feat(core): add security posture scanner

Author: aidenybai

packages/core/src/check-security-posture.ts

@@ -210,6 +210,14 @@ export const DEAD_CODE_WORKER_TIMEOUT_MS = 120_000;
 // the child's heap so those projects complete instead of crashing.
 export const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 
+export const SECURITY_SCAN_MAX_FILES = 2500;
+
+export const SECURITY_SCAN_MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024;
+
+export const SECURITY_SCAN_MAX_BUNDLE_FILE_SIZE_BYTES = 8 * 1024 * 1024;
+
+export const SECURITY_SCAN_MAX_DIRECTORY_DEPTH = 8;
+
 // HACK: lookahead cap for JSX opener-span scanning; bounds worst-case
 // work on pathological files. Real openers stay well under this.
 export const JSX_OPENER_SCAN_MAX_LINES = 32;

packages/core/src/constants.ts

@@ -37,6 +37,7 @@ export * from "./check-expo-project.js";
 export * from "./check-pnpm-hardening.js";
 export * from "./check-react-native-project.js";
 export * from "./check-reduced-motion.js";
+export * from "./check-security-posture.js";
 export * from "./collect-ignore-patterns.js";
 export * from "./compute-diagnostic-delta.js";
 export * from "./constants.js";

packages/core/src/index.ts

@@ -17,6 +17,7 @@ import { checkExpoProject } from "./check-expo-project.js";
 import { checkPnpmHardening } from "./check-pnpm-hardening.js";
 import { checkReactNativeProject } from "./check-react-native-project.js";
 import { checkReducedMotion } from "./check-reduced-motion.js";
+import { checkSecurityPosture } from "./check-security-posture.js";
 import { DEFAULT_SHOW_WARNINGS } from "./constants.js";
 import { highlighter } from "./highlighter.js";
 import { computeJsxIncludePaths } from "./jsx-include-paths.js";
@@ -324,12 +325,12 @@ export const runInspect = <HooksR = never>(
         Stream.tap((diagnostic) => reporterService.emit(diagnostic)),
       );
 
-    // ── Phase: environment checks ──────────────────────────────────
     const environmentDiagnostics: ReadonlyArray<Diagnostic> = isDiffMode
       ? []
       : [
           ...checkReducedMotion(scanDirectory),
           ...checkPnpmHardening(scanDirectory),
+          ...checkSecurityPosture(scanDirectory),
           ...checkExpoProject(scanDirectory, project),
           ...checkReactNativeProject(scanDirectory, project),
         ];