shipwarden 0.2.0 → 0.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipwarden",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Free security scanner and launch checklist for apps built with Lovable, Bolt, Cursor and v0: Supabase RLS, Firebase rules, leaked keys, unprotected endpoints, missing privacy policy and 404 pages.",
   "homepage": "https://github.com/patrickballard/shipwarden#readme",
   "repository": {

package/src/rules/secrets.js

@@ -87,6 +87,8 @@ export const publicEnvSecret = {
     for (const m of file.content.matchAll(PUBLIC_VAR)) {
       const [name, prefix, rest] = m;
       if (seen.has(name) || /PUBLISHABLE|ANON/.test(rest)) continue;
+      const lineStart = file.content.lastIndexOf('\n', m.index) + 1;
+      if (/^\s*(#|\/\/|\*)/.test(file.content.slice(lineStart, m.index))) continue; // commented out
       const critical = CRITICAL_NAME.test(rest);
       if (!critical && !AI_KEY_NAME.test(rest)) continue;
       // The ai-key-in-browser finding already covers an AI key used from browser code.

package/src/rules/web.js

@@ -1,4 +1,4 @@
-import { EDGE_FUNCTION, ROUTE_HANDLER, hasDirective, isServerEndpoint, lineAt, makeFinding } from '../util.js';
+import { EDGE_FUNCTION, ROUTE_HANDLER, hasDirective, isServerEndpoint, lineAt, looksLikePlaceholder, makeFinding } from '../util.js';
 
 const MUTATING_EXPORT = /export\s+(?:async\s+)?function\s+(POST|PUT|PATCH|DELETE)\b|export\s+const\s+(POST|PUT|PATCH|DELETE)\s*=|\bas\s+(POST|PUT|PATCH|DELETE)\b/;
 
@@ -177,8 +177,11 @@ export const committedEnvFile = {
   severity: 'high',
   check(file, ctx) {
     if (!ctx.tracked || !ENV_FILE.test(file.path) || ENV_TEMPLATE.test(file.path)) return [];
-    const names = [...file.content.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*['"]?[^\s'"#]/gm)].map((m) => m[1]);
-    const secrets = names.filter((n) => !PUBLIC_PREFIX.test(n));
+    const vars = [...file.content.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*['"]?([^\s'"#][^\n'"]*)/gm)];
+    // Public values and local-only dev settings (localhost databases, "password") aren't leaks.
+    const secrets = vars
+      .filter(([, name, value]) => !PUBLIC_PREFIX.test(name) && !/localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal/.test(value) && !looksLikePlaceholder(value) && !/^(password|secret|changeme|true|false|\d+|development|production|test)$/i.test(value))
+      .map(([, name]) => name);
     if (!secrets.length) return [];
     const shown = secrets.slice(0, 5).map((n) => `\`${n}\``).join(', ');
     return [