readystack-view-in-browser-leak-audit 1.0.2__tar.gz

readystack_view_in_browser_leak_audit-1.0.2/LICENSE.txt

@@ -0,0 +1,15 @@
+View in Browser — Publish Leak Audit (HTML) — Licence
+
+Free scope
+  Audit the HTML file you are about to open in the browser and get every leak with its line number and the fix. is free for any use, personal or commercial, for as long as you keep the
+  extension installed, and the online check at the product page is free without registration.
+
+Paid scope
+  Sweep every HTML file in the workspace in one command and write a dated audit report you keep. is the paid part. It asks for a licence key issued at purchase (one seat, one key). The key is checked against the payment provider and
+  cached locally for 30 days so it keeps working offline.
+
+Redistribution
+  You may not resell, re-host or bundle this extension or its rule set. The rule set and the
+  engine are provided as-is; check results are advisory and do not constitute legal advice.
+
+(c) ReadyStack — https://getreadystack.com

readystack_view_in_browser_leak_audit-1.0.2/PKG-INFO

@@ -0,0 +1,84 @@
+Metadata-Version: 2.4
+Name: readystack-view-in-browser-leak-audit
+Version: 1.0.2
+Summary: 24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resou (bundled Node.js runtime)
+Author-email: ReadyStack <support@getreadystack.com>
+License: Proprietary - see LICENSE.txt
+Project-URL: Homepage, https://getreadystack.com/tools/view-in-browser-leak-audit?ref=pypi
+Project-URL: Documentation, https://getreadystack.com/tools/view-in-browser-leak-audit?ref=pypi
+Project-URL: Support, https://getreadystack.com/support
+Keywords: view in browser,html,preview,api key,secret,localhost,publish,static site,audit,leak
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: nodejs-wheel-binaries>=20
+Dynamic: license-file
+
+# View in Browser — Publish Leak Audit (HTML)
+
+> Runs the same checker as the npm package `@readystack/view-in-browser-leak-audit` on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+![View in Browser — Publish Leak Audit (HTML)](https://getreadystack.com/img/promo/sku128294_result_card.jpg)
+
+24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resources, a leftover noindex.
+
+## Install
+
+```
+view-in-browser-leak-audit file
+```
+
+Node 18+. The same 24 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Audit the HTML file you are about to open in the browser: all 24 rules, every finding with its severity, line number and fix. The clean fixture returns 0 findings, the dirty one returns 27. No key, no watermark, no locked answers.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scope: one command sweeps every HTML file in the workspace instead of the one in front of you, and writes a dated LEAK-AUDIT.md you keep as evidence — forty pages in one pass instead of forty passes.
+
+```
+@readystack/view-in-browser-leak-audit --dir ./templates --report html --out report.html
+```
+
+In February 2026 a developer reported an $82,000 Google Cloud bill after a key embedded in client-side Google Maps code was taken from the page source; their normal spend was $180 a month.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "view-in-browser-leak-audit": { "command": "npx", "args": ["-y", "@readystack/view-in-browser-leak-audit", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: View in Browser — Publish Leak Audit (HTML)
+  run: npx -y @readystack/view-in-browser-leak-audit --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/view-in-browser-leak-audit --dir /work --ci`)
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_CwvLDIxujtAKjVYNswBmnY71CVpJXNzshSaBQ2RDuKe)
+
+
+<!-- view in browser leak audit -->
+
+
+## Install (PyPI)
+
+```
+pip install readystack-view-in-browser-leak-audit
+view-in-browser-leak-audit --help
+```

readystack_view_in_browser_leak_audit-1.0.2/README.md

@@ -0,0 +1,64 @@
+# View in Browser — Publish Leak Audit (HTML)
+
+> Runs the same checker as the npm package `@readystack/view-in-browser-leak-audit` on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+![View in Browser — Publish Leak Audit (HTML)](https://getreadystack.com/img/promo/sku128294_result_card.jpg)
+
+24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resources, a leftover noindex.
+
+## Install
+
+```
+view-in-browser-leak-audit file
+```
+
+Node 18+. The same 24 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Audit the HTML file you are about to open in the browser: all 24 rules, every finding with its severity, line number and fix. The clean fixture returns 0 findings, the dirty one returns 27. No key, no watermark, no locked answers.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scope: one command sweeps every HTML file in the workspace instead of the one in front of you, and writes a dated LEAK-AUDIT.md you keep as evidence — forty pages in one pass instead of forty passes.
+
+```
+@readystack/view-in-browser-leak-audit --dir ./templates --report html --out report.html
+```
+
+In February 2026 a developer reported an $82,000 Google Cloud bill after a key embedded in client-side Google Maps code was taken from the page source; their normal spend was $180 a month.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "view-in-browser-leak-audit": { "command": "npx", "args": ["-y", "@readystack/view-in-browser-leak-audit", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: View in Browser — Publish Leak Audit (HTML)
+  run: npx -y @readystack/view-in-browser-leak-audit --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/view-in-browser-leak-audit --dir /work --ci`)
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_CwvLDIxujtAKjVYNswBmnY71CVpJXNzshSaBQ2RDuKe)
+
+
+<!-- view in browser leak audit -->
+
+
+## Install (PyPI)
+
+```
+pip install readystack-view-in-browser-leak-audit
+view-in-browser-leak-audit --help
+```

readystack_view_in_browser_leak_audit-1.0.2/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "readystack-view-in-browser-leak-audit"
+version = "1.0.2"
+description = "24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resou (bundled Node.js runtime)"
+readme = "README.md"
+requires-python = ">=3.9"
+dependencies = ["nodejs-wheel-binaries>=20"]
+license = {text = "Proprietary - see LICENSE.txt"}
+keywords = ["view in browser", "html", "preview", "api key", "secret", "localhost", "publish", "static site", "audit", "leak"]
+authors = [{name = "ReadyStack", email = "support@getreadystack.com"}]
+classifiers = ["Programming Language :: Python :: 3", "Environment :: Console", "Topic :: Software Development :: Quality Assurance", "Operating System :: OS Independent"]
+
+[project.urls]
+Homepage = "https://getreadystack.com/tools/view-in-browser-leak-audit?ref=pypi"
+Documentation = "https://getreadystack.com/tools/view-in-browser-leak-audit?ref=pypi"
+Support = "https://getreadystack.com/support"
+
+[project.scripts]
+"view-in-browser-leak-audit" = "readystack_view_in_browser_leak_audit.__main__:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+"readystack_view_in_browser_leak_audit" = ["js/*"]

readystack_view_in_browser_leak_audit-1.0.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/__init__.py

