deploy-checkup 0.1.0__tar.gz

deploy_checkup-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nandha Gopal 
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

deploy_checkup-0.1.0/PKG-INFO

@@ -0,0 +1,178 @@
+Metadata-Version: 2.4
+Name: deploy-checkup
+Version: 0.1.0
+Summary: Check whether your deployed app is set up safely, in plain language, with fixes for your host.
+Author: Nandhagopal
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Nandhagopal2912/deploy-checkup
+Project-URL: Issues, https://github.com/Nandhagopal2912/deploy-checkup/issues
+Keywords: deploy,security,cors,headers,https,render,cli
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: rich<16,>=14
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: license-file
+
+# deploy-checkup
+
+[![CI](https://github.com/Nandhagopal2912/deploy-checkup/actions/workflows/ci.yml/badge.svg)](https://github.com/Nandhagopal2912/deploy-checkup/actions/workflows/ci.yml)
+
+Tells you, in plain language, whether your deployed app is set up safely, and exactly how to fix what isn't on your host.
+
+> **Only test apps you own or have permission to test.** Against someone else's site, unusual requests can look like an attack and may be illegal.
+
+## Install
+
+Requires Python 3.10 or newer.
+
+```bash
+pipx install deploy-checkup
+```
+
+`pipx` installs command-line tools in their own environment ([how to install pipx](https://pipx.pypa.io/stable/installation/)). `pip install deploy-checkup` works too.
+
+## Usage
+
+```bash
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com
+```
+
+| Option | Meaning |
+|---|---|
+| `url` | Your frontend's address (required) |
+| `--api` | Your API's address, if it is separate |
+| `--health-path` | The API's health check path (default `/health`) |
+| `--yes-i-own-it` | Run the probing checks without asking (for CI) |
+| `--json` | Print the findings as JSON instead of a coloured report |
+| `-V`, `--version` | Show the version |
+| `-h`, `--help` | Show help |
+
+Example output:
+
+```
+──────────── https://your-frontend.onrender.com ────────────
+PASS    Site answered with status 200
+PASS    Plain HTTP redirects to HTTPS (301)
+WARNING Content-Security-Policy is missing
+        Why: If an attacker manages to inject a script into your page, the browser will run it. ...
+        Fix: Start with Content-Security-Policy: default-src 'self' and loosen it ...
+
+Summary: 6 pass, 1 warning, 0 fail, 0 info
+```
+
+Each finding says what was found, why it matters, and how to fix it.
+
+| Level | Meaning |
+|---|---|
+| **PASS** | Checked, and it's set up well. |
+| **WARNING** | Probably worth fixing, but your app may be fine without it. Used whenever deploy-checkup can't be sure. |
+| **FAIL** | Something is clearly broken or unsafe. Fix this first. |
+| **INFO** | Good to know, such as a check that was skipped or a hint that may not apply. |
+
+The command exits with code `1` if anything fails and `0` otherwise.
+
+### Use it in CI
+
+Run it after each deploy, so a broken setup fails the pipeline. For example, in GitHub Actions:
+
+```yaml
+- run: pip install deploy-checkup
+- run: deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
+```
+
+`--yes-i-own-it` runs the probing checks without the question nobody can answer in CI. Leave it out to run only the gentle checks.
+
+## What it checks
+
+| Check | Runs on | What it asks |
+|---|---|---|
+| **reachable** | frontend | Does the address answer, and with what status? |
+| **https** | frontend and API | Does plain `http://` redirect to `https://`, and permanently (301/308)? |
+| **headers** | frontend | Are the browser security headers set? Strict-Transport-Security (at least 6 months), X-Content-Type-Options (`nosniff`), Content-Security-Policy, X-Frame-Options (or CSP `frame-ancestors`), Referrer-Policy |
