Harden public showcase privacy controls

scripts/check-public-safety.py

@@ -33,6 +33,7 @@ PRIVATE_MOUNT = re.compile(r"(?i)/mnt/(?!storage\b|media\b|backups\b|example\b)[
 PRIVATE_OPT = re.compile(r"(?i)/opt/(?!example\b|application\b)[a-z0-9._-]+\b")
 PRIVATE_KEY = re.compile(r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----", re.I)
 EMAIL = re.compile(r"(?i)\b[A-Z0-9._%+-]+@([A-Z0-9.-]+\.[A-Z]{2,})\b")
+URL_HOST = re.compile(r"(?i)https?://([a-z0-9.-]+)")
 SECRET_ASSIGNMENT = re.compile(
     r"(?i)\b(?:api[_-]?(?:key|token)|access[_-]?token|auth[_-]?token|token|password|passwd|"
     r"client[_-]?secret|cookie|private[_-]?key)\b\s*[:=]\s*[\"']?([^\s\"',}]+)"
@@ -43,11 +44,14 @@ AUTHORIZATION = re.compile(
 OPAQUE = re.compile(r"\b[A-Za-z0-9_+/=-]{32,}\b")
 
 RISKY_SUFFIXES = {
-    ".pem", ".key", ".p12", ".pfx", ".kdbx", ".ovpn", ".mobileconfig"
+    ".pem", ".key", ".p12", ".pfx", ".kdbx", ".ovpn", ".mobileconfig",
+    ".db", ".sqlite", ".sqlite3", ".dump", ".pcap", ".pcapng",
 }
 RISKY_NAMES = {
     ".env", "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa", "wg0.conf"
 }
+RAW_EXPORT_NAME = re.compile(r"(?i)(?:^|[-_.])(?:backup|dump|export|baseline|snapshot)(?:[-_.]|$)")
+ALLOWED_URL_HOSTS = {"github.com", "service.example.net"}
 
 
 def tracked_files() -> list[Path]:
@@ -88,6 +92,8 @@ def main() -> int:
             findings.add(f"{relative}: prohibited key/config suffix")
         if re.fullmatch(r"wg\d+\.conf", name):
             findings.add(f"{relative}: prohibited VPN configuration filename")
+        if RAW_EXPORT_NAME.search(name):
+            findings.add(f"{relative}: raw export/backup-style filename requires review")
 
         try:
             data = path.read_bytes()
@@ -95,6 +101,7 @@ def main() -> int:
             findings.add(f"{relative}: unreadable: {exc}")
             continue
         if b"\0" in data[:4096]:
+            findings.add(f"{relative}: binary tracked file requires manual review")
             continue
 
         for line_number, line in enumerate(data.decode("utf-8", errors="ignore").splitlines(), 1):
@@ -124,6 +131,13 @@ def main() -> int:
                 if not domain.endswith(("example.com", "example.net", "example.org")):
                     findings.add(f"{prefix}: non-example email address")
 
+            for match in URL_HOST.finditer(line):
+                host = match.group(1).lower()
+                if host not in ALLOWED_URL_HOSTS and not host.endswith(
+                    (".example.com", ".example.net", ".example.org")
+                ):
+                    findings.add(f"{prefix}: non-approved URL host")
+
             for match in SECRET_ASSIGNMENT.finditer(line):
                 value = match.group(1)
                 if not is_placeholder(value):
@@ -134,12 +148,13 @@ def main() -> int:
                 if not is_placeholder(value):
                     findings.add(f"{prefix}: authorization material")
 
-            for candidate in OPAQUE.findall(line):
+            line_without_urls = re.sub(r"https?://\S+", "", line)
+            for candidate in OPAQUE.findall(line_without_urls):
                 if is_placeholder(candidate):
                     continue
                 # Commit hashes and content digests are still identifiers; require a label.
                 labelled_hash = re.search(
-                    r"(?i)\b(?:sha(?:1|256|512)|digest|commit|checksum|example[_-]?hash)\b",
+                    r"(?i)(?:\b(?:sha(?:1|256|512)|digest|commit|checksum|example[_-]?hash)\b|\buses\s*:)",
                     line,
                 )
                 if labelled_hash and re.fullmatch(r"[0-9a-fA-F]{32,128}", candidate):
@@ -154,7 +169,11 @@ def main() -> int:
             print(f"- {finding}")
         return 1
 
-    print(f"Public-safety scan passed: {len(files)} tracked files checked")
+    content_count = len(files) - int(any(path.relative_to(ROOT).as_posix() == SELF for path in files))
+    print(
+        "Public-safety scan passed: "
+        f"{content_count} tracked files content-scanned; detector source executed separately"
+    )
     return 0