@@ -0,0 +1 @@
+__version__ = '1.0.2'

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/__main__.py

@@ -0,0 +1,12 @@
+import os, sys
+
+
+def main():
+    # Runs the same checker as the npm package on the Node.js runtime installed with this package (nodejs-wheel-binaries).
+    from nodejs_wheel import node
+    here = os.path.dirname(os.path.abspath(__file__))
+    return node([os.path.join(here, "js", "cli.js")] + sys.argv[1:])
+
+
+if __name__ == "__main__":
+    sys.exit(main())

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/js/cli.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// cli.js — the same rules as the VS Code extension, run from a terminal or a container. Generated by adapters.py.
+'use strict';
+const fs = require('fs'), path = require('path');
+const RULES = require('./rules.json');
+const S = require('./strings.json');
+const lic = require('./license.js');
+const ENGINE = require('./engine.js');   // s144 — scaffold products: the same engine the VS Code extension runs
+const RULE_LIST = Array.isArray(ENGINE.RULES) ? ENGINE.RULES : (Array.isArray(RULES) ? RULES : []);
+const RULE_N = ENGINE.RULE_COUNT || RULE_LIST.length;
+function scan(text, file) {
+  const r = ENGINE.engine.check(String(text), { today: new Date().toISOString().slice(0, 10), path: file || '' });
+  return (r && r.findings || []).map((f) => ({ line: parseInt(f.line, 10) || 1, msg: String(f.msg || f.message || f.check || ''), fix: f.fix || null, sev: (String(f.sev || 'error').toLowerCase().startsWith('err') ? 'error' : 'warn') }));
+}
+function isText(p) { try { const b = fs.readFileSync(p); if (b.length > 2 * 1024 * 1024) return false; const s = b.subarray(0, 4096); for (const x of s) if (x === 0) return false; return true; } catch (e) { return false; } }
+function walk(dir, exts, out) {
+  let ents = []; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch (e) { return out; }
+  for (const e of ents) {
+    if (['node_modules', '.git', '.hg', '.svn', '.venv', 'venv', '.tox', '.cache', '.next', '.nuxt', '.terraform', '__pycache__'].includes(e.name)) continue;   // s158 — .github · .gitlab-ci.yml · .env · .well-known 은 본다 (옛 줄은 점으로 시작하는 것을 전부 건너뛰어 워크플로 검사기가 .github/workflows 를 못 봤다)
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if ((!exts.length || exts.includes(path.extname(e.name).toLowerCase())) && isText(p)) out.push(p);
+  }
+  return out;
+}
+function esc(s) { return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;'); }
+function csvq(s) { return '"' + String(s == null ? '' : s).replace(/"/g, '""') + '"'; }
+function render(rows, fmt) {
+  if (fmt === 'json') return JSON.stringify({ tool: S.name, rules: RULE_N, files: rows }, null, 1);
+  if (fmt === 'csv') { const o = ['file,line,severity,message,fix']; for (const r of rows) for (const h of r.hits) o.push([csvq(r.file), h.line, h.sev, csvq(h.msg), csvq(h.fix)].join(',')); return o.join('\n') + '\n'; }
+  if (fmt === 'html') {
+    const n = rows.reduce((a, r) => a + r.hits.length, 0);
+    let o = '<!doctype html><meta charset="utf-8"><title>' + esc(S.name) + ' report</title><style>body{font:14px system-ui;margin:24px}table{border-collapse:collapse}td,th{border:1px solid #ddd;padding:4px 8px;font-size:13px}code{font-family:ui-monospace,monospace}</style>';
+    o += '<h1>' + esc(S.name) + '</h1><p>' + rows.length + ' files · ' + n + ' findings · ' + RULE_N + ' rules</p><table><tr><th>file</th><th>line</th><th>sev</th><th>message</th><th>fix</th></tr>';
+    for (const r of rows) for (const h of r.hits) o += '<tr><td><code>' + esc(r.file) + '</code></td><td>' + h.line + '</td><td>' + esc(h.sev) + '</td><td>' + esc(h.msg) + '</td><td>' + esc(h.fix || '') + '</td></tr>';
+    return o + '</table>';
+  }
+  let o = ''; for (const r of rows) { o += r.file + '\n'; for (const h of r.hits) o += '  ' + String(h.line).padStart(5) + '  ' + h.sev.padEnd(5) + ' ' + h.msg + (h.fix ? '\n         -> ' + h.fix : '') + '\n'; if (!r.hits.length) o += '  (no findings)\n'; }
+  return o;
+}
+function trialState() {
+  // s158 — ⚑7일 무료 없음: 새 체험은 ⛔열지 않는다 · 이미 시작된 체험(trial.json)만 끝까지 지킨다 (읽기 전용)
+  if (process.env.READYSTACK_NO_TRIAL) return { active: false };
+  try {
+    const p = path.join(path.dirname(lic.storePath()), S.bin + '.trial.json');
+    const t = JSON.parse(fs.readFileSync(p, 'utf8'));
+    return { active: !!(t && t.until) && new Date(t.until + 'T23:59:59Z').getTime() > Date.now(), until: t && t.until };
+  } catch (e) { return { active: false }; }
+}
+// ★s158 2026-09-23 — the free run SPEAKS about the rest of the folder (vsix: auto.js · crx: welcome tab).
+//   The answer for the named files is complete and free; the next step is shown with the user's OWN numbers:
+//   "this folder has N more matching files - M issues in K of them" + the one command that sweeps them.