+| **cors** | API | Asks the API as your frontend, then as a made-up site (`deploy-checkup-test.invalid`). Is your frontend allowed and everyone else blocked? |
+| **health** | API | Calls the health path 3 times. Does it exist, and what's the median response time? |
+| **cold_start** | API | Was the first of those requests much slower than the rest (a free tier waking up)? Reported as a hint, not a verdict. |
+| **exposed_files** | frontend and API | Can anyone download `/.env` or `/.git/config`? **Probing:** runs only after you confirm you own the site. |
+
+The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Frame-Options, and flagging them would be a false alarm.
+
+**Fix hints match your host.** When a response carries Render's `x-render-origin-server` header, fixes point to the exact place in the Render dashboard. On any other host you get general advice.
+
+### Probing checks ask first
+
+Most checks send ordinary requests any browser could send. The exposed files check asks for paths like `/.env`, which on someone else's site can look like an attack. So deploy-checkup asks *"Do you own this site?"* before running it. If nobody can answer (in CI, for example), it is skipped and the report says so, unless you pass `--yes-i-own-it`. A leaked file's contents are never shown in the report.
+
+### Polite by design
+
+Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A full run sends a few dozen ordinary requests.
+
+### What it doesn't do
+
+deploy-checkup is a quick first look, not a full security audit:
+
+- It only sends ordinary requests. It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP.
+- CORS is tested on the one API address you give it, and health on one path.
+- Cold start detection is a guess from a few timings.
+- Fix hints are written for Render first; other hosts get general advice.
+
+## JSON output
+
+`--json` prints the same findings for scripts and CI. Only the JSON goes to standard output; the permission question goes to standard error, so you can save the report safely:
+
+```bash
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --json > report.json
+```
+
+```json
+{
+  "tool": "deploy-checkup",
+  "version": "0.1.0",
+  "targets": [
+    {
+      "url": "https://your-api.onrender.com",
+      "findings": [
+        {"check": "health", "level": "pass", "title": "API answered in 108 ms (median of 2)", "why": "", "fix": ""}
+      ]
+    }
+  ],
+  "summary": {"pass": 16, "warning": 0, "fail": 0, "info": 0}
+}
+```
+
+The exit code is the same as for the coloured report.
+
+## Development
+
+```bash
+git clone https://github.com/Nandhagopal2912/deploy-checkup.git
+cd deploy-checkup
+python -m venv .venv
+.venv\Scripts\activate          # Windows; on macOS/Linux: source .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```
+
+`-e` installs in editable mode, so code changes take effect without reinstalling. Re-run the install after changing `dependencies` or `[project.scripts]` in `pyproject.toml`.
+
+Tests never touch the network. Each check receives an `httpx.Client`, and tests pass one built on `httpx.MockTransport`, which answers requests with fake responses. CI runs them on Python 3.10 and 3.13.
+
+[`demo/`](https://github.com/Nandhagopal2912/deploy-checkup/tree/main/demo) holds a deliberately broken app with known flaws, used to prove each check catches what it should. The project's plan is in the [roadmap](https://github.com/Nandhagopal2912/deploy-checkup/blob/main/docs/Deploy%20Doctor%20Roadmap.pdf).
+
+## License
+
+[MIT](https://github.com/Nandhagopal2912/deploy-checkup/blob/main/LICENSE)

