/**
 * Web Safety Scanner
 *
 * Detects the top vibe-coding / AI-generated-app breach classes that existing
 * scanners do not cover deterministically:
 *
 *  1. RLS-off (Supabase / Postgres / Drizzle)
 *     — CREATE TABLE with no matching ENABLE ROW LEVEL SECURITY → entire table
 *       is readable/writable by any authenticated user; the #1 Lovable/Bolt breach.
 *     — Explicit DISABLE ROW LEVEL SECURITY.
 *     — service_role key exposed in client/edge-reachable code (bypasses RLS entirely).
 *
 *  2. Webhook signature verification missing
 *     — A route or handler that processes webhook POSTs (Stripe, Svix/Clerk, GitHub)
 *       but never calls the provider's `.constructEvent()` / `.verify()` /
 *       `crypto.timingSafeEqual` guard → replay / forgery allows fake payments etc.
 *
 *  3. Client-exposed secrets (NEXT_PUBLIC / VITE_ / REACT_APP_ prefix + secret suffix)
 *     — Env vars whose name announces they will ship to the browser bundle, but whose
 *       suffix indicates they carry a real secret. Operates on .env files and on
 *       process.env / import.meta.env assignments in source.
 *     NOTE: NEXT_PUBLIC_SUPABASE_ANON_KEY is intentionally NOT flagged — the anon key
 *     is designed to be public; the risk is RLS-off (covered by Detector 1 above).
 *
 * Hardening: bounded directory walk (withFileTypes, skip symlinks, EXCLUDED_DIR_RE,
 * MAX_FILES cap, per-file MAX_FILE_BYTES stat check before read), resolveContainedFile
 * for defence-in-depth, and validateProjectPath at the public entry point.
 * Never throws past the module boundary; always returns a ScannerResult.
 *
 * @module scanners/web-safety
 */
import type { ScannerResult } from "./types.js";
export declare const WEB_SAFETY_RULES: {
    readonly RLS_DISABLED: "web-safety:rls-disabled";
    readonly RLS_FORCE_DISABLED: "web-safety:rls-force-disabled";
    readonly SERVICE_ROLE_CLIENT_EXPOSED: "web-safety:service-role-client-exposed";
    readonly WEBHOOK_NO_SIGNATURE_VERIFICATION: "web-safety:webhook-no-signature-verification";
    readonly CLIENT_EXPOSED_SECRET: "web-safety:client-exposed-secret";
};
/**
 * Run the web safety scanner against a project.
 *
 * Returns errors in the result, never throws. Gracefully degrades when no
 * relevant files are found (returns success: true, findings: []).
 */
export declare function runWebSafety(projectPath: string): Promise<ScannerResult>;
//# sourceMappingURL=web-safety.d.ts.map