#!/usr/bin/env bash
# L4b security floor (NOT the whole of security — a real pen-test is in the milestone battery).
# Three checks: dependency audit · secrets scan · .env hygiene. Adapt the tools to your stack.
set -uo pipefail
fail=0

echo "== [1/3] Dependency audit =="
# <FILL IN>  e.g.  npm audit --audit-level=high   |   pip-audit
echo "   (replace with your audit tool)"

echo "== [2/3] Secrets scan (tracked files) =="
if git grep -nEI '(api[_-]?key|secret|password|token)[\"'\'' :=]+[A-Za-z0-9/_+-]{16,}' -- . ':!*.md' ':!*.lock' 2>/dev/null; then
  echo "   ^ possible secret in tracked files — investigate"; fail=1
else echo "   clean"; fi

echo "== [3/3] .env hygiene =="
if git ls-files --error-unmatch .env >/dev/null 2>&1; then
  echo "   .env is TRACKED — remove it and add to .gitignore"; fail=1
else echo "   .env not tracked ✓"; fi

[ "$fail" -eq 0 ] && echo "SECURITY RIG: GREEN" || { echo "SECURITY RIG: FAILED"; exit 1; }