v3.0 🚀

.deepsec/.gitignore

@@ -0,0 +1,9 @@
+node_modules/
+.env*.local
+
+# Scan output — regenerated by `deepsec scan` / `process`. INFO.md
+# and SETUP.md (manually edited) stay tracked.
+data/*/files/
+data/*/runs/
+data/*/reports/
+data/*/project.json

.deepsec/AGENTS.md

@@ -0,0 +1,23 @@
+# Agent setup
+
+This is a deepsec scanning workspace. Each registered project has its
+own setup prompt at `data/<id>/SETUP.md` — open the relevant one when
+asked to set a project up.
+
+## Common tasks
+
+- **Set up a project for scanning**: read `data/<id>/SETUP.md` and
+  follow it (read `node_modules/deepsec/SKILL.md`, then fill
+  `data/<id>/INFO.md` from the target codebase).
+- **Add a new project**: run `deepsec init-project <root>` — it
+  scaffolds `data/<id>/` and prints/writes the setup prompt for the
+  new project.
+- **Write a custom matcher** (only after a real true-positive shows you
+  a pattern worth keeping): read
+  `node_modules/deepsec/dist/docs/writing-matchers.md`.
+
+## Reference
+
+The deepsec skill is at `node_modules/deepsec/SKILL.md` (after
+`pnpm install`). The full docs ship at
+`node_modules/deepsec/dist/docs/`.

.deepsec/README.md

@@ -0,0 +1,74 @@
+# deepsec
+
+This directory holds the [deepsec](https://www.npmjs.com/package/deepsec)
+config for the parent repo. Checked into git so teammates inherit
+project context (auth shape, threat model, custom matchers); generated
+scan output is gitignored.
+
+Currently configured project: `parsertime` (target: `..`).
+
+## Setup
+
+1. `pnpm install` — installs deepsec.
+2. Add an AI Gateway / Anthropic / OpenAI token to `.env.local`. If
+   you already have `claude` or `codex` CLI logged in on this
+   machine, you can skip the token for non-sandbox runs (`process` /
+   `revalidate` / `triage`); deepsec auto-detects and reuses the
+   subscription. See
+   `node_modules/deepsec/dist/docs/vercel-setup.md` after install.
+3. Open the parent repo in your coding agent (Claude Code, Cursor, …)
+   and have it follow `data/parsertime/SETUP.md` to fill in
+   `data/parsertime/INFO.md`.
+
+## Daily commands
+
+```bash
+pnpm deepsec scan
+pnpm deepsec process     --concurrency 5
+pnpm deepsec revalidate  --concurrency 5                  # cuts FP rate
+pnpm deepsec export      --format md-dir --out ./findings
+```
+
+`--project-id` is auto-resolved while there's only one project in
+`deepsec.config.ts`. Once you've added a second project, pass
+`--project-id parsertime` (or whichever id you want) explicitly.
+
+`scan` is free (regex only). `process` is the AI stage (≈$0.30/file
+on Opus by default). Run state goes to `data/parsertime/`.
+
+## Adding another project
+
+To scan another codebase from this same `.deepsec/`:
+
+```bash
+pnpm deepsec init-project ../some-other-package   # path relative to .deepsec/
+```
+
+Appends an entry to `deepsec.config.ts` and writes
+`data/<id>/{INFO.md,SETUP.md,project.json}`. Open the new SETUP.md
+in your agent to fill in INFO.md.
+
+## Layout
+
+```
+deepsec.config.ts        Project list (one entry per scanned repo)
+data/parsertime/
+  INFO.md                Repo context — checked into git, hand-curated
+  SETUP.md               Agent setup prompt — checked in, deletable
+  project.json           Generated (gitignored)
+  files/                 One JSON per scanned source file (gitignored)
+  runs/                  Run metadata (gitignored)
+  reports/               Generated markdown reports (gitignored)
+AGENTS.md                Pointer for coding agents
+.env.local               Tokens (gitignored)
+```
+
+## Docs
+
+After `pnpm install`:
+
+- Skill: `node_modules/deepsec/SKILL.md`
+- Full docs: `node_modules/deepsec/dist/docs/{getting-started,configuration,models,writing-matchers,plugins,architecture,data-layout,vercel-setup,faq}.md`
+
+Or browse on
+[GitHub](https://github.com/vercel/deepsec/tree/main/docs).

