: all`). |
+| `skip-checks` | | Checklist item ids to turn off, e.g. `robots-sitemap, error-monitoring`. |
 | `anthropic-api-key` | | Turns on the optional AI review (below). |
 | `ai-model` | `claude-opus-5-5` | Claude model for the AI review. |
 
@@ -102,10 +133,11 @@ In the Action, set `anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}`. A revi
 ## CLI
 
 ```
-shipwarden [path] [--format text|json|markdown] [--fail-on <severity|none>] [--ignore <glob>] [--ai] [--model <id>]
+shipwarden [path] [--format text|json|markdown] [--fail-on <severity|none>] [--ignore <glob>]
+           [--no-checklist] [--skip-check <id>] [--ai] [--model <id>]
 ```
 
-Exit code 1 means a finding is at or above `--fail-on` (default `critical`).
+Exit code 1 means a security finding is at or above `--fail-on` (default `critical`). The checklist never changes the exit code.
 
 ## Limitations
 

package/action.yml

@@ -20,6 +20,12 @@ inputs:
   ignore:
     description: Extra glob patterns to skip, comma or newline separated (also reads .shipwardenignore)
     default: ''
+  checklist:
+    description: On full scans (not PR-scoped ones), also run the launch checklist (404 page, privacy policy, rate limits on AI calls, ...)
+    default: 'true'
+  skip-checks:
+    description: Checklist item ids to turn off, comma or newline separated
+    default: ''
   anthropic-api-key:
     description: Optional. Lets Claude double-check uncertain findings and drop false positives
     default: ''
@@ -55,5 +61,7 @@ runs:
         INPUT_SCOPE: ${{ inputs.scope }}
         INPUT_COMMENT: ${{ inputs.comment }}
         INPUT_IGNORE: ${{ inputs.ignore }}
+        INPUT_CHECKLIST: ${{ inputs.checklist }}
+        INPUT_SKIP_CHECKS: ${{ inputs.skip-checks }}
         INPUT_ANTHROPIC_API_KEY: ${{ inputs.anthropic-api-key }}
         INPUT_AI_MODEL: ${{ inputs.ai-model }}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "shipwarden",
-  "version": "0.1.0",
-  "description": "Free security scanner for apps built with Lovable, Bolt, Cursor and v0: Supabase RLS, Firebase rules, leaked keys, unprotected endpoints.",
+  "version": "0.2.1",
+  "description": "Free security scanner and launch checklist for apps built with Lovable, Bolt, Cursor and v0: Supabase RLS, Firebase rules, leaked keys, unprotected endpoints, missing privacy policy and 404 pages.",
   "homepage": "https://github.com/patrickballard/shipwarden#readme",
   "repository": {
     "type": "git",

package/src/action.js

@@ -35,9 +35,16 @@ async function main() {
   const pr = readEvent().pull_request;
   const sha = pr?.head?.sha ?? process.env.GITHUB_SHA;
 
-  const result = await scan(root, { ignore });
+  // The launch checklist is about the whole codebase, so it only runs on full scans
+  // (pushes, schedules, or scope: all), never on a PR that reports on changed files.
+  const prScoped = !!pr && scope === 'changed';
+  const result = await scan(root, {
+    ignore,
+    checklist: !prScoped && input('CHECKLIST', 'true') !== 'false',
+    skipChecks: input('SKIP_CHECKS').split(/[\n,]/).map((s) => s.trim()).filter(Boolean),
+  });
   let scopeNote = 'the whole repository';
-  if (pr && scope === 'changed') {
+  if (prScoped) {
     try {
       const changed = await listPullFiles({ token, owner, repo, number: pr.number });
       result.findings = result.findings.filter((f) => changed.has(f.file));

