arnav-audit

Autonomous Internal Security, Memory Leakage & Invisible UI/UX Interface Auditor

arnav-audit is a high-speed, zero-dependency command-line interface and package designed to audit local codebases for critical security credential leaks, React/JS memory leaks, and invisible frontend UI/UX interface defects.

🚀 Quickstart: Installation to Final Execution Pipeline

Follow this 4-step workflow to install, verify, and run audits across your projects:

Step 1: Install Globally

Choose any method to install or run the CLI:

# Method A: Install globally via npm
npm install -g arnav-audit

# Method B: Direct install from GitHub (works for anyone without npm login)
npm install -g github:arnnnnaaavvvvv/MEJOR

# Method C: If working inside this cloned repository
npm install -g . --force

(Alternatively, run instantly with zero installation: npx github:arnnnnaaavvvvv/MEJOR . or npx arnav-audit .)

Step 2: Verify the CLI Binary

Confirm that arnav-audit is globally registered in your terminal:

arnav-audit --version
# Output: arnav-audit v1.0.4

arnav-audit --help
# Displays available flags, rules, and example commands

Step 3: Run the Codebase Audit

Navigate to any project directory and run the audit:

# Audit the current project directory
arnav-audit .

# Audit a specific subdirectory or file
arnav-audit ./src

# List every single file inspected
arnav-audit . --files

# Scan exclusively for credentials & secrets
arnav-audit . --security-only

# Scan exclusively for memory & event listener leaks
arnav-audit . --leakage-only

Step 4: Generate Automated AI Fix Prompts (Final Step)

Generate ready-to-paste prompts formatted specifically for Cursor, Claude Code, or Antigravity:

arnav-audit . --prompts

Or pipe machine-readable JSON into CI/CD quality gates:

arnav-audit . --json > audit-report.json

🛡️ Detection Capabilities

1. Internal Security & Credential Leakage

• Hardcoded Secret Keys: Scans for exposed AWS access keys (AKIA...), OpenAI API keys (sk-...), GitHub personal access tokens (ghp_...), Stripe live secret keys (sk_live_...), and private key blocks (-----BEGIN RSA PRIVATE KEY-----).
• Exposed Configuration: Detects committed .env and .env.local files in git trees missing .gitignore coverage.
• XSS & Code Injection Vectors: Unsanitized dangerouslySetInnerHTML, eval(), and new Function() invocations.
• Backend Injection Patterns: Flags raw string interpolations in SQL queries and unsafe subprocess(..., shell=True) execution.

2. Major & Minor Memory & Resource Leakage

• Hook Listener Leaks: addEventListener inside React useEffect hooks missing clean-up removeEventListener callbacks.
• Timer Leaks: setInterval and setTimeout initialized without unmount clearInterval teardowns.
• Global Scope Pollution: Accidental state assignments to the global window object preventing garbage collection.
• Residual Logging: Production console.log statements leaking internal state and data payloads.

3. Invisible Interface & UI/UX Traps

• iOS Safari Auto-Zoom Trap (UX-IOS-AUTOZOOM): Form inputs with font-size < 16px triggering mandatory mobile viewport zooming on focus.
• 300ms Touch Latency (UX-TAP-LATENCY): Interactive elements missing touch-action: manipulation.
• Obliterated Focus Rings (A11Y-FOCUS-OBLITERATED): outline: none removing keyboard accessibility indicators (WCAG 2.4.7).
• Flexbox Icon Collapse (UI-FLEX-SQUISH): Distorted SVG icons inside flex containers missing flex-shrink: 0.
• Viewport Bleed (UX-VIEWPORT-BLEED): Horizontal layout thrashing from 100vw scrollbar leaks.
• Unannounced Icon Buttons (A11Y-ICON-UNANNOUNCED): Buttons with only icons missing aria-label.

🛠️ CLI Reference & Flags

| Flag | Shorthand | Description | |---|---|---| | [directory] | — | Target path to audit (defaults to .) | | --files | --list | List every scanned file with inspection status | | --verbose | — | Display detailed scan logs and file-by-file verification | | --prompts | --fix | Pre-compile copy-paste AI fix prompts for Cursor / Claude Code | | --security-only| --security | Scan exclusively for credentials, secrets & injection vectors | | --leakage-only | --leakage | Scan exclusively for event listeners, timers & window leaks | | --json | — | Output raw machine-readable JSON for CI/CD pipelines | | --version | -v | Display CLI version | | --help | -h | Display help screen |

🚀 GitHub Actions CI/CD Quality Gate

Add arnav-audit to your .github/workflows/audit.yml to automatically prevent credential leakage or broken mobile viewports from merging into production:

name: Codebase Quality & Security Gate
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Run arnav-audit
        run: npx arnav-audit .

🧪 Local Development & Testing

# Run unit tests
npm test

# Run audit locally
node bin/cli.js .

# Check help output
node bin/cli.js --help

📄 License

MIT © Arnav