+//   Never blocks, never starts a trial (s158: no free trial - the free answer on the named files is the "try it"), human seat only, 400 files / 1.5 s cap.
+function folderHint(done) {
+  if (!process.stderr.isTTY || process.env.CI || process.env.READYSTACK_NO_HINT || !done.length) return;
+  const base = path.dirname(path.resolve(done[0]));
+  const seen = new Set(done.map((f) => path.resolve(f)));
+  const all = walk(base, S.exts || [], []).filter((f) => !seen.has(path.resolve(f)));
+  if (!all.length) return;
+  const t0 = Date.now(); let issues = 0, hitFiles = 0, scanned = 0;
+  for (const f of all.slice(0, 400)) { if (Date.now() - t0 > 1500) break; let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } scanned++; const h = scan(t, f); if (h.length) { issues += h.length; hitFiles++; } }
+  const rel = path.relative(process.cwd(), base) || '.';
+  const tail = trialState().active ? 'free during your trial' : '$' + S.price + ' once';
+  const more = all.length + ' more matching file' + (all.length > 1 ? 's' : '');
+  const found = issues ? ' - ' + (scanned < all.length ? 'at least ' : '') + issues + ' issue' + (issues > 1 ? 's' : '') + ' in ' + hitFiles + ' of them' : ' - no issues found in them';
+  process.stderr.write('\n' + (rel === '.' ? 'This folder' : rel) + ' has ' + more + found + '.\n' + (issues ? 'Sweep them all: ' + S.bin + ' --dir ' + (/\s/.test(rel) ? JSON.stringify(rel) : rel) + '   (' + tail + ')\n' : ''));
+}
+let _usePinged = false;
+function pingUse() {
+  try {
+    if (_usePinged) return; _usePinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;
+    if (!(process.stdout.isTTY || process.stdin.isTTY)) return;   // human seat only (s152)
+    const https = require('https');
+    const body = JSON.stringify({ t: 'use', slug: S.bin, src: 'cli', why: 'free' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + S.bin } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) {}
+}
+function mcpServe() {
+  process.env.READYSTACK_MCP = '1';   // s152 - 에이전트(Claude Code·Cursor)가 부른 세션은 사람 자리다 · 키 판 핑 src=mcp
+  // s144 — MCP server over stdio (newline-delimited JSON-RPC · no dependencies). Free: check_text · check_file. Licence (s158: no free trial): check_dir.
+  const rl = require('readline').createInterface({ input: process.stdin });
+  const send = (o) => process.stdout.write(JSON.stringify(o) + '\n');
+  const tools = [
+    { name: 'check_text', description: S.name + ' - run all ' + RULE_N + ' checks on a text (free)', inputSchema: { type: 'object', properties: { text: { type: 'string', description: 'file contents' }, path: { type: 'string', description: 'optional file name for context' } }, required: ['text'] } },
+    { name: 'check_file', description: S.name + ' - run all checks on one file by path (free)', inputSchema: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] } },
+    { name: 'check_dir', description: S.name + ' - sweep a folder and return every finding (licence; $' + S.price + ' once)', inputSchema: { type: 'object', properties: { dir: { type: 'string' }, ext: { type: 'string', description: 'optional extension filter, e.g. .html' } }, required: ['dir'] } }
+  ];
+  const result = (id, rows) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: render(rows, 'text') }], structuredContent: { tool: S.name, rules: RULE_N, files: rows } } });
+  const fail = (id, text) => send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text }], isError: true } });
+  rl.on('line', async (line) => {
+    let m; try { m = JSON.parse(line); } catch (e) { return; }
+    const id = m.id, method = m.method;
+    if (method === 'initialize') return send({ jsonrpc: '2.0', id, result: { protocolVersion: '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: '@readystack/' + S.bin, version: '1.0.0' } } });
+    if (method === 'notifications/initialized' || method === 'ping') { if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} }); return; }
+    if (method === 'tools/list') return send({ jsonrpc: '2.0', id, result: { tools } });
+    if (method === 'tools/call') {
+      const name = (m.params || {}).name, args = (m.params || {}).arguments || {};
+      try {
+        if (name === 'check_text') return result(id, [{ file: args.path || '(text)', hits: scan(String(args.text || ''), args.path || '') }]);
+        if (name === 'check_file') return result(id, [{ file: args.path, hits: scan(fs.readFileSync(args.path, 'utf8'), args.path) }]);
+        if (name === 'check_dir') {
+          const r = await lic.ensure();
+          if (!r.ok && !trialState().active) return fail(id, S.need_key + ' Get a licence ($' + S.price + ', once): ' + lic.BUY_URL);
+          const files = walk(args.dir, args.ext ? [args.ext] : (S.exts || []), []);
+          return result(id, files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t, f) }; }));