package/src/checklist.js

@@ -0,0 +1,255 @@
+// Launch checklist: things AI-built apps commonly ship without. These are not security
+// findings: they never fail a build, and each check only runs when it applies to the app.
+import { isServerEndpoint, lineAt } from './util.js';
+
+const CODE = /\.[cm]?[jt]sx?$|\.(vue|svelte|astro)$/;
+const PAGES = /\.[cm]?[jt]sx?$|\.(vue|svelte|astro|html|mdx?)$/;
+const HEAD_FILES = /(^|\/)(index\.html|(src\/)?app\/layout\.[jt]sx?|pages\/_(document|app)\.[jt]sx?|app\/root\.[jt]sx?|src\/app\.html|nuxt\.config\.[jt]s|src\/layouts\/\w+\.astro|(public\/)?(manifest|site)\.(json|webmanifest))$/;
+
+/** First match of `re` in files whose path matches `filter`, as a location. */
+function locate(files, re, filter = CODE) {
+  for (const f of files) {
+    if (!filter.test(f.path)) continue;
+    const m = re.exec(f.content);
+    if (m) return { file: f.path, line: lineAt(f.content, m.index) };
+  }
+  return null;
+}
+
+function signals(files, ctx) {
+  const dep = (re) => [...ctx.deps].some((d) => re.test(d));
+  // A sign-in that only exists on an admin page doesn't mean the app has user accounts.
+  const userFacing = files.filter((f) => !/(^|\/)[^/]*admin[^/]*(\/|$)/i.test(f.path));
+  const inCode = (re) => !!locate(userFacing, re);
+  const hostedAuthUi = dep(/^@clerk\/|^@auth0\/|^@kinde-oss\/|^@workos-inc\//);
+  const accounts =
+    hostedAuthUi ||
+    dep(/^next-auth$|^@auth\/|^better-auth$|^lucia$/) ||
+    inCode(/\.auth\.(signUp|signIn\w*)\s*\(|createUserWithEmailAndPassword|signInWithEmailAndPassword|signInWithPopup|signInWithRedirect/);
+  return {
+    hostedAuthUi,
+    accounts,
+    passwordAuth: inCode(/signInWithPassword|createUserWithEmailAndPassword|signInWithEmailAndPassword|CredentialsProvider|Credentials\(\s*\{|\.auth\.signUp\s*\(\s*\{[^}]*password/),
+    payments: dep(/^stripe$|^@stripe\/|^@lemonsqueezy\/|^@paddle\/|^@polar-sh\/|^razorpay$|^@paypal\//),
+    analytics: dep(/posthog|^@vercel\/analytics$|mixpanel|amplitude|^react-ga|^@next\/third-parties$|plausible|^@segment\/|umami|hotjar/i) || inCode(/googletagmanager\.com|\bgtag\s*\(/),
+  };
+}
+
+const exists = (ctx, re) => ctx.paths.some((p) => re.test(p));
+
+const AI_CALL =
+  /(?:from\s+|import\s*\(\s*|require\(\s*)['"](?:npm:|jsr:|https?:\/\/esm\.sh\/)?(?:openai|@anthropic-ai\/sdk|ai|@ai-sdk\/[\w-]+|groq-sdk|replicate|@google\/genai|@google\/generative-ai|@mistralai\/mistralai|cohere-ai)(?:@[^'"/]*)?(?:\/[^'"]*)?['"]|api\.openai\.com|api\.anthropic\.com|generativelanguage\.googleapis\.com|openrouter\.ai\/api|ai\.gateway\.lovable\.dev/;
+const RATE_LIMIT = /rate.?limit|ratelimit|limiter|throttl|arcjet|botid|turnstile|recaptcha|hcaptcha|usage.?limit|quota|credits?\b|max.?requests|requests?.?per/i;
+
+const BOILERPLATE = [
+  { re: /<title>\s*(?:Vite \+ React(?: \+ TS)?|Vite App|React App)\s*<\/title>|"(?:short_)?name"\s*:\s*"(?:React App|Create React App Sample)"/, label: 'the starter template title' },
+  { re: /Create Next App|Generated by create next app/, label: 'the "Create Next App" title' },
+  { re: /Lovable App|Lovable Generated Project|lovable\.dev\/opengraph-image|@lovable_dev/, label: "Lovable's default title, description or preview image" },
+  { re: /['"`]v0 App['"`]|Created with v0/, label: 'the default v0 title' },
+  { re: /href=["']\/vite\.svg["']/, label: "Vite's logo as the favicon" },
+];
+
+export const CHECKS = [
+  {
+    id: 'not-found-page',
+    title: '404 page',
+    missing: 'No 404 page',
+    applies: (s, ctx) => ctx.app,
+    priority: (s, ctx) => (ctx.kind === 'spa' ? 'must' : 'should'),
+    check(files, ctx) {
+      const byKind = {
+        next: /(^|\/)(src\/)?app\/not-found\.[jt]sx?$|(^|\/)(src\/)?pages\/404\.[jt]sx?$/,
+        sveltekit: /(^|\/)src\/routes\/\+error\.svelte$/,
+        nuxt: /(^|\/)error\.vue$/,
+        astro: /(^|\/)src\/pages\/404\.(astro|mdx?|html)$/,
+        remix: /(^|\/)app\/routes\/(\$|\[\$\]|404)\.[jt]sx?$/,
+      };
+      if (byKind[ctx.kind]) return exists(ctx, byKind[ctx.kind]);
+      return (
+        exists(ctx, /(^|\/)404\.html$|(^|\/)(NotFound|not-found|404)\.[a-z]+$/i) ||
+        !!locate(files, /path\s*[:=]\s*\{?\s*["'`]\/?\*["'`]|notFoundComponent|:pathMatch\(\.\*\)/)
+      );
+    },
+    why: (s, ctx) =>
+      ctx.kind === 'spa'
+        ? 'Anyone who follows a broken or mistyped link gets a blank page, with no way back into your app.'
+        : 'Broken links fall back to the framework\'s bare default 404, which looks like your site is down.',
+    fix: (s, ctx) =>
+      ({
+        next: 'Add `app/not-found.tsx` with your header and a link home.',
+        sveltekit: 'Add `src/routes/+error.svelte`.',
+        nuxt: 'Add `error.vue` at the project root.',
+        astro: 'Add `src/pages/404.astro`.',
+        remix: 'Add a splat route `app/routes/$.tsx` that renders a not-found page.',
