Security gate for your build output. Find leaked credentials and exposed source maps in
dist/before you ship — not after someone else finds them.
Your SPA ships every byte of JavaScript to every visitor. Whatever secrets sit in your source end up in the bundle — a scan of 5 million apps found 42k+ leaked tokens. distguard is the pre-flight check that stops them at build time.
npx distguard ./dist # risk-ranked terminal report
npx distguard ./dist --json # machine-readable for CI
npx distguard ./dist --fail-on high # red-light the pipeline on high+ findings
26 rules across three severity tiers — full catalog with remediation guidance in RULES.md:
| tier | examples |
|---|---|
| critical | AWS / Alibaba Cloud access keys · Azure storage account keys · Stripe live secret keys · private key blocks · GitHub / npm / GitLab / GCP-OAuth tokens |
| high | Google / OpenAI / Anthropic API keys · Slack / Telegram / Discord tokens · SendGrid / Twilio / Shopify / DigitalOcean credentials · inline basic-auth URLs |
| medium / low | hardcoded JWTs · Hugging Face tokens · Firebase database URLs · internal network addresses · restorable & bare source maps |
Every finding is redacted, anchored to file:line:column with a masked code frame, and explained: why it's dangerous → how to fix it → authoritative reference.
- ** CI-first**: meaningful exit codes (
0clean ·1findings ≥ threshold ·2runtime error) and JSON output make it a drop-in pipeline gate - low noise by design: vendor documentation samples are whitelisted, formats strictly validated, duplicates collapsed per file
- zero-dependency mindset: a single tiny runtime dep (arg parser); a security tool should not widen your attack surface to audit you
- framework agnostic: scans whatever folder you point it at
| tool | lane | notes |
|---|---|---|
| gitleaks | git repositories (source) | complementary — run both |
| trufflehog | git history / many sources | same lane as gitleaks |
| mapxtractor | offensive recon (hunters) | extracts, doesn't gate builds |
| Jsmon | commercial SaaS monitoring | paid, closed |
| distguard | built artifacts, free, CI gate | this gap |
Drop a .distguardrc.json next to where you run it:
{
"allowlist": ["vendor/", "test/fixtures/"],
"ignoreRules": ["internal-network-url"]
}SRI integrity checks · security header audit · SARIF output for GitHub Code Scanning · CSP generation from build output.
pnpm install
pnpm test # vitest suite
pnpm lint # oxlint + oxfmt
pnpm rules:doc # regenerate RULES.md from rule metadata
pnpm build # tsdownFixture policy: credential values in tests are assembled at runtime from fragments so this repository never contains byte-level lookalike secrets.
MIT © lvyanyan