+        }
+        return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool ' + name } });
+      } catch (e) { return fail(id, String(e && e.message || e)); }
+    }
+    if (id !== undefined) send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'method not found: ' + method } });
+  });
+}
+function help() {
+  return [S.name + ' - ' + S.subtitle, '', 'Usage: ' + S.bin + ' <file> [more files]           check the files you name (free, every rule)',
+    '       ' + S.bin + ' --dir <folder> [--ext .html]  scan a whole folder            (licence)',
+    '       ' + S.bin + ' ... --report csv|json|html [--out file]   export a report   (licence)',
+    '       ' + S.bin + ' ... --ci                      exit 1 when an error-level finding exists (licence)',
+    '       ' + S.bin + ' --license <key>               store your licence key (or set READYSTACK_LICENSE)',
+    '       ' + S.bin + ' --rules                       list the ' + RULE_N + ' rules',
+    '       ' + S.bin + ' --mcp                         run as an MCP server (stdio) for Claude Code / Cursor / Windsurf - free checks, folder sweep needs a licence', '',
+    'Free: ' + S.free, 'Licence ($' + S.price + ', once): ' + S.paid, 'Get a licence: ' + lic.BUY_URL, ''].join('\n');
+}
+(async function main() {
+  try { const _feed = await lic.pullFeed(); if (_feed && Array.isArray(_feed.rules)) { if (Array.isArray(ENGINE.RULES)) for (const r of _feed.rules) ENGINE.RULES.push(r); } } catch (e) {}   // ★s134 구독 피드 병합 (키 있는 손님만)
+  const a = process.argv.slice(2);
+  const get = (k) => { const i = a.indexOf(k); return i >= 0 ? a[i + 1] : null; };
+  if (a.includes('--mcp')) { mcpServe(); return; }
+  if (!a.length || a.includes('--help') || a.includes('-h')) { process.stdout.write(help()); return; }
+  if (a.includes('--rules')) { process.stdout.write((RULE_LIST.length ? RULE_LIST.map((r, i) => String(i + 1).padStart(3) + '  [' + (r.sev || 'warn') + '] ' + (r.message || r.msg || r.id || '')) : Array.from({ length: RULE_N }, (_, i) => String(i + 1).padStart(3) + '  [engine] check ' + (i + 1))).join('\n') + '\n'); return; }
+  if (a.includes('--license')) { const r = await lic.ensure(get('--license')); process.stdout.write(r.ok ? 'Licence stored: ' + lic.storePath() + '\n' : 'Licence not accepted (' + r.why + '). Get one: ' + lic.BUY_URL + '\n'); process.exit(r.ok ? 0 : 2); }
+  const dir = get('--dir'), fmt = get('--report'), out = get('--out'), ci = a.includes('--ci');
+  const exts = a.includes('--ext') ? [get('--ext')] : (S.exts || []);
+  const paid = !!(dir || fmt || ci);
+  if (paid) {
+    const r = await lic.ensure();
+    if (!r.ok) {
+      const t = trialState();   // s158 — ⚑7일 무료 없음 · 이미 시작된 체험만 지킨다
+      if (t.active) process.stderr.write('Trial: the full run is free until ' + t.until + ' — after that $' + S.price + ' once. Get a licence: ' + lic.BUY_URL + '\n');
+      else {
+        // s158 — the key is asked WITH the customer's own count (endowment · open loop): how many issues this folder holds.
+        let own = '';
+        if (dir) { try { const all = walk(dir, exts, []); let n = 0, k = 0, sc = 0; const t0 = Date.now();
+          for (const f of all.slice(0, 2000)) { if (Date.now() - t0 > 4000) break; let tx = ''; try { tx = fs.readFileSync(f, 'utf8'); } catch (e) { continue; } sc++; const h = scan(tx, f); if (h.length) { n += h.length; k++; } }
+          if (n) own = dir + ': ' + (sc < all.length ? 'at least ' : '') + n + ' issue' + (n > 1 ? 's' : '') + ' in ' + k + ' of ' + all.length + ' files.\n'; } catch (e) {} }
+        process.stderr.write(own + S.need_key + '\n  set READYSTACK_LICENSE=<key>  or  ' + S.bin + ' --license <key>\n  Get a licence ($' + S.price + ' once): ' + lic.BUY_URL + '\n'); process.exit(2);
+      }
+    }
+  }
+  const files = dir ? walk(dir, exts, []) : a.filter((x, i) => !x.startsWith('--') && !['--dir', '--report', '--out', '--ext', '--license'].includes(a[i - 1]));
+  if (!files.length) { process.stderr.write('No files. ' + S.bin + ' --help\n'); process.exit(2); }
+  const rows = files.map((f) => { let t = ''; try { t = fs.readFileSync(f, 'utf8'); } catch (e) { return { file: f, hits: [], error: String(e.message) }; } return { file: f, hits: scan(t) }; });
+  const text = render(rows, fmt || 'text');
+  if (out) fs.writeFileSync(out, text); else process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+  if (!paid) { try { folderHint(files); } catch (e) {} pingUse(); }   // s158 — a free run ends with the user's own folder count + one anonymous 'used' count (human seat only)
+  const errors = rows.reduce((n, r) => n + r.hits.filter((h) => h.sev === 'error').length, 0);
+  if (ci && errors) process.exit(1);
+})().catch((e) => { process.stderr.write(String(e && e.stack || e) + '\n'); process.exit(3); });