+      })[ctx.kind] ?? 'Add a catch-all route last in your router, e.g. `<Route path="*" element={<NotFound />} />`, with a link back home.',
+  },
+  {
+    id: 'error-page',
+    title: 'Error page',
+    missing: 'No error page',
+    applies: (s, ctx) => ctx.kind === 'next' || (ctx.kind === 'spa' && ctx.deps.has('react')),
+    priority: (s, ctx) => (ctx.kind === 'spa' ? 'must' : 'should'),
+    check(files, ctx) {
+      if (ctx.kind === 'next') return exists(ctx, /(^|\/)(src\/)?app\/(?:.*\/)?(global-)?error\.[jt]sx?$|(^|\/)(src\/)?pages\/(_error|500)\.[jt]sx?$/);
+      return !!locate(files, /ErrorBoundary|componentDidCatch|errorElement\s*[:=]|errorComponent/);
+    },
+    why: (s, ctx) =>
+      ctx.kind === 'spa'
+        ? 'If any component throws, React unmounts the whole app and every visitor sees a white screen.'
+        : 'An unexpected error shows Next.js\'s generic "Application error" screen instead of a friendly message and a way to retry.',
+    fix: (s, ctx) =>
+      ctx.kind === 'next'
+        ? 'Add `app/error.tsx` (and `app/global-error.tsx`) with a message and a "Try again" button that calls `reset()`.'
+        : 'Wrap your app in an error boundary, e.g. `react-error-boundary`: `<ErrorBoundary fallback={<CrashPage />}><App /></ErrorBoundary>`.',
+  },
+  {
+    id: 'privacy-policy',
+    title: 'Privacy policy',
+    missing: 'No privacy policy',
+    applies: (s, ctx) => ctx.app && (s.accounts || s.payments || s.analytics),
+    priority: () => 'must',
+    check: (files, ctx) =>
+      exists(ctx, /privacy/i) || !!locate(files, /["'`]\/(?:legal\/)?privacy(?:[-_]policy)?["'`/#?]|href\s*=\s*\{?["'`]https?:[^"'`]*privacy/i, PAGES),
+    why: (s) => {
+      const what = [s.accounts && 'user accounts', s.payments && 'payments', s.analytics && 'analytics'].filter(Boolean).join(', ');
+      return `Your app has ${what}, so it collects personal data. Privacy laws (GDPR, CCPA) require a privacy policy, and Google sign-in, Stripe and the app stores ask for its URL.`;
+    },
+    fix: () =>
+      'Add a `/privacy` page covering what you collect, why, which services process it (e.g. Supabase, Stripe) and how users can get their data deleted. Link it in the footer and on the sign-up form.',
+  },
+  {
+    id: 'terms-of-service',
+    title: 'Terms of service',
+    missing: 'No terms of service',
+    applies: (s, ctx) => ctx.app && s.payments,
+    priority: () => 'must',
+    check: (files, ctx) =>
+      exists(ctx, /(^|\/|[-_])(terms|tos)([-_.\/]|$)/i) || !!locate(files, /["'`]\/(?:legal\/)?(?:terms|tos)(?:[-_]of[-_](?:service|use))?["'`/#?]|href\s*=\s*\{?["'`]https?:[^"'`]*terms/i, PAGES),
+    why: () => 'You take payments, so you need terms covering refunds, cancellations and acceptable use. Stripe expects them on your site before it activates live payments.',
+    fix: () => 'Add a `/terms` page with your refund and cancellation policy, and link it at checkout and in the footer.',
+  },
+  {
+    id: 'password-reset',
+    title: 'Password reset',
+    missing: 'No way to reset a forgotten password',
+    applies: (s) => s.passwordAuth && !s.hostedAuthUi,
+    priority: () => 'must',
+    check: (files) => !!locate(files, /resetPasswordForEmail|sendPasswordResetEmail|forgot[-_ ]?password|reset[-_ ]?password|ForgotPassword|ResetPassword|updateUser\(\s*\{\s*password/i),
+    why: () => "Users sign in with a password, but there's no way to reset it. Anyone who forgets theirs is locked out for good.",
+    fix: () =>
+      'Add a "Forgot password?" link. Supabase: `supabase.auth.resetPasswordForEmail(email, { redirectTo })` plus a page that calls `supabase.auth.updateUser({ password })`. Firebase: `sendPasswordResetEmail(auth, email)`.',
+  },
+  {
+    id: 'account-deletion',
+    title: 'Account deletion',
+    missing: 'No way for users to delete their account',
+    applies: (s) => s.accounts && !s.hostedAuthUi,
+    priority: () => 'should',
+    check: (files) => !!locate(files, /deleteUser|delete[-_ ]?account|deleteMyAccount|close[-_ ]?account|delete_user|user\.delete\(\)/i),
+    why: () => 'GDPR gives users the right to have their data deleted, and Apple rejects apps with sign-up but no in-app account deletion.',
+    fix: () => 'Add a "Delete account" button that calls a server function: confirm who the user is, delete their rows, then `supabase.auth.admin.deleteUser(user.id)` (or your auth provider\'s equivalent).',
+  },
+  {
+    id: 'ai-rate-limit',
+    title: 'Rate limits on AI calls',
+    missing: 'No rate limit on paid AI calls',
+    applies: (s, ctx, files) => !!aiServerCall(files),
+    priority: () => 'must',
+    check: (files, ctx) => [...ctx.deps].some((d) => RATE_LIMIT.test(d)) || !!locate(files, RATE_LIMIT),
+    locate: (files) => aiServerCall(files),
