@royea/secret-sauce

Find the business logic you forgot to protect.

Scan any JavaScript/TypeScript codebase to identify exposed business logic — pricing formulas, scoring algorithms, AI prompts, game rules, rate limits — and get actionable migration guidance. Zero dependencies.

The Problem

Your SaaS pricing table is in utils/pricing.ts. Your AI system prompt is in lib/ai.ts. Your matching algorithm is in hooks/useScore.ts. All shipped to the browser. All visible in DevTools.

SecretSauce finds these patterns automatically, rates how unique they are (1-5 stars), and tells you exactly where to move them.

Install

npm install -g @royea/secret-sauce

Usage

# Scan a project
secret-sauce analyze ./src

# Output: findings grouped by protection level, with file paths and line numbers

Example Output

SECRET SAUCE — Business Logic Protection Report

SUMMARY
Total findings: 47    Needs server migration: 12

BY PROTECTION LEVEL
  [SERVER-ONLY]     3 findings   ← Move these NOW
  [SERVER-FETCH]    9 findings
  [CACHE+FETCH]    15 findings
  [DUAL]           14 findings
  [CLIENT-OK]       6 findings   ← These are fine

MIGRATION REQUIRED
  src/lib/ai.ts:45 [SERVER-ONLY] *****
  System prompt exposed in client bundle. Remove entirely; serve via authenticated API.

  src/utils/pricing.ts:12 [SERVER-FETCH] ****
  Pricing algorithm with weighted factors. Move to server endpoint, cache 1h.

  src/hooks/useScore.ts:78 [CACHE+FETCH] ***
  Custom scoring formula. Serve from API, encrypt cache, 24h TTL.

Protection Levels

| Level | Stars | Action | |-------|-------|--------| | CLIENT-OK | 1 | Safe on client. No action needed. | | DUAL | 2 | Keep on client, validate server-side too. | | CACHE+FETCH | 3 | Move to server. Cache locally (encrypted, 24h). | | SERVER-FETCH | 4 | Server API only. Re-fetch hourly. | | SERVER-ONLY | 5 | Remove from client entirely. Auth endpoints only. |

What It Detects

• SCORING — Point values, level thresholds, ranking formulas
• PRICING — Cost tables, discount logic, reward schedules
• ALGORITHMS — Matching, sorting, trust scoring, weighted formulas
• AI_PROMPTS — System prompts, model configs, prompt templates
• AUTH_LOGIC — Token handling, permission checks, session logic
• RATE_LIMITS — Throttling, daily caps, retry limits
• GAME_RULES — Win conditions, state machines, game config
• VALIDATION — Input constraints, regex patterns, allowed values

Programmatic API

import { scan, rate, protect, formatReport } from '@royea/secret-sauce';

const results = scan('./src');
const rated = rate(results);
const report = protect(rated, './src');
console.log(formatReport(report));

Why This Exists

Every code audit turns up the same thing: business logic shipped to the browser that shouldn't be. Manual review takes hours. SecretSauce does it in seconds.

No external dependencies. No API keys. Runs entirely on your machine.

License

MIT