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/js/engine.js

@@ -0,0 +1,76 @@
+/* View in Browser — Publish Leak Audit
+ * One brain, two homes: this exact file runs in the VS Code extension and in the free web page.
+ */
+(function (root) {
+  var isNode = (typeof module !== 'undefined' && module.exports);
+  var RULES = isNode ? require('./rules.json') : root.VIL_RULES;
+
+  function lineOf(text, index) {
+    var n = 1;
+    for (var i = 0; i < index && i < text.length; i++) if (text.charCodeAt(i) === 10) n++;
+    return n;
+  }
+
+  function attrOf(tag, name) {
+    var m = new RegExp('\\b' + name + '\\s*=\\s*("([^"]*)"|\'([^\']*)\'|([^\\s>]+))', 'i').exec(tag);
+    if (!m) return null;
+    return m[2] !== undefined ? m[2] : (m[3] !== undefined ? m[3] : (m[4] || ''));
+  }
+
+  function scanRegex(rule, text, out) {
+    var re = new RegExp(rule.re, 'gi');
+    var m;
+    while ((m = re.exec(text)) !== null) {
+      out.push({ check: rule.id, sev: rule.sev, msg: rule.msg, line: lineOf(text, m.index) });
+      if (m.index === re.lastIndex) re.lastIndex++;
+    }
+  }
+
+  function scanTagMissingAttr(rule, text, out) {
+    var re = new RegExp('<' + rule.tag + '\\b[^>]*>', 'gi');
+    var m;
+    while ((m = re.exec(text)) !== null) {
+      var tag = m[0];
+      var trigger = attrOf(tag, rule.when_attr);
+      if (trigger === null) continue;
+      if (rule.when_re && !new RegExp(rule.when_re, 'i').test(trigger)) continue;
+      var have = attrOf(tag, rule.require_attr);
+      var ok = rule.require_attr_re
+        ? (have !== null && new RegExp(rule.require_attr_re, 'i').test(have))
+        : (have !== null && have !== '');
+      if (!ok) out.push({ check: rule.id, sev: rule.sev, msg: rule.msg, line: lineOf(text, m.index) });
+      if (m.index === re.lastIndex) re.lastIndex++;
+    }
+  }
+
+  function scanYearLtToday(rule, text, opts, out) {
+    var year = parseInt(String((opts && opts.today) || '').slice(0, 4), 10);
+    if (!year) return;
+    var re = new RegExp(rule.re, 'gi');
+    var m;
+    while ((m = re.exec(text)) !== null) {
+      if (parseInt(m[1], 10) < year) {
+        out.push({ check: rule.id, sev: rule.sev, msg: rule.msg, line: lineOf(text, m.index) });
+      }
+      if (m.index === re.lastIndex) re.lastIndex++;
+    }
+  }
+
+  function check(text, opts) {
+    text = String(text == null ? '' : text);
+    opts = opts || {};
+    var out = [];
+    for (var i = 0; i < RULES.length; i++) {
+      var rule = RULES[i];
+      if (rule.kind === 'tag_missing_attr') scanTagMissingAttr(rule, text, out);
+      else if (rule.kind === 'year_lt_today') scanYearLtToday(rule, text, opts, out);
+      else scanRegex(rule, text, out);
+    }
+    out.sort(function (a, b) { return a.line - b.line || a.check.localeCompare(b.check); });
+    return { findings: out };
+  }
+
+  var api = { engine: { check: check }, RULES: RULES, RULE_COUNT: RULES.length };
+  root.VILENGINE = api;
+  if (isNode) module.exports = api;
+})(typeof window !== 'undefined' ? window : globalThis);

