fix: resolve artifact-env-leak false positives for node_modules and public tokens

[skoshx]

Summary

Fixes two false positive cases in the artifact-env-leak security scan rule:

1. Vendor library examples in sourcemaps: JSDoc comments in node_modules libraries (e.g., @reatom/core with hypothetical process.env.DATABASE_URL usage) were flagged when included in sourcemap sourcesContent
2. Intentionally-public tokens: Public tokens following common naming conventions like VITE_STYTCH_PUBLIC_TOKEN (analogous to Stripe's PUBLISHABLE_KEY) were flagged despite having PUBLIC in their name

Root Cause

Issue 1: node_modules in sourcemaps

• Sourcemaps include sourcesContent with original source from all bundled files, including node_modules
• The maskSourceComments function returned sourcemaps unchanged (they're JSON, not JS/TS)
• Secret-like patterns in vendor library JSDoc examples triggered false positives

Issue 2: Public token pattern

• VITE_STYTCH_PUBLIC_TOKEN matches VITE_*_TOKEN but wasn't explicitly trusted
• The trust list was vendor-specific rather than pattern-based
• Following the existing PUBLISHABLE pattern, *_PUBLIC_* tokens should be trusted

Changes

1. Extended maskSourceComments for sourcemaps:

   • Detects .map files and parses as JSON
   • For each sourcesContent entry from a node_modules source, masks comments individually
   • Reassembles JSON with masked content

2. Added pattern-based trust for public tokens:

   • Trust pattern: _[A-Z0-9]+_PUBLIC_(TOKEN|KEY|SECRET)
   • Requires at least one component between _ and PUBLIC to avoid matching NEXT_PUBLIC_ / EXPO_PUBLIC_ prefixes
   • Examples:
     • ✅ VITE_STYTCH_PUBLIC_TOKEN (trusted - has _STYTCH_PUBLIC_TOKEN)
     • ✅ NEXT_PUBLIC_STRIPE_PUBLIC_KEY (trusted - has _STRIPE_PUBLIC_KEY)
     • ❌ NEXT_PUBLIC_SECRET_TOKEN (still flags - no _X_PUBLIC_ pattern)

Testing

• Added comprehensive regression tests covering both sourcemap masking and public token trust
• All existing artifact-env-leak tests pass (45 tests)
• All check-security-scan fixture tests pass (151 tests)
• Lint and typecheck clean

Scope Decision

Narrowly scoped to:

• Only mask comments in node_modules sources within sourcemaps (app code still scanned)
• Only trust tokens with _PUBLIC_ as a distinct infix (not part of the prefix)
• Existing behavior preserved for all other cases

Closes #1738

  

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1740

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1740

npm i https://pkg.pr.new/react-doctor@1740

commit: fa914fc

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at fa914fc in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence