scryer 0.2.0 → 1.0.0

data/lib/scryer/rules/cors_misconfiguration_rule.rb

@@ -0,0 +1,69 @@
+module Scryer
+  module Rules
+    # Flags the well-known Rack::Cors antipattern: a wildcard origin
+    # (`origins '*'`) combined with `credentials: true` on a `resource` call.
+    # Per the CORS spec, browsers reject this combination in practice, but
+    # it's still the standard misconfiguration flagged in security reviews —
+    # either half alone (wildcard origin with no credentials, or credentials
+    # with a real origin allowlist) is fine.
+    #
+    # `config/initializers/cors.rb` is small and self-contained, so this
+    # checks "does `origins(...)` with a literal `'*'` appear anywhere in the
+    # file AND does a `resource` call with `credentials: true` appear
+    # anywhere in the file" rather than requiring both inside the exact same
+    # `allow do ... end` block — the same file-wide-evidence looseness
+    # IdorRule uses for its class-wide authorization check.
+    class CorsMisconfigurationRule < Rule
+      self.rule_id = "cors_misconfiguration"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "CORS wildcard origin combined with credentials"
+
+      def scan
+        findings = []
+        return findings unless wildcard_origin_anywhere?(sexp)
+
+        each_credentialed_resource(sexp).each do |node|
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "This file allows a wildcard origin (`origins '*'`) somewhere and this " \
+                      "`resource` call sets `credentials: true` — browsers won't honor that " \
+                      "combination for actual credentialed requests, and Rack::Cors handling it " \
+                      "inconsistently is the standard CORS misconfiguration flagged in reviews. " \
+                      "Either restrict origins to a real allowlist, or drop `credentials: true`.",
+            suggested_fix: "Replace the wildcard with an explicit origin allowlist wherever " \
+                            "`credentials: true` is set: `origins 'https://app.example.com'` " \
+                            "instead of `origins '*'` — a wildcard origin should only be paired " \
+                            "with `credentials: false` (the default)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def wildcard_origin_anywhere?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          next false unless Ast.call_name(inner)&.last == "origins"
+
+          Ast.call_arguments(n).any? { |a| Ast.plain_string_value(a) == "*" }
+        end
+      end
+
+      def each_credentialed_resource(node)
+        Ast.each_node(node).select do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          next false unless Ast.call_name(inner)&.last == "resource"
+
+          Ast.true_literal?(Ast.keyword_arg(Ast.call_arguments(n), "credentials"))
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/force_ssl_rule.rb

@@ -0,0 +1,45 @@
+module Scryer
+  module Rules
+    # Flags `config.force_ssl = false` — an explicit opt-out of Rails'
+    # built-in HTTPS enforcement (redirects, HSTS, secure cookie flag).
+    # Absence of `config.force_ssl = true` isn't flagged — that would require
+    # confirming no environment file sets it anywhere, which needs whole-app
+    # context this per-file rule doesn't have. Only the explicit opt-out is a
+    # reliable, low-noise signal on its own.
+    class ForceSslRule < Rule
+      self.rule_id = "force_ssl_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "HTTPS enforcement explicitly disabled"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "force_ssl"
+
+          value = node[2]
+          next unless Ast.false_literal?(value)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`config.force_ssl = false` explicitly disables Rails' HTTPS enforcement " \
+                      "(redirects, HSTS, and the secure flag on cookies) — traffic can be served " \
+                      "and session cookies transmitted over plain HTTP.",
+            suggested_fix: "Set `config.force_ssl = true` (the default for a new Rails production " \
+                            "environment) unless this app is deliberately terminating TLS " \
+                            "elsewhere (a load balancer already enforcing HTTPS) — and if so, " \
+                            "leave a comment explaining that so this doesn't look like an oversight."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/graphql_missing_query_limits_rule.rb