+    why: () => 'Your server calls a paid AI API with nothing limiting how often. One script hitting that endpoint in a loop can run up a bill of thousands overnight.',
+    fix: () =>
+      'Limit requests per user or IP (e.g. `@upstash/ratelimit`, or a daily quota per user in your database), and set a monthly spending cap in your AI provider\'s dashboard.',
+  },
+  {
+    id: 'default-branding',
+    title: 'Your own title, description and favicon',
+    missing: 'Template title, description or favicon still in place',
+    applies: (s, ctx, files) => ctx.app && files.some((f) => HEAD_FILES.test(f.path)),
+    priority: () => 'must',
+    check: (files) => !boilerplate(files).length,
+    locate: (files) => boilerplate(files)[0],
+    why: (s, ctx, files) =>
+      `Browser tabs and shared links still show ${[...new Set(boilerplate(files).map((b) => b.label))].join(', ')}. It's the first thing people see when you share your link.`,
+    fix: (s, ctx, files) => `Set your own \`<title>\`, meta description, \`og:image\` and favicon in \`${boilerplate(files)[0]?.file}\`.`,
+  },
+  {
+    id: 'social-preview',
+    title: 'Social preview image',
+    missing: 'No social preview image',
+    applies: (s, ctx) => ctx.app,
+    priority: () => 'should',
+    check: (files, ctx) =>
+      exists(ctx, /(^|\/)(opengraph|twitter)-image\.\w+$/) || !!locate(files, /og:image|twitter:image|openGraph\s*:\s*\{[\s\S]{0,800}?images/, HEAD_FILES),
+    why: () => 'Without a preview image, links to your app on X, LinkedIn, Slack and iMessage show up as a plain text box.',
+    fix: (s, ctx) =>
+      ctx.kind === 'next'
+        ? 'Add a 1200×630 `app/opengraph-image.png`.'
+        : 'Add a 1200×630 image and `<meta property="og:image" content="https://yourdomain.com/og.png">` to your `<head>`.',
+  },
+  {
+    id: 'robots-sitemap',
+    title: 'robots.txt and sitemap',
+    missing: 'No robots.txt or sitemap',
+    applies: (s, ctx) => ctx.app,
+    priority: () => 'should',
+    check: (files, ctx) =>
+      exists(ctx, /(^|\/)robots\.txt$|(^|\/)(src\/)?app\/robots\.[jt]s$/) &&
+      (exists(ctx, /sitemap[^/]*\.xml$|(^|\/)(src\/)?app\/sitemap\.[jt]s$/) || [...ctx.deps].some((d) => /sitemap/.test(d))),
+    why: () => "Search engines find and index your pages faster with a robots.txt and sitemap. Without them you're harder to find on Google.",
+    fix: (s, ctx) =>
+      ctx.kind === 'next' ? 'Add `app/robots.ts` and `app/sitemap.ts` (Next.js generates the files from them).' : 'Add `public/robots.txt` and a `public/sitemap.xml` listing your public pages.',
+  },
+  {
+    id: 'error-monitoring',
+    title: 'Error monitoring',
+    missing: 'No error monitoring',
+    applies: (s, ctx) => ctx.app && (s.accounts || s.payments),
+    priority: () => 'should',
+    check: (files, ctx) => [...ctx.deps].some((d) => /^@sentry\/|logrocket|^@bugsnag\/|^rollbar$|^@highlight-run\/|^@datadog\/browser|^posthog-(js|node)$|^@axiomhq\/|^@logtail\//.test(d)),
+    why: () => "When something breaks for a user, you'll only hear about it if they bother to tell you, and most just leave.",
+    fix: (s, ctx) => `Add Sentry (free tier): \`npx @sentry/wizard@latest -i ${ctx.kind === 'next' ? 'nextjs' : 'react'}\`, or PostHog's error tracking.`,
+  },
+];
+
+const boilerplateCache = new WeakMap();
+function boilerplate(files) {
+  if (!boilerplateCache.has(files)) {
+    const hits = [];
+    for (const f of files) {
+      if (!HEAD_FILES.test(f.path)) continue;
+      for (const b of BOILERPLATE) {
+        const m = b.re.exec(f.content);
+        if (m) hits.push({ file: f.path, line: lineAt(f.content, m.index), label: b.label });
+      }
+    }
+    boilerplateCache.set(files, hits);
+  }
+  return boilerplateCache.get(files);
+}
+
+const aiCache = new WeakMap();
+function aiServerCall(files) {
+  if (!aiCache.has(files)) {
+    const server = files.filter((f) => isServerEndpoint(f) || /(^|\/)(server|api|functions|lib\/server)\//.test(f.path));
+    aiCache.set(files, locate(server, AI_CALL));
+  }
+  return aiCache.get(files);
+}
+
+/**
+ * @returns {{id: string, title: string, missing: string, priority: 'must'|'should', ok: boolean, why: string, fix: string, file?: string, line?: number}[]}
+ */
+export function runChecklist(files, ctx, skip = new Set()) {
+  if (!ctx.app) return [];
+  const s = signals(files, ctx);
+  const items = [];
+  for (const c of CHECKS) {
+    if (skip.has(c.id) || !c.applies(s, ctx, files)) continue;
+    const ok = c.check(files, ctx);
+    const item = { id: c.id, title: c.title, missing: c.missing, priority: c.priority(s, ctx), ok };
+    if (!ok) Object.assign(item, { why: c.why(s, ctx, files), fix: c.fix(s, ctx, files) }, c.locate?.(files) ?? {});
+    items.push(item);
+  }
+  return items.sort((a, b) => a.ok - b.ok || (a.priority === 'must' ? 0 : 1) - (b.priority === 'must' ? 0 : 1));
+}