deploy_checkup-0.1.0/README.md

@@ -0,0 +1,148 @@
+# deploy-checkup
+
+[![CI](https://github.com/Nandhagopal2912/deploy-checkup/actions/workflows/ci.yml/badge.svg)](https://github.com/Nandhagopal2912/deploy-checkup/actions/workflows/ci.yml)
+
+Tells you, in plain language, whether your deployed app is set up safely, and exactly how to fix what isn't on your host.
+
+> **Only test apps you own or have permission to test.** Against someone else's site, unusual requests can look like an attack and may be illegal.
+
+## Install
+
+Requires Python 3.10 or newer.
+
+```bash
+pipx install deploy-checkup
+```
+
+`pipx` installs command-line tools in their own environment ([how to install pipx](https://pipx.pypa.io/stable/installation/)). `pip install deploy-checkup` works too.
+
+## Usage
+
+```bash
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com
+```
+
+| Option | Meaning |
+|---|---|
+| `url` | Your frontend's address (required) |
+| `--api` | Your API's address, if it is separate |
+| `--health-path` | The API's health check path (default `/health`) |
+| `--yes-i-own-it` | Run the probing checks without asking (for CI) |
+| `--json` | Print the findings as JSON instead of a coloured report |
+| `-V`, `--version` | Show the version |
+| `-h`, `--help` | Show help |
+
+Example output:
+
+```
+──────────── https://your-frontend.onrender.com ────────────
+PASS    Site answered with status 200
+PASS    Plain HTTP redirects to HTTPS (301)
+WARNING Content-Security-Policy is missing
+        Why: If an attacker manages to inject a script into your page, the browser will run it. ...
+        Fix: Start with Content-Security-Policy: default-src 'self' and loosen it ...
+
+Summary: 6 pass, 1 warning, 0 fail, 0 info
+```
+
+Each finding says what was found, why it matters, and how to fix it.
+
+| Level | Meaning |
+|---|---|
+| **PASS** | Checked, and it's set up well. |
+| **WARNING** | Probably worth fixing, but your app may be fine without it. Used whenever deploy-checkup can't be sure. |
+| **FAIL** | Something is clearly broken or unsafe. Fix this first. |
+| **INFO** | Good to know, such as a check that was skipped or a hint that may not apply. |
+
+The command exits with code `1` if anything fails and `0` otherwise.
+
+### Use it in CI
+
+Run it after each deploy, so a broken setup fails the pipeline. For example, in GitHub Actions:
+
+```yaml
+- run: pip install deploy-checkup
+- run: deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --yes-i-own-it
+```
+
+`--yes-i-own-it` runs the probing checks without the question nobody can answer in CI. Leave it out to run only the gentle checks.
+
+## What it checks
+
+| Check | Runs on | What it asks |
+|---|---|---|
+| **reachable** | frontend | Does the address answer, and with what status? |
+| **https** | frontend and API | Does plain `http://` redirect to `https://`, and permanently (301/308)? |
+| **headers** | frontend | Are the browser security headers set? Strict-Transport-Security (at least 6 months), X-Content-Type-Options (`nosniff`), Content-Security-Policy, X-Frame-Options (or CSP `frame-ancestors`), Referrer-Policy |
+| **cors** | API | Asks the API as your frontend, then as a made-up site (`deploy-checkup-test.invalid`). Is your frontend allowed and everyone else blocked? |
+| **health** | API | Calls the health path 3 times. Does it exist, and what's the median response time? |
+| **cold_start** | API | Was the first of those requests much slower than the rest (a free tier waking up)? Reported as a hint, not a verdict. |
+| **exposed_files** | frontend and API | Can anyone download `/.env` or `/.git/config`? **Probing:** runs only after you confirm you own the site. |
+
+The headers check skips the API on purpose: a JSON API doesn't need CSP or X-Frame-Options, and flagging them would be a false alarm.
+
+**Fix hints match your host.** When a response carries Render's `x-render-origin-server` header, fixes point to the exact place in the Render dashboard. On any other host you get general advice.
+
+### Probing checks ask first
+
+Most checks send ordinary requests any browser could send. The exposed files check asks for paths like `/.env`, which on someone else's site can look like an attack. So deploy-checkup asks *"Do you own this site?"* before running it. If nobody can answer (in CI, for example), it is skipped and the report says so, unless you pass `--yes-i-own-it`. A leaked file's contents are never shown in the report.
+
+### Polite by design
+
+Every request uses a 60-second timeout (Render's free tier can take about 50 seconds to wake up) and identifies itself as `User-Agent: DeployCheckup/<version>`, so site owners can see what called them. A full run sends a few dozen ordinary requests.
+
+### What it doesn't do
+
+deploy-checkup is a quick first look, not a full security audit:
+
+- It only sends ordinary requests. It doesn't try to break in, and it isn't a replacement for tools like OWASP ZAP.
+- CORS is tested on the one API address you give it, and health on one path.
+- Cold start detection is a guess from a few timings.
+- Fix hints are written for Render first; other hosts get general advice.
+
+## JSON output
+
+`--json` prints the same findings for scripts and CI. Only the JSON goes to standard output; the permission question goes to standard error, so you can save the report safely:
+
+```bash
+deploy-checkup https://your-frontend.onrender.com --api https://your-api.onrender.com --json > report.json
+```
+
+```json
+{
+  "tool": "deploy-checkup",
+  "version": "0.1.0",
+  "targets": [
+    {
+      "url": "https://your-api.onrender.com",
+      "findings": [
+        {"check": "health", "level": "pass", "title": "API answered in 108 ms (median of 2)", "why": "", "fix": ""}
+      ]
+    }
+  ],
+  "summary": {"pass": 16, "warning": 0, "fail": 0, "info": 0}
+}
+```
+
+The exit code is the same as for the coloured report.
+
+## Development
+
+```bash
+git clone https://github.com/Nandhagopal2912/deploy-checkup.git
+cd deploy-checkup
+python -m venv .venv
+.venv\Scripts\activate          # Windows; on macOS/Linux: source .venv/bin/activate
+pip install -e ".[dev]"
+pytest
+```
+
+`-e` installs in editable mode, so code changes take effect without reinstalling. Re-run the install after changing `dependencies` or `[project.scripts]` in `pyproject.toml`.
+
+Tests never touch the network. Each check receives an `httpx.Client`, and tests pass one built on `httpx.MockTransport`, which answers requests with fake responses. CI runs them on Python 3.10 and 3.13.
+
+[`demo/`](https://github.com/Nandhagopal2912/deploy-checkup/tree/main/demo) holds a deliberately broken app with known flaws, used to prove each check catches what it should. The project's plan is in the [roadmap](https://github.com/Nandhagopal2912/deploy-checkup/blob/main/docs/Deploy%20Doctor%20Roadmap.pdf).
+
+## License
+
+[MIT](https://github.com/Nandhagopal2912/deploy-checkup/blob/main/LICENSE)

