security-audit

Security audit before a spawnpoint deploy

Run it on the app directory (the argument, or the current directory) once the files are final, before create_upload or deploy_project. Install nothing. End with one table and a verdict.

The rules

• block: no deploy_project until it is fixed or, where allowed, accepted. warn: fix it unless the user accepts. note: mention once.
• Only two findings can never be accepted: credential content and a private-key file. The server refuses those bundles anyway.
• Fix what is safe and say so: a port read from the environment, the bind address, a debug flag, a secret moved to env, an exclusion, and a token check on an admin, debug, or owner-only upload or presign route (generate the token, pass it as env, and give it to the owner once in your reply). Then deploy. Ask first only before changing what the app's own users get: narrowing CORS, removing a route, or making a route they use private.
• Never print a secret you found: file, line, and kind only.
• On a redeploy in the same session, rerun only if files changed. An acceptance holds for the session.

1. What ships

• [block] A credential-shaped string in any text file: the seven patterns in patterns.md, with its one-line grep. Fix: move the value into env on deploy_project (or set_env), read it from the environment, and tell the user to rotate the key: it is in this transcript now. A spawnpoint bucket's key (the project's S3_* values) is rotated with rotate_storage_key.
• [block] A credential file by name (the list in patterns.md). Fix: exclude it. .npmrc matters twice: it ships, and npm ci on the machine reads it.
• [strip] .env, .env.*, .git/: exclude them. Name the variables .env held (never the values) and offer to pass each one as env.
• [exclude] node_modules/, .venv/, venv/, __pycache__/, .next/, dist/ and build/ when a build script exists, .DS_Store, *.log. These become the tar --exclude flags for create_upload's command.
• [warn] Local databases and dumps (*.sqlite, *.sqlite3, *.db, *.sql, *.dump, *.bak): ask once whether a seeded demo is intended.
• [warn] Over about 15 MiB before compression: images first.