package/src/cli.js

@@ -18,6 +18,8 @@ Options:
   --format <text|json|markdown>  Output format (default: text)
   --fail-on <severity|none>      Exit 1 if any finding is at least this severe (default: critical)
   --ignore <glob>                Skip matching files (repeatable; also reads .shipwardenignore)
+  --no-checklist                 Skip the launch checklist (404 page, privacy policy, ...)
+  --skip-check <id>              Turn off one checklist item (repeatable; or add check:<id> to .shipwardenignore)
   --ai                           Ask Claude to double-check uncertain findings (needs ANTHROPIC_API_KEY)
   --model <id>                   Claude model for --ai (default: ${DEFAULT_MODEL})
   --no-color                     Disable colors
@@ -28,7 +30,7 @@ Severities: ${SEVERITIES.join(', ')}
 `;
 
 function parseArgs(argv) {
-  const opts = { target: '.', format: 'text', failOn: 'critical', ignore: [], ai: false, model: DEFAULT_MODEL, color: process.stdout.isTTY && !process.env.NO_COLOR };
+  const opts = { target: '.', format: 'text', failOn: 'critical', ignore: [], skipChecks: [], checklist: true, ai: false, model: DEFAULT_MODEL, color: process.stdout.isTTY && !process.env.NO_COLOR };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const value = () => {
@@ -43,6 +45,8 @@ function parseArgs(argv) {
     else if (arg === '--fail-on') opts.failOn = value();
     else if (arg === '--ignore') opts.ignore.push(value());
     else if (arg === '--ai') opts.ai = true;
+    else if (arg === '--no-checklist') opts.checklist = false;
+    else if (arg === '--skip-check') opts.skipChecks.push(value());
     else if (arg === '--model') opts.model = value();
     else if (arg === '--no-color') opts.color = false;
     else if (arg.startsWith('-')) throw new Error(`Unknown option ${arg}`);
@@ -60,7 +64,7 @@ async function main() {
 