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/js/license.js

@@ -0,0 +1,83 @@
+// license.js — Polar licence check for the CLI / container. Generated by adapters.py; do not edit by hand.
+'use strict';
+const https = require('https'), fs = require('fs'), path = require('path'), os = require('os');
+const ORG_ID = 'a5cdf664-d8e7-4f87-8895-056717aaba17';
+const BENEFIT_ID = 'f6649c56-c479-4e11-93d5-607ea7751ddb';   // s142 — this product's Polar benefit (s140 law: ask with benefit_id, or one key opens every product)
+const BUY_URL = 'https://buy.polar.sh/polar_cl_CwvLDIxujtAKjVYNswBmnY71CVpJXNzshSaBQ2RDuKe';
+const SLUG = 'view-in-browser-leak-audit';
+const GRACE_MS = 30 * 24 * 3600 * 1000;   // after a successful check, 30 days work offline
+const RECHECK_MS = 7 * 24 * 3600 * 1000;  // re-ask Polar every 7 days (refunds / cancellations)
+function storePath() { return path.join(process.env.READYSTACK_HOME || path.join(os.homedir(), '.config', 'readystack'), SLUG + '.json'); }
+function load() { try { return JSON.parse(fs.readFileSync(storePath(), 'utf8')); } catch (e) { return {}; } }
+function save(o) { try { fs.mkdirSync(path.dirname(storePath()), { recursive: true }); fs.writeFileSync(storePath(), JSON.stringify(o)); } catch (e) { /* read-only home: still works for this run */ } }
+const ALL_BENEFIT_ID = '22692551-5203-4467-b1a3-e33cdba6589d';   // s149 2026-09-17 — 팀 키(전 린터 한 키 · Polar benefit) · 상품 benefit 다음에 한 번 더 묻는다
+function validate(key) {
+  return validate1(key, BENEFIT_ID).then(function (r) { return (r.ok || r.offline || !/^[0-9a-f-]{36}$/.test(ALL_BENEFIT_ID)) ? r : validate1(key, ALL_BENEFIT_ID); });
+}
+function validate1(key, ben) {
+  return new Promise(function (resolve) {
+    if (!ORG_ID) return resolve({ ok: false, offline: false });
+    const body = JSON.stringify(/^[0-9a-f-]{36}$/.test(ben) ? { key: key, organization_id: ORG_ID, benefit_id: ben } : { key: key, organization_id: ORG_ID });
+    const req = https.request({ hostname: 'api.polar.sh', path: '/v1/customer-portal/license-keys/validate', method: 'POST', timeout: 8000,
+      headers: { 'content-type': 'application/json', 'polar-version': '2026-04', 'content-length': Buffer.byteLength(body) } }, function (res) {
+      let buf = ''; res.on('data', function (d) { buf += d; });
+      res.on('end', function () {
+        if (res.statusCode !== 200) return resolve({ ok: false, offline: false });
+        try { const j = JSON.parse(buf); resolve({ ok: j && (j.status === 'granted' || j.valid === true || !!j.id), offline: false }); }
+        catch (e) { resolve({ ok: false, offline: false }); }
+      });
+    });
+    req.on('timeout', function () { req.destroy(); resolve({ ok: false, offline: true }); });
+    req.on('error', function () { resolve({ ok: false, offline: true }); });
+    req.write(body); req.end();
+  });
+}
+// ★s151 2026-09-19 — 키 판(키가 없거나 거절된 순간)을 익명으로 센다 (슬러그·출처·이유만) · DO_NOT_TRACK=1 · READYSTACK_NO_TELEMETRY 면 안 보낸다 · 실패는 조용히 · 프로세스당 한 번.
+let _pinged = false;
+function pingPaywall(why) {
+  try {
+    if (_pinged) return; _pinged = true;
+    if (process.env.DO_NOT_TRACK === '1' || process.env.READYSTACK_NO_TELEMETRY || process.env.CI) return;   // s151: CI(깃허브 액션 등)와 우리 빌드는 손님이 아니다
+    if (!(process.stdout.isTTY || process.stdin.isTTY || process.env.READYSTACK_MCP === '1')) return;   // s152: 사람 자리(터미널·MCP 세션)에서만 센다 - 발행 1분 뒤 남의 실행기(JP · 우리 3대는 US)가 돌린 no_key 13건은 손님이 아니다
+    const body = JSON.stringify({ t: 'paywall', slug: SLUG, src: process.env.READYSTACK_MCP === '1' ? 'mcp' : 'cli', why: why || 'no_key' });
+    const req = https.request({ hostname: 'getreadystack.com', path: '/api/ev', method: 'POST', timeout: 3000,
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), 'user-agent': 'readystack-cli/' + SLUG } }, function (res) { res.resume(); });
+    req.on('timeout', function () { req.destroy(); }); req.on('error', function () {});
+    req.write(body); req.end();
+  } catch (e) { /* 세는 것이 실패해도 상품은 돈다 */ }
+}
+async function ensure(explicitKey) {
+  const st = load();
+  const key = explicitKey || process.env.READYSTACK_LICENSE || st.key;
+  if (!key) { pingPaywall('no_key'); return { ok: false, why: 'no_key' }; }   // s151
+  const age = Date.now() - (st.okAt || 0);
+  if (!explicitKey && st.key === key && age < RECHECK_MS) return { ok: true, cached: true };
+  const r = await validate(String(key).trim());
+  if (r.ok) { save({ key: String(key).trim(), okAt: Date.now() }); return { ok: true }; }
+  if (r.offline && st.key === key && age < GRACE_MS) return { ok: true, offline: true };
+  if (!r.offline) pingPaywall('invalid');   // s151
+  return { ok: false, why: r.offline ? 'offline' : 'invalid' };
+}
+// ★s134 — 구독 규칙 피드(층3 "바뀌면 업데이트"): 키 있는 손님만 · 7일마다 · 오프라인은 캐시. 워커 GET /api/rules/<slug>?key=
+const FEED_URL = 'https://getreadystack.com/api/rules/';
+function pullFeed() {
+  const st = load(); const key = process.env.READYSTACK_LICENSE || st.key; const cached = st.feed || null;
+  if (!key) return Promise.resolve(cached);
+  if (cached && (Date.now() - (st.feedAt || 0)) < RECHECK_MS) return Promise.resolve(cached);
+  return new Promise(function (resolve) {
+    let req;
+    try {
+      req = https.get(FEED_URL + encodeURIComponent(SLUG) + '?key=' + encodeURIComponent(key), { timeout: 8000, headers: { 'user-agent': 'readystack-cli' } }, function (res) {
+        let buf = ''; res.on('data', function (d) { buf += d; });
+        res.on('end', function () {
+          if (res.statusCode !== 200) return resolve(cached);
+          try { const j = JSON.parse(buf); if (!j || !Array.isArray(j.rules)) return resolve(cached); save(Object.assign(load(), { feed: j, feedAt: Date.now() })); resolve(j); }
+          catch (e) { resolve(cached); }
+        });
+      });
+    } catch (e) { return resolve(cached); }
+    req.on('timeout', function () { req.destroy(); resolve(cached); });
+    req.on('error', function () { resolve(cached); });
+  });
+}
+module.exports = { ensure, BUY_URL, storePath, pullFeed };