@@ -0,0 +1,75 @@
+module Scryer
+  module Rules
+    # Flags a `class X < GraphQL::Schema` (or a class whose superclass
+    # constant path text is exactly `GraphQL::Schema`) whose body calls
+    # neither `max_depth` nor `max_complexity` anywhere — without at least
+    # one of those, a client can send an arbitrarily deep/expensive query
+    # and the server will try to resolve all of it, a common
+    # denial-of-service vector for GraphQL APIs. Both missing is flagged as
+    # a single finding per class (not one per missing directive), the same
+    # "did the class do the safe thing at all" pattern as
+    # ActiveStorageMissingContentTypeValidationRule/IdorRule.
+    class GraphqlMissingQueryLimitsRule < Rule
+      self.rule_id = "graphql_missing_query_limits"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "GraphQL schema without query depth/complexity limits"
+
+      LIMIT_METHODS = %w[max_depth max_complexity].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          superclass = superclass_name(node[2])
+          next unless superclass == "GraphQL::Schema"
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| LIMIT_METHODS.include?(name) }
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{class_name}` extends `GraphQL::Schema` but calls neither `max_depth` nor " \
+                      "`max_complexity` — without either limit, a client can send an arbitrarily " \
+                      "deep or expensive query and the server will attempt to resolve all of it, a " \
+                      "common denial-of-service vector for GraphQL APIs.",
+            suggested_fix: "Add at least one limit to the schema, e.g. `max_depth 15` and/or " \
+                            "`max_complexity 300` (tune both to what this API's real queries need)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last
+        end
+      end
+
+      # Textual name of a (possibly namespaced) constant superclass node —
+      # "GraphQL::Schema" for the `[:const_path_ref, ...]` chain a `< X::Y`
+      # superclass parses into, or the bare name for an unnamespaced
+      # superclass (`[:var_ref, [:@const, ...]]`). nil if there's no
+      # superclass (`node[2]` is nil for a plain `class X` with no `< ...`).
+      def superclass_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = superclass_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_basic_auth_rule.rb

@@ -0,0 +1,48 @@
+module Scryer
+  module Rules
+    # Flags `http_basic_authenticate_with` calls whose `password:` (or
+    # `name:`) keyword argument is a plain string literal — a shape
+    # `HardcodedSecretRule` doesn't cover (that rule only looks at
+    # `x = "literal"` assignment targets, not keyword-argument values in a
+    # method call).
+    class HardcodedBasicAuthRule < Rule
+      self.rule_id = "hardcoded_basic_auth"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded HTTP Basic Auth credential"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?password|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && name_pair[1] == "http_basic_authenticate_with"
+
+          args = Ast.call_arguments(node)
+          password_value = Ast.plain_string_value(Ast.keyword_arg(args, "password"))
+          next unless password_value && !password_value.strip.empty? && !PLACEHOLDER_VALUES.match?(password_value.strip)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`http_basic_authenticate_with` is called with a literal `password:` — " \
+                      "anyone with read access to this source (including git history) has the " \
+                      "credential, and it can't be rotated without a code change and deploy.",
+            suggested_fix: "Move the credential out of source: " \
+                            "`http_basic_authenticate_with name: ENV.fetch(\"BASIC_AUTH_USER\"), " \
+                            "password: ENV.fetch(\"BASIC_AUTH_PASSWORD\")` (or Rails encrypted " \
+                            "credentials), and rotate this password since it's likely already " \
+                            "exposed in git history."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_secret_key_base_rule.rb

@@ -0,0 +1,55 @@
+module Scryer
+  module Rules
+    # Flags `config.secret_key_base = "literal"` (or
+    # `Rails.application.config.secret_key_base = "literal"`) — a plain
+    # string literal assigned to `secret_key_base` via a `.field=` target.
+    #
+    # HardcodedSecretRule doesn't catch this shape: its `target_name` walks
+    # the assignment target depth-first and returns the *first* identifier
+    # it finds, which for a `.field=` target with a receiver is the
+    # receiver's own name (`config`) rather than the attribute being
+    # assigned (`secret_key_base`) — so `config.secret_key_base = "..."`
+    # never matches its NAME_PATTERN, even though the value is exactly the
+    # kind of credential that rule exists to catch. Bare assignment
+    # (`secret_key_base = "..."` with no receiver) IS already caught by
+    # HardcodedSecretRule, since there the identifier IS the target name —
+    # this rule only covers the receiver'd shape it misses.
+    class HardcodedSecretKeyBaseRule < Rule
+      self.rule_id = "hardcoded_secret_key_base"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded secret_key_base"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "secret_key_base"
+
+          value = Ast.plain_string_value(node[2])
+          next unless value && !value.strip.empty? && !PLACEHOLDER_VALUES.match?(value.strip)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`secret_key_base` is assigned a literal string — this key signs/encrypts " \
+                      "Rails sessions and other secrets; anyone with read access to this source " \
+                      "(including git history) can forge session cookies and other signed data.",
+            suggested_fix: "Use `Rails.application.credentials.secret_key_base` (the Rails default, " \
+                            "set via `bin/rails credentials:edit`) or `ENV.fetch(\"SECRET_KEY_BASE\")` " \
+                            "instead, and rotate this key since it's likely already exposed in git " \
+                            "history."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/idor_rule.rb

