npm package: @royea/secret-sauce
Description: Scan JS/TS codebases to find exposed business logic. Rates uniqueness (1-5 stars), assigns protection levels, and tells you exactly what to move server-side.
Author: Roy Arguan
Latest version: 1.0.0

# @royea/secret-sauce

**Find the business logic you forgot to protect.**

Scan any JavaScript/TypeScript codebase to identify exposed business logic — pricing formulas, scoring algorithms, AI prompts, game rules, rate limits — and get actionable migration guidance. Zero dependencies.

## The Problem

Your SaaS pricing table is in `utils/pricing.ts`. Your AI system prompt is in `lib/ai.ts`. Your matching algorithm is in `hooks/useScore.ts`. All shipped to the browser. All visible in DevTools.

SecretSauce finds these patterns automatically, rates how unique they are (1-5 stars), and tells you exactly where to move them.

## Install

```bash
npm install -g @royea/secret-sauce
```

## Usage

```bash
# Scan a project
secret-sauce analyze ./src

# Output: findings grouped by protection level, with file paths and line numbers
```

### Example Output

```
SECRET SAUCE — Business Logic Protection Report

SUMMARY
Total findings: 47    Needs server migration: 12

BY PROTECTION LEVEL
  [SERVER-ONLY]     3 findings   ← Move these NOW
  [SERVER-FETCH]    9 findings
  [CACHE+FETCH]    15 findings
  [DUAL]           14 findings
  [CLIENT-OK]       6 findings   ← These are fine

MIGRATION REQUIRED
  src/lib/ai.ts:45 [SERVER-ONLY] *****
  System prompt exposed in client bundle. Remove entirely; serve via authenticated API.

  src/utils/pricing.ts:12 [SERVER-FETCH] ****
  Pricing algorithm with weighted factors. Move to server endpoint, cache 1h.

  src/hooks/useScore.ts:78 [CACHE+FETCH] ***
  Custom scoring formula. Serve from API, encrypt cache, 24h TTL.
```

## Protection Levels

| Level | Stars | Action |
|-------|-------|--------|
| CLIENT-OK | 1 | Safe on client. No action needed. |
| DUAL | 2 | Keep on client, validate server-side too. |
| CACHE+FETCH | 3 | Move to server. Cache locally (encrypted, 24h). |
| SERVER-FETCH | 4 | Server API only. Re-fetch hourly. |
| SERVER-ONLY | 5 | Remove from client entirely. Auth endpoints only. |

## What It Detects

- **SCORING** — Point values, level thresholds, ranking formulas
- **PRICING** — Cost tables, discount logic, reward schedules
- **ALGORITHMS** — Matching, sorting, trust scoring, weighted formulas
- **AI_PROMPTS** — System prompts, model configs, prompt templates
- **AUTH_LOGIC** — Token handling, permission checks, session logic
- **RATE_LIMITS** — Throttling, daily caps, retry limits
- **GAME_RULES** — Win conditions, state machines, game config
- **VALIDATION** — Input constraints, regex patterns, allowed values

## Programmatic API

```typescript
import { scan, rate, protect, formatReport } from '@royea/secret-sauce';

const results = scan('./src');
const rated = rate(results);
const report = protect(rated, './src');
console.log(formatReport(report));
```

## Why This Exists

Every code audit turns up the same thing: business logic shipped to the browser that shouldn't be. Manual review takes hours. SecretSauce does it in seconds.

No external dependencies. No API keys. Runs entirely on your machine.

## License

MIT