deploy_checkup-0.1.0/pyproject.toml

@@ -0,0 +1,44 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "deploy-checkup"
+version = "0.1.0"
+description = "Check whether your deployed app is set up safely, in plain language, with fixes for your host."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Nandhagopal" }]
+requires-python = ">=3.10"
+keywords = ["deploy", "security", "cors", "headers", "https", "render", "cli"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: Internet :: WWW/HTTP",
+]
+dependencies = [
+    "httpx >= 0.28,<1",
+    "rich >= 14,<16",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest >=8",
+    "build",
+    "twine",
+]
+
+[project.urls]
+Homepage = "https://github.com/Nandhagopal2912/deploy-checkup"
+Issues = "https://github.com/Nandhagopal2912/deploy-checkup/issues"
+
+[project.scripts]
+deploy-checkup = "deploy_checkup.cli:main"

deploy_checkup-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

deploy_checkup-0.1.0/src/deploy_checkup/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

deploy_checkup-0.1.0/src/deploy_checkup/checks/cold_start.py

@@ -0,0 +1,37 @@
+from statistics import median
+
+from deploy_checkup.models import Finding, Level
+
+CHECK = "cold_start"
+COLD_MS = 5000  # a first request this slow usually means the server was asleep
+
+
+def check_cold_start(times_ms: list[float]) -> Finding:
+    """Compare the first response time with the ones after it."""
+    first = round(times_ms[0])
+    warm = round(median(times_ms[1:]))
+
+    if first >= COLD_MS and first > 3 * warm:
+        return Finding(
+            check=CHECK,
+            level=Level.INFO,
+            title=f"First request took {first / 1000:.1f} s, later ones {warm} ms: free tier waking up?",
+            why=(
+                "Free hosting plans often put an app to sleep when nobody visits, "
+                "and the next visitor waits while it starts again."
+            ),
+            fix=(
+                "Say so in your README so visitors know to wait, or use a plan that "
+                "keeps the server running."
+            ),
+            render_fix=(
+                "Render's free tier sleeps after 15 minutes without visitors. Say so in "
+                "your README, or move the service to a paid instance type to keep it awake."
+            ),
+        )
+
+    return Finding(
+        check=CHECK,
+        level=Level.PASS,
+        title=f"No cold start this time (first request {first} ms)",
+    )