@@ -0,0 +1,111 @@
+module Scryer
+  module Rules
+    # Flags `Model.find(params[...])` / `Model.find_by(...params...)` inside
+    # a controller where the receiver is a bare, unnamespaced constant (not
+    # scoped through e.g. `current_user.things.find(...)`) and no
+    # authorization call (`authorize`, `authorize!`, `policy_scope`, `can?`,
+    # `cannot?` — the common Pundit/CanCanCan method names) appears anywhere
+    # else in the same controller class.
+    #
+    # This is the least precise rule in the gem, by nature of the problem:
+    # whether a given `find` is actually scoped to the current user is a
+    # question about the whole app's authorization model, not something
+    # visible from one file's AST. Expect real false positives — e.g. an
+    # admin-only controller already gated by a class-level `before_action`,
+    # or a genuinely global/unowned model (`Country.find(params[:id])`).
+    # Treat every finding as "worth a second look," not a confirmed bug —
+    # same spirit as CsrfProtectionRule's class-wide safeguard check, applied
+    # to a harder problem.
+    class IdorRule < Rule
+      self.rule_id = "idor"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Possible insecure direct object reference (IDOR)"
+
+      FINDER_METHODS = %w[find find_by find_by!].freeze
+
+      # Same reasoning as MassAssignmentRule::NON_MODEL_RECEIVERS: common
+      # stdlib/gem constants with their own `.find`-style methods that have
+      # nothing to do with an ActiveRecord model lookup.
+      NON_MODEL_RECEIVERS = %w[
+        Struct OpenStruct Data Class Module BCrypt OpenSSL Net URI Digest
+        JSON YAML Marshal String Array Hash Integer Float Symbol Comparable
+        Enumerable File Dir
+      ].freeze
+
+      AUTHORIZATION_METHODS = %w[authorize authorize! policy_scope can? cannot?].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          next unless class_name.to_s.end_with?("Controller")
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| AUTHORIZATION_METHODS.include?(name) }
+
+          each_unscoped_find(body).each do |find_node, method_name|
+            line = Ast.line_of(find_node)
+            findings << finding(
+              line: line,
+              message: "`#{method_name}` looks up a record directly from `params`, and " \
+                        "`#{class_name}` has no visible authorization check (no `authorize`, " \
+                        "`policy_scope`, or `can?`/`cannot?` anywhere in it) — if this record " \
+                        "belongs to a specific user/account, another user may be able to view or " \
+                        "modify it just by changing the id in the request.",
+              suggested_fix: "Scope the lookup to the current actor instead of the bare model, " \
+                              "e.g. `current_user.things.#{method_name}(params[:id])`, or add an " \
+                              "explicit authorization check (`authorize @thing` for Pundit, " \
+                              "`authorize! :show, @thing` for CanCanCan) before using the record."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(node)
+        Ast.each_node(node).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last
+        end
+      end
+
+      def each_unscoped_find(body)
+        Ast.each_node(body).filter_map do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless FINDER_METHODS.include?(method_name)
+          next unless likely_model_receiver?(receiver)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| Ast.references_params?(a) }
+
+          [node, method_name]
+        end
+      end
+
+      def likely_model_receiver?(receiver)
+        return false if receiver.nil? # bare find(...) inside the model itself, not a controller lookup
+        return false unless Ast.tagged?(receiver, :var_ref)
+
+        const_node = receiver[1]
+        return false unless const_node.is_a?(Array) && const_node[0] == :@const
+
+        !NON_MODEL_RECEIVERS.include?(const_node[1])
+      end
+    end
+  end
+end