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/js/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@readystack/view-in-browser-leak-audit",
+  "version": "1.0.2",
+  "description": "24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resou",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "view in browser",
+    "html",
+    "preview",
+    "api key",
+    "secret",
+    "localhost",
+    "publish",
+    "static site",
+    "audit",
+    "leak"
+  ],
+  "homepage": "https://getreadystack.com",
+  "funding": "https://buy.polar.sh/polar_cl_CwvLDIxujtAKjVYNswBmnY71CVpJXNzshSaBQ2RDuKe",
+  "bin": {
+    "view-in-browser-leak-audit": "cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "mcpName": "io.github.jmshinhwa/view-in-browser-leak-audit",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/jmshinhwa/readystack-themes.git",
+    "directory": "view-in-browser-leak-audit"
+  },
+  "files": [
+    "cli.js",
+    "license.js",
+    "rules.json",
+    "strings.json",
+    "README.md",
+    "LICENSE.txt",
+    "engine.js"
+  ]
+}

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/js/rules.json

@@ -0,0 +1,186 @@
+[
+ {
+  "id": "secret_google_api_key",
+  "sev": "high",
+  "kind": "regex",
+  "re": "AIza[0-9A-Za-z_\\-]{35}",
+  "msg": "Google API key literal sits in the page source — anyone who opens View Source has it. Restrict the key by HTTP referrer or move the call server-side before you publish.",
+  "consts": {
+   "sev_order": [
+    "high",
+    "med",
+    "low"
+   ],
+   "rail": "local preview -> public host",
+   "kit": "readystack"
+  }
+ },
+ {
+  "id": "secret_aws_access_key",
+  "sev": "high",
+  "kind": "regex",
+  "re": "AKIA[0-9A-Z]{16}",
+  "msg": "AWS access key id in client-side HTML. Rotate it and sign requests from a backend — a browser page cannot keep this secret."
+ },
+ {
+  "id": "secret_stripe_live",
+  "sev": "high",
+  "kind": "regex",
+  "re": "sk_live_[0-9a-zA-Z]{10,}",
+  "msg": "Stripe SECRET key (sk_live_) in the page. Only pk_ publishable keys belong in a browser. Roll this key in the Stripe dashboard now."
+ },
+ {
+  "id": "secret_slack_token",
+  "sev": "high",
+  "kind": "regex",
+  "re": "xox[baprs]-[0-9A-Za-z-]{10,}",
+  "msg": "Slack token in the page source. Revoke it and call Slack from a server, not from the visitor's browser."
+ },
+ {
+  "id": "secret_private_key_block",
+  "sev": "high",
+  "kind": "regex",
+  "re": "-----BEGIN [A-Z ]*PRIVATE KEY-----",
+  "msg": "A PEM private key block is pasted into this HTML file. Delete it, rotate the key pair, and never ship a private key to a static host."
+ },
+ {
+  "id": "secret_firebase_apikey",
+  "sev": "high",
+  "kind": "regex",
+  "re": "apiKey\\s*:\\s*[\\\"'][^\\\"']{15,}[\\\"']",
+  "msg": "Firebase-style apiKey literal in inline script. Lock the project with security rules and App Check — a published config without rules is an open database."
+ },
+ {
+  "id": "secret_generic_assignment",
+  "sev": "high",
+  "kind": "regex",
+  "re": "(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|password)\\s*[:=]\\s*[\\\"'][^\\\"'\\s]{12,}[\\\"']",
+  "msg": "A credential is assigned to a literal string in this page. Move it behind a request your server makes, then rotate the value you just exposed."
+ },
+ {
+  "id": "basic_auth_in_url",
+  "sev": "high",
+  "kind": "regex",
+  "re": "https?://[A-Za-z0-9._%+-]+:[^\\s\\\"'/@]+@",
+  "msg": "user:password embedded in a URL. Credentials in a URL leak through history, logs and the Referer header. Remove them before publishing."
+ },
+ {
+  "id": "localhost_url",
+  "sev": "high",
+  "kind": "regex",
+  "re": "https?://(?:localhost|127\\.0\\.0\\.1)(?::\\d+)?",
+  "msg": "A localhost URL works in your preview and dies for every visitor. Point it at the public origin, or make it a relative path."
+ },
+ {
+  "id": "private_lan_url",
+  "sev": "high",
+  "kind": "regex",
+  "re": "https?://(?:10\\.\\d|192\\.168\\.|172\\.(?:1[6-9]|2\\d|3[01])\\.)",
+  "msg": "A private LAN address is hard-coded here. It resolves on your machine only, and it tells strangers your internal network layout."
+ },
+ {
+  "id": "file_scheme_url",
+  "sev": "high",
+  "kind": "regex",
+  "re": "file:///",
+  "msg": "A file:/// URL only opens from your own disk. Browsers block it from a web page, so this asset will be missing once published."
+ },
+ {
+  "id": "local_disk_path",
+  "sev": "high",
+  "kind": "regex",
+  "re": "(?:src|href)\\s*=\\s*[\\\"'](?:[A-Za-z]:\\\\|/Users/|/home/|/tmp/)",
+  "msg": "An absolute path from your own disk is used as src/href. It breaks on the host and it prints your username into the page."
+ },
+ {
+  "id": "mixed_content_resource",
+  "sev": "med",
+  "kind": "regex",
+  "re": "(?:src|href)\\s*=\\s*[\\\"']http://(?!localhost|127\\.0\\.0\\.1)",
+  "msg": "Plain http:// resource on a page that will be served over https. Browsers block or downgrade it — switch the URL to https://."
+ },
+ {
+  "id": "insecure_form_action",
+  "sev": "high",
+  "kind": "regex",
+  "re": "<form\\b[^>]*\\baction\\s*=\\s*[\\\"']http://",
+  "msg": "Form posts over plain http://. Whatever the visitor types travels in clear text. Change the action to https://."
+ },
+ {
+  "id": "robots_noindex",
+  "sev": "high",
+  "kind": "regex",
+  "re": "<meta\\b[^>]*name\\s*=\\s*[\\\"']robots[\\\"'][^>]*noindex",
+  "msg": "A leftover robots noindex tag. The page will publish fine and then never appear in search — the failure nobody notices for weeks."
+ },
+ {
+  "id": "cdn_unpinned_latest",
+  "sev": "med",
+  "kind": "regex",
+  "re": "src\\s*=\\s*[\\\"']https://(?:cdn\\.jsdelivr\\.net|unpkg\\.com)/[^\\\"']*@latest",
+  "msg": "Third-party script pinned to @latest. The vendor can change your live page at any moment. Pin an exact version."
+ },
+ {
+  "id": "source_map_ref",
+  "sev": "med",
+  "kind": "regex",
+  "re": "//#\\s*sourceMappingURL=",
+  "msg": "A source map reference is shipped with the page, handing readers your unminified source. Drop it from the production build."
+ },
+ {
+  "id": "commented_secret",
+  "sev": "med",
+  "kind": "regex",
+  "re": "<!--[^>]*?(?:api[_-]?key|token|password|secret)",
+  "msg": "A credential is sitting inside an HTML comment. Comments ship to the browser — commenting a secret out does not hide it."
+ },
+ {
+  "id": "placeholder_left",
+  "sev": "med",
+  "kind": "regex",
+  "re": "(?:YOUR_API_KEY|CHANGE_?ME|FIXME|TODO)",
+  "msg": "A placeholder or TODO marker survived into the page you are about to publish. Fill it in or delete the block."
+ },
+ {
+  "id": "console_debug_left",
+  "sev": "low",
+  "kind": "regex",
+  "re": "console\\.(?:log|debug|table|dir)\\s*\\(",
+  "msg": "Debug console output left in the page. It is noise at best and it prints your data objects to anyone with DevTools open."
+ },
+ {
+  "id": "debug_flag_true",
+  "sev": "low",
+  "kind": "regex",
+  "re": "\\b(?:DEBUG|VERBOSE|IS_DEV)\\s*[:=]\\s*true\\b",
+  "msg": "A debug flag is still switched on. Set it to false so the published page does not run its development branch."
+ },
+ {
+  "id": "external_script_no_sri",
+  "sev": "med",
+  "kind": "tag_missing_attr",
+  "tag": "script",
+  "when_attr": "src",
+  "when_re": "^https?://",
+  "require_attr": "integrity",
+  "msg": "External script loaded with no integrity hash. If that CDN account is ever taken over, the attacker runs code on your page. Add integrity and crossorigin."
+ },
+ {
+  "id": "blank_link_no_noopener",
+  "sev": "low",
+  "kind": "tag_missing_attr",
+  "tag": "a",
+  "when_attr": "target",
+  "when_re": "^_blank$",
+  "require_attr": "rel",
+  "require_attr_re": "noopener",
+  "msg": "target=\"_blank\" without rel=\"noopener\". The page you link to can reach back into this tab. Add rel=\"noopener\"."
+ },
+ {
+  "id": "stale_year_literal",
+  "sev": "low",
+  "kind": "year_lt_today",
+  "re": "(?:©|&copy;|Copyright)\\s*(?:&copy;\\s*)?(\\d{4})",
+  "msg": "The copyright year in this page is older than today. Visitors read a stale year as an abandoned site; generated markup gets this wrong constantly."
+ }
+]