.deepsec/data/parsertime/INFO.md

@@ -0,0 +1,74 @@
+# parsertime
+
+## What this codebase does
+
+Parsertime is a Next.js 16 App Router app for collegiate Overwatch teams to
+track scrims, maps, player stats, tournaments, scouting, matchmaker requests,
+availability, notifications, and AI chat insights. It is TypeScript/React with
+Prisma on Postgres, NextAuth, Vercel KV/Blob/Edge Config, Stripe billing and AI
+credits, Axiom telemetry, Discord bot integrations, FACEIT ingest, and server
+route handlers under `src/app/api`.
+
+## Auth shape
+
+- NextAuth is configured in `src/lib/auth.ts`; route handlers and server pages
+  normally call `auth()` and then resolve the app user through `UserService`
+  with `AppRuntime.runPromise`.
+- Role and plan checks use `$Enums.UserRole.ADMIN` / `UserRole.ADMIN` and the
+  `Permission` / `check` helpers for feature gates such as `create-team`,
+  `create-scrim`, and stats timeframe access.
+- Team/scrim/map access is project-specific: use `isAuthedToViewTeam`,
+  `isTeamOwnerOrManager`, `isAuthedToViewScrim`, `isAuthedToViewMap`, or
+  explicit owner/manager/member checks against Prisma.
+- Machine endpoints use non-session auth: `authenticateBotSecret`,
+  `resolveDiscordUser`, `verifyTeamAccess`, local cron secret checks, Stripe
+  webhook signatures, and FACEIT HMAC signatures.
+- `guestMode` is an intentional sharing path for scrims and some `/team`
+  layouts; it should not imply general team membership or write access.
+
+## Threat model
+
+Highest impact is cross-team or public access to private scrim data, map stats,
+player availability, reports, chat history, tournament admin flows, or team
+management actions. Next are privilege escalation to admin/manager capabilities,
+abuse of Stripe/AI-credit flows, unauthorized Blob/R2 uploads, bot/internal
+endpoint abuse via shared secrets, and forged FACEIT/Stripe/cron callbacks.
+Public scouting, leaderboard, health, metadata, and guest availability surfaces
+exist, but should return only deliberately public or constrained data.
+
+## Project-specific patterns to flag
+
+- Any mutating `src/app/api/**/route.ts` that touches Prisma/services without
+  `auth()`, a named auth helper, `authenticateBotSecret`, a cron secret, or a
+  verified external webhook signature.
+- Team, scrim, map, tournament, comparison, notification, or credit handlers
+  that trust a `teamId`, `scrimId`, `mapId`, `userId`, `conversationId`, or
+  `scheduleId` from params/body without checking membership, owner/manager
+  status, admin role, or the matching session user.
+- Admin-only paths under `src/app/settings/admin` and `src/app/api/admin` that
+  do not require `UserRole.ADMIN` before search, audit-log, map-calibration, or
+  impersonation behavior.
+- Upload/presign flows using `handleUpload`, Vercel Blob, R2, avatar/banner
+  keys, or map-calibration files that authenticate a user but do not authorize
+  ownership/manager/admin access for the target team/user/map.
+- DEV_TOKEN/testing-email fallbacks, cron-like destructive routes, bot routes,
+  and webhook endpoints that are reachable in production without fail-closed
+  secret/signature validation.
+
+## Known false-positives
+
+- `src/app/api/auth/[...nextauth]/route.ts` is intentionally public because
+  NextAuth owns the callback/session flow; evaluate `src/lib/auth.ts` instead.
+- `src/app/api/stripe/webhooks/route.ts` and
+  `src/app/api/faceit/webhook/route.ts` are sessionless by design; the intended
+  auth is Stripe signature verification or FACEIT HMAC verification.
+- `src/app/api/bot/**` and `src/app/api/internal/availability/**` are machine
+  endpoints; `authenticateBotSecret` plus Discord user/team checks are the
+  expected auth shape.
+- `src/app/api/availability/[scheduleId]/responses/**` allows unauthenticated
+  availability submissions for shared schedules, with optional password/name
+  ownership semantics.
+- Public metadata and read surfaces include `robots.ts`, `sitemap.ts`,
+  `manifest.ts`, `.well-known/**`, `api/health`, `api/og`, `api/leaderboard/**`,
+  and public scouting/profile/stat pages; do not require `auth()` solely for
+  those routes.