data/lib/scryer/rules/insecure_cookie_serializer_rule.rb

@@ -0,0 +1,44 @@
+module Scryer
+  module Rules
+    # Flags `config.action_dispatch.cookies_serializer = :marshal`. Rails
+    # defaults to `:json` since Rails 4.1 specifically because deserializing
+    # a `Marshal`-encoded cookie can be turned into remote code execution if
+    # the cookie's secret is ever compromised (the same class of bug
+    # `UnsafeDeserializationRule` flags for `Marshal.load` directly) — only
+    # an explicit opt back into `:marshal` is flagged, never the (safe)
+    # default of not setting this at all.
+    class InsecureCookieSerializerRule < Rule
+      self.rule_id = "insecure_cookie_serializer"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Marshal cookie serializer enabled"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "cookies_serializer"
+          next unless Ast.literal_text(node[2]) == "marshal"
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`cookies_serializer = :marshal` deserializes every cookie with " \
+                      "`Marshal.load` — if the app's `secret_key_base` is ever leaked (or brute " \
+                      "forced), a forged cookie deserialized this way can lead to remote code " \
+                      "execution, not just a spoofed session.",
+            suggested_fix: "Use the default `:json` serializer instead (remove this line, or set " \
+                            "`config.action_dispatch.cookies_serializer = :json` explicitly) — it " \
+                            "can only produce plain data structures, never arbitrary objects."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/job_raw_params_rule.rb

@@ -0,0 +1,98 @@
+module Scryer
+  module Rules
+    # Flags `SomeJob.perform_async(...)` / `.perform_later(...)` /
+    # `.perform_now(...)` (or the bare form inside the job's own class) where
+    # an argument references `params` more broadly than a single-key
+    # subscript — see raw_params_reference? below for exactly what's exempt
+    # (`params[:id]` and friends) versus what isn't.
+    #
+    # Sidekiq stores job arguments in Redis in plaintext and displays them in
+    # its web UI; both Sidekiq and ActiveJob log job arguments by default.
+    # Passing a raw `params` hash risks leaking whatever it contains —
+    # passwords, tokens, full user-submitted fields — into logs, Redis, and
+    # the Sidekiq UI, instead of passing just the specific id/value the job
+    # actually needs. This is a distinct, well-documented Sidekiq/ActiveJob
+    # concern from mass assignment (which is about writing untrusted params
+    # to a model, not about where params end up once queued).
+    class JobRawParamsRule < Rule
+      self.rule_id = "job_raw_params"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Raw params passed to a background job"
+
+      PERFORM_METHODS = %w[perform_async perform_later perform_now].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          _receiver, method_name = receiver_and_name
+          next unless PERFORM_METHODS.include?(method_name)
+
+          args = Ast.call_arguments(node)
+          next unless args.any? { |a| raw_params_reference?(a) }
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{method_name}` is called with an argument that references `params` — " \
+                      "Sidekiq stores job arguments in Redis in plaintext (visible in its web UI), " \
+                      "and both Sidekiq and ActiveJob log job arguments by default, so anything in " \
+                      "the raw params hash (passwords, tokens, other sensitive fields) can end up " \
+                      "somewhere it wasn't meant to be readable.",
+            suggested_fix: "Extract only the specific id/value(s) the job actually needs into " \
+                            "local variables before enqueuing (e.g. `id = params[:id]; " \
+                            "#{method_name}(id)`), instead of passing `params` (or a subscript of " \
+                            "it) straight through, and have the job re-fetch/re-derive anything " \
+                            "else it needs from that id."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      # True if `node`'s subtree references `params` in a way broader than a
+      # single-key subscript (`params[:id]`) — a bare `params` value, or
+      # `params` as the receiver of anything other than `[]` (`.to_json`,
+      # `.permit`, `.to_h`, `.dig`, ...). `params[:id]` (and chained scalar
+      # coercion on the result, like `params[:id].to_i`) is the extremely
+      # common, safe idiom of pulling one field out — flagging every such
+      # call would make this rule useless noise. Anything else risks the
+      # raw/broad params data actually reaching Sidekiq's log/Redis/UI.
+      def raw_params_reference?(node)
+        found = false
+
+        walk = lambda do |n|
+          next if found || !n.is_a?(Array)
+
+          if Ast.tagged?(n, :aref) && bare_params?(n[1])
+            walk.call(n[2]) if n[2].is_a?(Array)
+            next
+          end
+
+          if bare_params?(n)
+            found = true
+            next
+          end
+
+          n.each { |c| walk.call(c) if c.is_a?(Array) }
+        end
+
+        walk.call(node)
+        found
+      end
+
+      def bare_params?(node)
+        Ast.tagged?(node, :vcall, :var_ref, :fcall) && Ast.ident_text(node[1]) == "params"
+      end
+    end
+  end
+end

