spb/drive Public

1#!/usr/bin/env node2/**3 * ─────────────────────────────────────────────4 *  SPB Drive — Personal Cloud Drive5 * ─────────────────────────────────────────────6 *  Author  : Simon-Pierre Boucher7 *  Contact : contact@spboucher.ai8 *  File    : scripts/check-secrets.mjs9 *  Purpose : CI gate — fail if any forbidden secret literal appears in the repo10 *  License : MIT © Simon-Pierre Boucher11 * ─────────────────────────────────────────────12 */1314import { execSync } from 'node:child_process';15import { readFileSync } from 'node:fs';1617// Forbidden literals are stored base64-encoded so this checker never18// contains the plaintext it is guarding against.19const FORBIDDEN = ['c24xOGJyYWR5'].map((b64) => Buffer.from(b64, 'base64').toString('utf8'));2021const files = execSync('git ls-files', { encoding: 'utf8' }).split('\n').filter(Boolean);22const hits = [];2324for (const file of files) {25  let buf;26  try { buf = readFileSync(file); } catch { continue; }27  const text = buf.toString('utf8');28  for (const secret of FORBIDDEN) {29    if (text.includes(secret)) hits.push(file);30  }31}3233if (hits.length > 0) {34  console.error('✗ Forbidden secret literal found in:');35  for (const file of hits) console.error(`  ${file}`);36  process.exit(1);37}38console.log('✓ check:secrets — no forbidden literals in tracked files.');39