   const root = path.resolve(opts.target);
   if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) throw new Error(`Not a directory: ${opts.target}`);
-  const result = await scan(root, { ignore: opts.ignore });
+  const result = await scan(root, { ignore: opts.ignore, checklist: opts.checklist, skipChecks: opts.skipChecks });
 
   let aiNote = '';
   let ai;

package/src/report.js

@@ -26,7 +26,7 @@ export function toMarkdown(result, { link, scopeNote, aiNote, maxItems = 30 } =
   const scanned = `Scanned ${plural(result.filesScanned, 'file')}${scopeNote ? ` · reporting on ${scopeNote}` : ''}${result.stack.length ? ` · ${result.stack.join(', ')}` : ''}`;
   const footer = [`<sub>${scanned}${aiNote ? ` · ${aiNote}` : ''}. To silence a finding, put a <code>shipwarden-ignore</code> comment on the line above it.</sub>`];
 
-  if (!findings.length) return [MARKER, '### ✅ ShipWarden: no security issues found', '', ...footer].join('\n');
+  if (!findings.length) return [MARKER, '### ✅ ShipWarden: no security issues found', '', ...checklistMarkdown(result.checklist), ...footer].join('\n');
 
   const shown = findings.slice(0, maxItems);
   const where = (f) => (link ? `[\`${f.file}:${f.line}\`](${link(f.file, f.line)})` : `\`${f.file}:${f.line}\``);
@@ -54,7 +54,25 @@ export function toMarkdown(result, { link, scopeNote, aiNote, maxItems = 30 } =
     if (f.ai) out.push('', `> 🤖 AI review (${f.ai.verdict === 'real' ? 'confirmed' : 'unsure'}): ${f.ai.reason}`);
     out.push('', '</details>', '');
   }
-  return [...out, ...footer].join('\n');
+  return [...out, ...checklistMarkdown(result.checklist), ...footer].join('\n');
+}
+
+function checklistSummary(items) {
+  const done = items.filter((i) => i.ok).length;
+  const mustMissing = items.filter((i) => !i.ok && i.priority === 'must').length;
+  return `${done} of ${items.length} done${mustMissing ? ` · ${mustMissing} must-have${mustMissing === 1 ? '' : 's'} missing` : ''}`;
+}
+
+function checklistMarkdown(items = []) {
+  if (!items.length) return [];
+  const out = [`<details${items.some((i) => !i.ok && i.priority === 'must') ? ' open' : ''}><summary>📋 <b>Launch checklist</b>: ${checklistSummary(items)}</summary>`, ''];
+  for (const i of items.filter((i) => !i.ok)) {
+    const where = i.file ? ` (\`${i.file}:${i.line}\`)` : '';
+    out.push(`- ${i.priority === 'must' ? '❌' : '⚠️'} **${i.missing}**${i.priority === 'must' ? ' · must have' : ''}${where}: ${i.why} **Fix:** ${i.fix}`);
+  }
+  const done = items.filter((i) => i.ok);
+  if (done.length) out.push(`- ✅ ${done.map((i) => i.title).join(', ')}`);
+  return [...out, '', '</details>', ''];
 }
 
 const escapeData = (s) => s.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
@@ -74,9 +92,8 @@ export function toText(result, { color = false, aiNote } = {}) {
   const c = (code, s) => (color ? `${ANSI[code]}${s}${ANSI.reset}` : s);
   const strip = (s) => s.replace(/`/g, '');
   const head = `ShipWarden · scanned ${plural(result.filesScanned, 'file')}${result.stack.length ? ` (${result.stack.join(', ')})` : ''} in ${result.durationMs}ms${aiNote ? ` · ${aiNote}` : ''}`;
-  if (!result.findings.length) return `${c('dim', head)}\n\n${c('green', '✔ No security issues found.')}\n`;
-
   const lines = [c('dim', head), ''];
+  if (!result.findings.length) lines.push(c('green', '✔ No security issues found.'), '');
   for (const f of result.findings) {
     lines.push(
       `${c(f.severity, ` ${f.severity.toUpperCase()} `)} ${c('bold', strip(f.title))}`,
@@ -87,8 +104,23 @@ export function toText(result, { color = false, aiNote } = {}) {
     if (f.ai) lines.push(`  ${c('dim', `AI review (${f.ai.verdict}): ${f.ai.reason}`)}`);
     lines.push('');
   }
-  lines.push(`${c('bold', `${plural(result.findings.length, 'issue')}:`)} ${summaryLine(result.findings)}`);
-  return `${lines.join('\n')}\n`;
+  if (result.findings.length) lines.push(`${c('bold', `${plural(result.findings.length, 'issue')}:`)} ${summaryLine(result.findings)}`, '');
+
+  const items = result.checklist ?? [];
+  if (items.length) {
+    lines.push(c('bold', `Launch checklist · ${checklistSummary(items)}`), '');
+    for (const i of items.filter((i) => !i.ok)) {
+      lines.push(
+        ` ${i.priority === 'must' ? c('high', ' MUST HAVE ') : c('medium', 'NICE TO HAVE')} ${c('bold', i.missing)}${i.file ? c('dim', `  ${i.file}:${i.line}`) : ''}`,
+        `  ${strip(i.why)}`,
+        `  ${c('bold', 'Fix:')} ${strip(i.fix)}`,
+        '',
+      );
+    }
+    const done = items.filter((i) => i.ok);
+    if (done.length) lines.push(`${c('green', ' ✔ Done:')} ${done.map((i) => i.title).join(' · ')}`, '');
+  }
+  return `${lines.join('\n')}`;
 }
 