.deepsec/data/parsertime/SETUP.md

@@ -0,0 +1,55 @@
+# Agent setup for `parsertime`
+
+This is a deepsec scanning workspace. Project `parsertime` was just registered
+(target: `..`). Setup is incomplete — `data/parsertime/INFO.md`
+still has placeholder sections.
+
+## What to do
+
+1. **Read the deepsec skill.** After `pnpm install`, the file is at
+   `node_modules/deepsec/SKILL.md`. It maps every doc topic to a file
+   under `node_modules/deepsec/dist/docs/`. Read `getting-started.md`,
+   `configuration.md`, and `writing-matchers.md` (skim the rest).
+
+2. **Fill in `data/parsertime/INFO.md`.** It's auto-injected into the AI
+   prompt for every batch — keep it short and selective.
+
+   **Length budget: 50–100 lines total.** Verbose context dilutes
+   signal in the scanner's prompt window. The goal is "what would a
+   reviewer miss if they didn't read this?", not exhaustive enumeration.
+
+   **Per-section rubric**:
+   - Pick 3–5 representative items per section. **Don't list every
+     file, helper, or callsite** — pick the patterns.
+   - Name primitives by their public name (e.g. `withAuthentication`,
+     `auth.can()`, `isTeamAdmin`). **No line numbers.** Don't enumerate
+     more than 5 paths in any list.
+   - Skip generic CWE categories — built-in matchers already cover
+     "SSRF", "SQL injection", "XSS". Cover what's _project-specific_:
+     internal auth helpers, custom middleware names, fork-specific
+     stubs, intended-public endpoints.
+   - One short paragraph or 3–5 short bullets per section. Not both.
+
+   Source material (read in this order, stop when you have enough):
+   - `../README.md`
+   - any `AGENTS.md` / `CLAUDE.md` in `..`
+   - `../package.json` (or `go.mod`, `pyproject.toml`, etc.)
+   - 5–10 representative code files (entry points, auth helpers) — not
+     a full code tour.
+
+3. **(Optional) Add custom matchers** for repo-specific patterns the
+   built-in matchers won't catch. Read
+   `node_modules/deepsec/dist/docs/writing-matchers.md` first; the
+   workflow there starts from a confirmed finding and grows the matcher
+   from it. Don't add matchers speculatively — wait for a real TP.
+
+## When you're done
+
+The user will run:
+
+```bash
+pnpm deepsec scan    --project-id parsertime
+pnpm deepsec process --project-id parsertime
+```
+
+You can delete this file once setup is complete.

.deepsec/data/parsertime/tech.json

@@ -0,0 +1,6 @@
+{
+  "tags": ["github-actions", "nextjs", "node", "prisma", "react"],
+  "sentinels": ["next.config.ts", "package.json"],
+  "detectedAt": "2026-05-27T15:25:18.654Z",
+  "rootPath": "/Users/lucasdoell/code/parsertime"
+}

.deepsec/deepsec.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "deepsec/config";
+
+export default defineConfig({
+  projects: [
+    { id: "parsertime", root: ".." },
+    // <deepsec:projects-insert-above>
+  ],
+});

.deepsec/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "deepsec-workspace",
+  "version": "0.1.0",
+  "private": true,
+  "description": "deepsec scanning workspace",
+  "type": "module",
+  "workspaces": [],
+  "packageManager": "pnpm@9.15.4",
+  "dependencies": {
+    "deepsec": "^2.0.10"
+  }
+}