24 lines
801 B
TypeScript
24 lines
801 B
TypeScript
const excluded = /(^|\/)(node_modules|dist|data|workspace|\.git)(\/|$)/u;
|
|
const suspicious = [
|
|
/sk-[A-Za-z0-9_-]{20,}/u,
|
|
/-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----/u,
|
|
];
|
|
const violations: string[] = [];
|
|
|
|
for await (const path of new Bun.Glob(
|
|
"**/*.{ts,js,json,md,yaml,yml,css,html}",
|
|
).scan(".")) {
|
|
if (excluded.test(path)) continue;
|
|
const content = await Bun.file(path).text();
|
|
if (suspicious.some((pattern) => pattern.test(content)))
|
|
violations.push(`${path}: 疑似包含真实凭据`);
|
|
if (path.startsWith("apps/web/") && content.includes("DEEPSEEK_API_KEY"))
|
|
violations.push(`${path}: 客户端不得引用模型密钥环境变量`);
|
|
}
|
|
|
|
if (violations.length) {
|
|
console.error(violations.join("\n"));
|
|
process.exit(1);
|
|
}
|
|
console.log("敏感信息检查通过。");
|