🚀 ship18ion

"Production Readiness Inspector" for your apps.

ship18ion (read as "ship-tion") is a CLI tool designed to prevent production disasters before they happen. It scans your codebase for environment configuration issues, leaked secrets, dangerous security misconfigurations, and build artifacts that shouldn't be there.

Think of it as eslint but for deployability.

✨ Features

• 🌱 Environment Hygiene:

  • Finds unused variables in your .env files.
  • Detects usage of process.env.VAR that are missing definitions.
  • Supports .env, .env.production and import.meta.env (Vite).

• 🔐 Secret Detection:

  • Catches hardcoded secrets (AWS keys, Stripe keys, generic private keys).
  • Uses entropy heuristics to find potential secrets hidden in plain sight.
  • Next.js Safety: Warns if NEXT_PUBLIC_ variables contain high-entropy strings (potential accidental leaks).

• ⚠️ Security & Config:

  • Alerts on debug: true or NODE_ENV mismatches.
  • Detects dangerous CORS configurations (origin: '*').
  • Finds hardcoded database connection strings.

• 📦 Build Safety:

  • Prevents source maps (.map) from leaking into production builds.
  • Ensures .env files are not bundled into build output directories.
  • Checks for dev dependencies (like eslint) accidentally listed in dependencies.

• 🧹 Code Hygiene (New):

  • Warns on leftover console.log() calls.
  • Flags FIXME comments that need resolution.

• 📦 Dependencies (New):

  • Checks for duplicate packages (listed in both dependencies and devDependencies).

• 🐙 Git Safety (New):

  • Ensures critical files (node_modules, .env) and framework artifacts (.next) are git-ignored.
  • Security: alerts if dangerous keys (e.g. serviceAccountKey.json) exist but are not ignored.

• 👷 CI/CD Ready:

  • Zero config by default.
  • Returns exit code 1 on failure to block bad builds.

📦 Installation

You can use it directly with npx:

npx ship18ion check

Or install it as a dev dependency:

npm install --save-dev ship18ion

🚀 Usage

Run the check in your project root:

npx ship18ion

CI Mode

For Continuous Integration pipelines (GitHub Actions, GitLab CI, etc.), use the --ci flag for minimal output and standard exit codes:

npx ship18ion check --ci

⚙️ Configuration

ship18ion works out of the box, but you can customize it by creating a ship18ion.config.json file in your root directory:

{
  "env": {
    "required": ["DATABASE_URL", "JWT_SECRET"],
    "disallowed": ["DEBUG_TOKEN"]
  },
  "security": {
    "noCorsWildcard": true,
    "requireRateLimit": false
  },
  "ignore": [
    "**/legacy-code/**",
    "**/test-fixtures/**"
  ]
}

🛡️ Rules Breakdown

Category	Rule	Description
Env	env-unused	A variable is defined in .env but never referenced in code.
Env	env-missing	A variable is used in code (process.env.X) but not defined.
Secrets	secret-pattern	Matches regex for known keys (AWS, Stripe, OpenAI).
Next.js	nextjs-public-secret	High-entropy string found in NEXT_PUBLIC_ variable.
Security	security-cors	Detects wildcard Access-Control-Allow-Origin.
Git	git-dirty	Warns if deploying with uncommitted changes.
Git	git-ignore-missing	Warns if .gitignore is missing critical entries (node_modules, .env).
Git	git-ignore-auth	Critical: Fails if serviceAccountKey.json etc are not ignored.
Hygiene	hygiene-console-log	Warns on console.log in production code.
Hygiene	hygiene-fixme	Warns on leftover FIXME comments.
Package	package-duplicate	Warns if a package is in both dependency lists.

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📄 License

ISC