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit/js/strings.json

@@ -0,0 +1,10 @@
+{
+ "name": "View in Browser — Publish Leak Audit (HTML)",
+ "subtitle": "24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resources, a leftover noindex.",
+ "bin": "view-in-browser-leak-audit",
+ "price": 29,
+ "free": "Audit the HTML file you are about to open in the browser: all 24 rules, every finding with its severity, line number and fix. The clean fixture returns 0 findings, the dirty one returns 27. No key, no watermark, no locked answers.",
+ "paid": "Scope: one command sweeps every HTML file in the workspace instead of the one in front of you, and writes a dated LEAK-AUDIT.md you keep as evidence — forty pages in one pass instead of forty passes.",
+ "need_key": "This option needs a licence (View in Browser — Publish Leak Audit (HTML)).",
+ "exts": []
+}

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit.egg-info/PKG-INFO

@@ -0,0 +1,84 @@
+Metadata-Version: 2.4
+Name: readystack-view-in-browser-leak-audit
+Version: 1.0.2
+Summary: 24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resou (bundled Node.js runtime)
+Author-email: ReadyStack <support@getreadystack.com>
+License: Proprietary - see LICENSE.txt
+Project-URL: Homepage, https://getreadystack.com/tools/view-in-browser-leak-audit?ref=pypi
+Project-URL: Documentation, https://getreadystack.com/tools/view-in-browser-leak-audit?ref=pypi
+Project-URL: Support, https://getreadystack.com/support
+Keywords: view in browser,html,preview,api key,secret,localhost,publish,static site,audit,leak
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE.txt
+Requires-Dist: nodejs-wheel-binaries>=20
+Dynamic: license-file
+
+# View in Browser — Publish Leak Audit (HTML)
+
+> Runs the same checker as the npm package `@readystack/view-in-browser-leak-audit` on a Node.js runtime that pip installs for you (`nodejs-wheel-binaries`) - no system Node.js needed. Your files are checked locally.
+
+![View in Browser — Publish Leak Audit (HTML)](https://getreadystack.com/img/promo/sku128294_result_card.jpg)
+
+24 rules read the .html file you are about to open in the browser and flag every line that behaves differently once the page has a public URL: live API keys, localhost and file:// paths, http:// resources, a leftover noindex.
+
+## Install
+
+```
+view-in-browser-leak-audit file
+```
+
+Node 18+. The same 24 rules as the VS Code extension, from a terminal or CI.
+
+## Free
+
+- Audit the HTML file you are about to open in the browser: all 24 rules, every finding with its severity, line number and fix. The clean fixture returns 0 findings, the dirty one returns 27. No key, no watermark, no locked answers.
+- `--rules` lists every rule
+
+## With a licence ($29 once)
+
+- Scope: one command sweeps every HTML file in the workspace instead of the one in front of you, and writes a dated LEAK-AUDIT.md you keep as evidence — forty pages in one pass instead of forty passes.
+
+```
+@readystack/view-in-browser-leak-audit --dir ./templates --report html --out report.html
+```
+
+In February 2026 a developer reported an $82,000 Google Cloud bill after a key embedded in client-side Google Maps code was taken from the page source; their normal spend was $180 a month.
+
+## Use from an AI agent (MCP)
+
+Claude Code · Cursor · Windsurf · any MCP client - add to your MCP config:
+
+```json
+{ "mcpServers": { "view-in-browser-leak-audit": { "command": "npx", "args": ["-y", "@readystack/view-in-browser-leak-audit", "--mcp"] } } }
+```
+
+Tools: `check_text` and `check_file` (free) · `check_dir` (licence). The agent gets every finding with the line number.
+
+## Use in CI
+
+```yaml
+- name: View in Browser — Publish Leak Audit (HTML)
+  run: npx -y @readystack/view-in-browser-leak-audit --dir . --ci
+```
+
+(container: `docker run --rm -v "$PWD:/work" getreadystack/view-in-browser-leak-audit --dir /work --ci`)
+
+The folder sweep, reports and CI mode need one licence — one payment, no subscription. Set `READYSTACK_LICENSE=<key>` or run `--license <key>` once.
+
+[Get a licence](https://buy.polar.sh/polar_cl_CwvLDIxujtAKjVYNswBmnY71CVpJXNzshSaBQ2RDuKe)
+
+
+<!-- view in browser leak audit -->
+
+
+## Install (PyPI)
+
+```
+pip install readystack-view-in-browser-leak-audit
+view-in-browser-leak-audit --help
+```

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit.egg-info/SOURCES.txt

@@ -0,0 +1,17 @@
+LICENSE.txt
+README.md
+pyproject.toml
+src/readystack_view_in_browser_leak_audit/__init__.py
+src/readystack_view_in_browser_leak_audit/__main__.py
+src/readystack_view_in_browser_leak_audit.egg-info/PKG-INFO
+src/readystack_view_in_browser_leak_audit.egg-info/SOURCES.txt
+src/readystack_view_in_browser_leak_audit.egg-info/dependency_links.txt
+src/readystack_view_in_browser_leak_audit.egg-info/entry_points.txt
+src/readystack_view_in_browser_leak_audit.egg-info/requires.txt
+src/readystack_view_in_browser_leak_audit.egg-info/top_level.txt
+src/readystack_view_in_browser_leak_audit/js/cli.js
+src/readystack_view_in_browser_leak_audit/js/engine.js
+src/readystack_view_in_browser_leak_audit/js/license.js
+src/readystack_view_in_browser_leak_audit/js/package.json
+src/readystack_view_in_browser_leak_audit/js/rules.json
+src/readystack_view_in_browser_leak_audit/js/strings.json

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+view-in-browser-leak-audit = readystack_view_in_browser_leak_audit.__main__:main

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit.egg-info/requires.txt

@@ -0,0 +1 @@
+nodejs-wheel-binaries>=20

readystack_view_in_browser_leak_audit-1.0.2/src/readystack_view_in_browser_leak_audit.egg-info/top_level.txt

@@ -0,0 +1 @@
+readystack_view_in_browser_leak_audit