viberaven 1.6.4 → 1.6.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -0
- package/package.json +2 -2
package/README.md
ADDED
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# viberaven
|
|
2
|
+
|
|
3
|
+
A successful Vercel deploy does not prove that Supabase keeps one user's rows private. VibeRaven reads an AI-built Vercel + Supabase app's repository for missing RLS, permissive policies, browser-exposed service-role keys, environment names absent from `.env.example`, and Stripe handlers without raw-body signature verification.
|
|
4
|
+
|
|
5
|
+
This package launches [`@viberaven/cli`](https://www.npmjs.com/package/@viberaven/cli) at the same version and forwards arguments and exit status.
|
|
6
|
+
|
|
7
|
+
## Start From Your App
|
|
8
|
+
|
|
9
|
+
Requires Node.js 20 or newer. Run from your app's project root:
|
|
10
|
+
|
|
11
|
+
```bash
|
|
12
|
+
# Open the local Studio
|
|
13
|
+
npx -y viberaven@1.6.5
|
|
14
|
+
# Fresh terminal check
|
|
15
|
+
npx -y viberaven@1.6.5 check
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
Use a pass before launch or handoff, after a migration/policy change, or for a production RLS, environment, database connection, service-role or Stripe webhook failure. Studio combines findings, provider context and git comparisons. For chat, select an installed/authenticated coding CLI and use **Test connection**.
|
|
19
|
+
|
|
20
|
+
`check` refreshes `.viberaven/agent-tasklist.md`, `gate-result.json` and `context-map.json` without patching source. Have the agent read tasks/source and recheck after fixes. `check --json` prints a summary; `--json` prints the full gate object after a fresh scan.
|
|
21
|
+
|
|
22
|
+
Default check returns 0 without critical blockers, allowing warnings; 1 with blockers; 2 on scan error. `--strict=warning --json` also fails warnings, with 2 for errors and 3 for unknown/unavailable results. Unrestricted SELECT can be intentional public content and is a warning.
|
|
23
|
+
|
|
24
|
+
## Scope And Integration
|
|
25
|
+
|
|
26
|
+
Grants determine access with RLS off. Verify live user access and provider steps separately; repository edits alone cannot complete them. A clear check is not a security audit, build or deployment. The scan needs no VibeRaven login/API key; npm downloads can need network.
|
|
27
|
+
|
|
28
|
+
MCP hosts use [`@viberaven/mcp`](https://www.npmjs.com/package/@viberaven/mcp). See the [public repository](https://github.com/ohad6k/VibeRaven), [agent reference](https://ohad6k.github.io/VibeRaven/llms.txt) and [RLS comparison](https://ohad6k.github.io/VibeRaven/examples/proof/rls-comparison/). The maintainer-authored comparison retains published **1.6.3** runs in local databases, not new 1.6.5 scans or independent endorsement. License: MIT.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "viberaven",
|
|
3
|
-
"version": "1.6.
|
|
3
|
+
"version": "1.6.5",
|
|
4
4
|
"description": "Supabase RLS and security check for AI-built apps on Vercel + Supabase (Lovable, Bolt, Cursor, Claude Code): tables without RLS, using (true) policies, service role keys in client code, unsigned Stripe webhooks. Runs locally. Advice, not a gate.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"author": "VibeRaven",
|
|
@@ -48,7 +48,7 @@
|
|
|
48
48
|
"bin"
|
|
49
49
|
],
|
|
50
50
|
"dependencies": {
|
|
51
|
-
"@viberaven/cli": "1.6.
|
|
51
|
+
"@viberaven/cli": "1.6.5"
|
|
52
52
|
},
|
|
53
53
|
"engines": {
|
|
54
54
|
"node": ">=20"
|