deploy_checkup-0.1.0/src/deploy_checkup/checks/cors.py

@@ -0,0 +1,85 @@
+import httpx
+
+from deploy_checkup.models import Finding, Level
+
+CHECK = "cors"
+MADE_UP_SITE = "https://deploy-checkup-test.invalid"  # .invalid can never be a real website
+
+
+def check_cors(client: httpx.Client, api_url: str, frontend_url: str) -> list[Finding]:
+    """Ask the API as your frontend, then as a made-up site, and compare the answers."""
+    frontend = _origin(frontend_url)
+    try:
+        as_frontend = client.get(api_url, headers={"Origin": frontend})
+        as_stranger = client.get(api_url, headers={"Origin": MADE_UP_SITE})
+    except httpx.RequestError:
+        return []  # the other checks already report connection problems
+
+    return [
+        _check_own_frontend(as_frontend, frontend),
+        _check_other_sites(as_stranger),
+    ]
+
+
+def _origin(url: str) -> str:
+    """The part of a URL a browser sends as Origin: scheme, host and (if unusual) port."""
+    parsed = httpx.URL(url)
+    origin = f"{parsed.scheme}://{parsed.host}"
+    if parsed.port is not None:
+        origin += f":{parsed.port}"
+    return origin
+
+
+def _check_own_frontend(response: httpx.Response, frontend: str) -> Finding:
+    allowed = response.headers.get("access-control-allow-origin")
+    if allowed in (frontend, "*"):
+        return Finding(check=CHECK, level=Level.PASS, title=f"API allows your frontend ({frontend})")
+
+    return Finding(
+        check=CHECK,
+        level=Level.WARNING,
+        title=f"API doesn't allow your frontend ({frontend})",
+        why=(
+            "Browsers will block your frontend from reading the API's answers, "
+            "so pages that load data will break."
+        ),
+        fix=(
+            f"Add {frontend} to your API's allowed origins (often set through an "
+            "environment variable), then redeploy."
+        ),
+        render_fix=(
+            f"Add {frontend} to your API's allowed origins, for example through an "
+            "environment variable in the Render dashboard, then redeploy."
+        ),
+    )
+
+
+def _check_other_sites(response: httpx.Response) -> Finding:
+    allowed = response.headers.get("access-control-allow-origin")
+    with_cookies = response.headers.get("access-control-allow-credentials", "").lower() == "true"
+
+    if allowed is None:
+        return Finding(check=CHECK, level=Level.PASS, title="API blocks other websites")
+
+    if allowed == MADE_UP_SITE and with_cookies:
+        return Finding(
+            check=CHECK,
+            level=Level.FAIL,
+            title="API lets any website read it with your visitors' cookies",
+            why=(
+                "A stranger's site can call your API from a logged-in visitor's browser "
+                "and read their private data."
+            ),
+            fix=(
+                "List your real frontend address as the only allowed origin. "
+                "Never combine 'allow every origin' with allow_credentials."
+            ),
+        )
+
+    return Finding(
+        check=CHECK,
+        level=Level.WARNING,
+        title=f"API accepts requests from any website (Access-Control-Allow-Origin: {allowed})",
+        why="Any site can read your API's answers. That's fine for public data, risky for anything else.",
+        fix="If the API isn't meant to be public, allow only your frontend's address.",
+    )

deploy_checkup-0.1.0/src/deploy_checkup/checks/exposed_files.py

@@ -0,0 +1,65 @@
+import re
+
+import httpx
+
+from deploy_checkup.models import Finding, Level
+
+CHECK = "exposed_files"
+
+
+def _looks_like_env(body: str) -> bool:
+    return re.search(r"^[A-Z][A-Z0-9_]*=", body, re.MULTILINE) is not None
+
+
+def _looks_like_git_config(body: str) -> bool:
+    return "[core]" in body
+
+
+# Each path, and how to recognise the real file (so a friendly 200 page isn't a false alarm).
+PATHS = {
+    "/.env": _looks_like_env,
+    "/.git/config": _looks_like_git_config,
+}
+
+
+def check_exposed_files(client: httpx.Client, url: str) -> list[Finding]:
+    """Ask for a few files that should never be public, and check what comes back."""
+    findings = []
+    for path, looks_real in PATHS.items():
+        try:
+            response = client.get(httpx.URL(url).join(path))
+        except httpx.RequestError:
+            return []  # the other checks already report connection problems
+
+        is_html = "text/html" in response.headers.get("content-type", "")
+        if response.status_code == 200 and not is_html and looks_real(response.text):
+            findings.append(_exposed(path))
+        else:
+            findings.append(Finding(check=CHECK, level=Level.PASS, title=f"{path} is not exposed"))
+    return findings
+
+
+def _exposed(path: str) -> Finding:
+    return Finding(
+        check=CHECK,
+        level=Level.FAIL,
+        title=f"{path} is publicly downloadable",
+        why=(
+            "Anyone can download this file. It usually holds passwords, API keys or "
+            "your code's history, which attackers collect automatically."
+        ),
+        fix=(
+            f"Stop serving {path} (don't copy it into your build or static folder), "
+            "then change every secret it contained: assume they're already leaked."
+        ),
+    )
+
+
+def skipped() -> Finding:
+    return Finding(
+        check=CHECK,
+        level=Level.INFO,
+        title="Exposed files check skipped (needs your permission)",
+        why="It asks for files like /.env, which only the site's owner should do.",
+        fix="Run again and answer yes, or pass --yes-i-own-it in CI.",
+    )