 export function toJson(result, extra = {}) {

package/src/rules/secrets.js

@@ -87,6 +87,8 @@ export const publicEnvSecret = {
     for (const m of file.content.matchAll(PUBLIC_VAR)) {
       const [name, prefix, rest] = m;
       if (seen.has(name) || /PUBLISHABLE|ANON/.test(rest)) continue;
+      const lineStart = file.content.lastIndexOf('\n', m.index) + 1;
+      if (/^\s*(#|\/\/|\*)/.test(file.content.slice(lineStart, m.index))) continue; // commented out
       const critical = CRITICAL_NAME.test(rest);
       if (!critical && !AI_KEY_NAME.test(rest)) continue;
       // The ai-key-in-browser finding already covers an AI key used from browser code.

package/src/rules/web.js

@@ -1,4 +1,4 @@
-import { EDGE_FUNCTION, ROUTE_HANDLER, hasDirective, isServerEndpoint, lineAt, makeFinding } from '../util.js';
+import { EDGE_FUNCTION, ROUTE_HANDLER, hasDirective, isServerEndpoint, lineAt, looksLikePlaceholder, makeFinding } from '../util.js';
 
 const MUTATING_EXPORT = /export\s+(?:async\s+)?function\s+(POST|PUT|PATCH|DELETE)\b|export\s+const\s+(POST|PUT|PATCH|DELETE)\s*=|\bas\s+(POST|PUT|PATCH|DELETE)\b/;
 
@@ -177,8 +177,11 @@ export const committedEnvFile = {
   severity: 'high',
   check(file, ctx) {
     if (!ctx.tracked || !ENV_FILE.test(file.path) || ENV_TEMPLATE.test(file.path)) return [];
-    const names = [...file.content.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*['"]?[^\s'"#]/gm)].map((m) => m[1]);
-    const secrets = names.filter((n) => !PUBLIC_PREFIX.test(n));
+    const vars = [...file.content.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*['"]?([^\s'"#][^\n'"]*)/gm)];
+    // Public values and local-only dev settings (localhost databases, "password") aren't leaks.
+    const secrets = vars
+      .filter(([, name, value]) => !PUBLIC_PREFIX.test(name) && !/localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal/.test(value) && !looksLikePlaceholder(value) && !/^(password|secret|changeme|true|false|\d+|development|production|test)$/i.test(value))
+      .map(([, name]) => name);
     if (!secrets.length) return [];
     const shown = secrets.slice(0, 5).map((n) => `\`${n}\``).join(', ');
     return [

package/src/scanner.js

@@ -2,7 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { RULES, RULE_IDS } from './rules/index.js';
-import { globToRegExp, severityRank } from './util.js';
+import { runChecklist } from './checklist.js';
+import { TEST_FILE, globToRegExp, severityRank } from './util.js';
 
 const DEFAULT_IGNORES = [
   'node_modules', '.git', '.next', '.nuxt', '.output', '.svelte-kit', '.vercel', '.netlify', '.turbo', '.cache',
@@ -16,8 +17,6 @@ const TEXT_EXT = new Set([
 ]);
 const MAX_BYTES = 1024 * 1024;
 const MAX_SQL_BYTES = 32 * 1024 * 1024; // schema dumps get big
-// Tests and fixtures are full of fake keys and deliberately unsafe code.
-const TEST_FILE = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|e2e|cypress|spec)\/|\.(test|spec|stories)\.[cm]?[jt]sx?$/;
 
 function walk(root, rel = '', out = []) {
   for (const entry of fs.readdirSync(path.join(root, rel), { withFileTypes: true })) {
@@ -45,6 +44,7 @@ function listFiles(root) {
   }
 }
 
+/** `.shipwardenignore`: path globs, plus `check:<id>` lines that turn off a checklist item. */
 function readIgnoreFile(root) {
   try {
     return fs
@@ -78,7 +78,17 @@ function loadFiles(root, paths, ignores) {
   return files;
 }
 
