Add ProdGuard to Static Code Analysis 🤖🤖🤖

[Felix0731]

Adding ProdGuard to Static Code Analysis.

Repo: https://github.com/Felix0731/prodguard — MIT, zero runtime dependencies, Node >= 18.
npm: https://www.npmjs.com/package/prodguard

Why it's a fit for this list

Most tools in this section look for insecure code being added. ProdGuard looks for a security control being removed — the diff where RLS gets turned off to make a query work, a paywall gate gets pinned to false for a demo, or email confirmation gets disabled to speed up testing. That failure mode has become common in agent-assisted codebases, and it doesn't trip a normal SAST rule because the resulting code isn't malformed, it's just unguarded.

Eighteen rules, ten rated critical: RLS disabled or never enabled, service-role key reachable from client code or behind a VITE_/NEXT_PUBLIC_ prefix, Stripe webhook handler with no constructEvent signature check, JWT decoded but never verified, Firebase rules open (including console test-mode), paywall/entitlement gate hardcoded, live secret or credential file committed, DELETE FROM/TRUNCATE with no WHERE, CORS wildcard with credentials.

npx prodguard check --demo   # runs all 18 against an in-memory broken app, touches nothing
npx prodguard check          # exit 1 on critical
npx prodguard init           # writes a config and a GitHub Action

Honest limits

It matches text, it does not parse your program, so an unusual spelling of the same bug can get past it — there's an allow-list for the reverse case. A clean run means these eighteen checks didn't fire, not that the app is secure.

Relevant to this list specifically: an audit before release found the tool printing the secrets it detected (redaction was wired into one rule of the twelve that existed then) and a ReDoS in one pattern that could hang CI for 159s. Both fixed in 0.5.0 with regression tests, redaction is now central in the rule runner so no rule can skip it. Flagging it here rather than leaving it for someone else to find.

Rules for over-broad GRANTs and duplicate permissive RLS policies were added in 0.7.0 after users reported them.