data/lib/scryer/rules/jwt_insecure_rule.rb

@@ -0,0 +1,120 @@
+module Scryer
+  module Rules
+    # Flags insecure usage of the `jwt` gem's `JWT.decode`/`JWT.encode`:
+    #   - `JWT.decode(token, secret, false, ...)` — the third positional arg
+    #     literal `false` disables signature verification entirely, so any
+    #     caller can forge a token that decodes successfully.
+    #   - `algorithm: 'none'` / `'alg' => 'none'` — the "none" algorithm
+    #     means the token isn't signed at all.
+    #   - A plain string literal passed directly as the secret/key argument
+    #     — distinct from HardcodedSecretRule, which only matches
+    #     `x = "literal"` assignment targets, not a literal inline in a call
+    #     argument.
+    class JwtInsecureRule < Rule
+      self.rule_id = "jwt_insecure_usage"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Insecure JWT.decode/JWT.encode usage"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?(secret|key)|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          receiver_and_name = Ast.call_name(inner)
+          next unless receiver_and_name
+
+          receiver, method_name = receiver_and_name
+          next unless const_receiver_name(receiver) == "JWT" && %w[decode encode].include?(method_name)
+
+          args = Ast.call_arguments(node)
+          line = Ast.line_of(node)
+
+          findings << verify_bypass_finding(line) if method_name == "decode" && Ast.false_literal?(args[2])
+          findings << algorithm_none_finding(method_name, line) if algorithm_none?(node)
+          findings.concat(inline_secret_finding(method_name, args, line))
+        end
+
+        findings
+      end
+
+      private
+
+      def verify_bypass_finding(line)
+        finding(
+          line: line,
+          message: "`JWT.decode` is called with `false` for `verify` — signature verification is " \
+                    "disabled entirely, so any caller can hand this code a forged token with " \
+                    "arbitrary claims and it will be accepted as valid.",
+          suggested_fix: "Pass `true` for `verify` and supply the correct `algorithm:` option, e.g. " \
+                          "`JWT.decode(token, secret, true, algorithm: 'HS256')`."
+        )
+      end
+
+      def algorithm_none?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :assoc_new)
+
+          key = assoc_key_text(n[1])
+          next false unless key && %w[algorithm alg].include?(key.downcase)
+
+          value = assoc_value_text(n[2])
+          value&.downcase == "none"
+        end
+      end
+
+      def algorithm_none_finding(method_name, line)
+        finding(
+          line: line,
+          message: "`JWT.#{method_name}` is called with `algorithm: 'none'` — the \"none\" " \
+                    "algorithm means the token carries no signature at all, so its claims can be " \
+                    "freely modified/forged by anyone.",
+          suggested_fix: "Use a real signing algorithm (e.g. `algorithm: 'HS256'` or `'RS256'`) and " \
+                          "never accept `'none'` from user/client input when choosing it."
+        )
+      end
+
+      def inline_secret_finding(method_name, args, line)
+        secret_arg = args[1]
+        secret = secret_arg && Ast.plain_string_value(secret_arg)
+        return [] unless secret && !secret.strip.empty? && !PLACEHOLDER_VALUES.match?(secret.strip)
+
+        [
+          finding(
+            line: line,
+            message: "`JWT.#{method_name}` is called with a literal string as the signing " \
+                      "secret/key — anyone with read access to this source (including git " \
+                      "history) can forge or verify tokens with it.",
+            suggested_fix: "Move the secret out of source (`ENV.fetch(\"JWT_SECRET\")` or Rails " \
+                            "encrypted credentials) and rotate this value since it's likely " \
+                            "already exposed in git history."
+          )
+        ]
+      end
+
+      def assoc_key_text(key_node)
+        return key_node[1].to_s.delete_suffix(":") if key_node.is_a?(Array) && key_node[0] == :@label
+
+        Ast.plain_string_value(key_node) || Ast.literal_text(key_node)
+      end
+
+      def assoc_value_text(value_node)
+        Ast.plain_string_value(value_node) || Ast.literal_text(value_node)
+      end
+
+      def const_receiver_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = const_receiver_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end