-function buildContext(files, tracked) {
+function detectKind(deps) {
+  if (deps.has('next')) return 'next';
+  if (deps.has('@sveltejs/kit')) return 'sveltekit';
+  if (deps.has('nuxt')) return 'nuxt';
+  if (deps.has('astro')) return 'astro';
+  if ([...deps].some((d) => d.startsWith('@remix-run/'))) return 'remix';
+  if (deps.has('vite') || deps.has('react-scripts')) return 'spa';
+  return 'other';
+}
+
+function buildContext(files, tracked, paths) {
   const deps = new Set();
   for (const f of files) {
     if (!f.path.endsWith('package.json')) continue;
@@ -94,7 +104,10 @@ function buildContext(files, tracked) {
   const anyPath = (re) => files.some((f) => re.test(f.path));
   const usesSupabase = [...deps].some((d) => d.startsWith('@supabase/')) || anyPath(/(^|\/)supabase\/(config\.toml|migrations\/|functions\/)/);
   const usesFirebase = deps.has('firebase') || deps.has('firebase-admin') || anyPath(/(^|\/)(firebase\.json|firestore\.rules)$/);
-  const framework = deps.has('next') ? 'next' : deps.has('vite') || deps.has('react-scripts') ? 'spa' : 'other';
+  const kind = detectKind(deps);
+  // Only a plain SPA ships everything under src/ to the browser.
+  const framework = kind === 'next' || kind === 'spa' ? kind : 'other';
+  const app = kind !== 'other' || paths.some((p) => /(^|\/)index\.html$/.test(p));
 
   const stack = [];
   if (framework === 'next') stack.push('Next.js');
@@ -103,7 +116,7 @@ function buildContext(files, tracked) {
   if (usesFirebase) stack.push('Firebase');
   if (deps.has('stripe') || deps.has('@stripe/stripe-js')) stack.push('Stripe');
   if (deps.has('@prisma/client') || deps.has('prisma')) stack.push('Prisma');
-  return { tracked, deps, usesSupabase, usesFirebase, framework, stack };
+  return { tracked, deps, usesSupabase, usesFirebase, framework, kind, app, paths, stack };
 }
 
 const IGNORE_COMMENT = /shipwarden-ignore(?:[\s:]+([\w-]+(?:\s*,\s*[\w-]+)*))?/;
@@ -120,12 +133,20 @@ function isSuppressed(finding, fileContents) {
   return false;
 }
 
-export async function scan(root, { ignore = [] } = {}) {
+/**
+ * @param {string} root
+ * @param {{ignore?: string[], checklist?: boolean, skipChecks?: string[]}} [opts]
+ *   checklist: also run the whole-codebase launch checklist (skip it for PR-scoped scans).
+ */
+export async function scan(root, { ignore = [], checklist = true, skipChecks = [] } = {}) {
   const started = Date.now();
   const { paths, tracked } = listFiles(root);
-  const ignores = [...DEFAULT_IGNORES, ...readIgnoreFile(root), ...ignore].map(globToRegExp);
+  const ignoreLines = readIgnoreFile(root);
+  const skip = new Set([...skipChecks, ...ignoreLines.filter((l) => l.startsWith('check:')).map((l) => l.slice(6).trim())]);
+  const ignores = [...DEFAULT_IGNORES, ...ignoreLines.filter((l) => !l.startsWith('check:')), ...ignore].map(globToRegExp);
   const files = loadFiles(root, paths, ignores);
-  const ctx = buildContext(files, tracked);
+  const visiblePaths = paths.filter((p) => !ignores.some((re) => re.test(p)) && !TEST_FILE.test(p));
+  const ctx = buildContext(files, tracked, visiblePaths);
   const fileContents = new Map(files.map((f) => [f.path, f.content]));
 
   const raw = [];
@@ -149,6 +170,7 @@ export async function scan(root, { ignore = [] } = {}) {
     filesScanned: files.length,
     stack: ctx.stack,
     findings,
+    checklist: checklist ? runChecklist(files.filter((f) => !TEST_FILE.test(f.path)), ctx, skip) : [],
     fileContents,
     durationMs: Date.now() - started,
   };

package/src/util.js

@@ -1,5 +1,8 @@
 export const SEVERITIES = ['critical', 'high', 'medium', 'low'];
 
+// Tests and fixtures are full of fake keys and deliberately unsafe code.
+export const TEST_FILE = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|e2e|cypress|spec)\/|\.(test|spec|stories)\.[cm]?[jt]sx?$/;
+
 export function severityRank(severity) {
   const i = SEVERITIES.indexOf(severity);
   return i === -1 ? SEVERITIES.length : i;