scryer 0.3.0 → 1.0.0

data/lib/scryer/report_renderer.rb

@@ -73,6 +73,18 @@ module Scryer
       rows.map { |row| row.map { |field| csv_field(field) }.join(",") }.join("\n")
     end
 
+    SARIF_LEVEL_BY_SEVERITY = { "critical" => "error", "warning" => "warning", "info" => "note" }.freeze
+
+    # SARIF 2.1.0 (docs.oasis-open.org/sarif/sarif/v2.1.0) — the format
+    # GitHub Code Scanning (and other CI security dashboards) natively
+    # ingest, turning findings into inline PR annotations and Security-tab
+    # entries instead of a report file nobody opens. Pure data mapping of
+    # what's already in as_hash — no new detection logic, and every finding
+    # behaves identically to how it does in the other formats.
+    def as_sarif
+      JSON.pretty_generate(sarif_hash)
+    end
+
     def as_html
       h = as_hash
       security = h["security_findings"]
@@ -408,7 +420,8 @@ module Scryer
     def render_dependency_finding(f)
       severity = f["severity"]
       heading = f["kind"] == "insecure_source" ? "Insecure gem source" : "#{escape(f["gem_name"])} #{escape(f["installed_version"])}"
-      advisory = f["advisory_id"] ? "<span class=\"loc\">#{escape(f["advisory_id"])}#{f["title"] ? " — #{escape(f["title"])}" : ""}</span>" : ""
+      advisory_text = [f["advisory_id"], f["title"]].compact.map { |t| escape(t) }.join(" — ")
+      advisory = advisory_text.empty? ? "" : "<span class=\"loc\">#{advisory_text}</span>"
       link = f["url"] ? " &middot; <a href=\"#{escape(f["url"])}\" target=\"_blank\" rel=\"noopener\">advisory</a>" : ""
       patched = Array(f["patched_versions"])
 
@@ -481,7 +494,14 @@ module Scryer
     end
 
     def dependency_csv_row(f)
-      identifier = f["kind"] == "insecure_source" ? "insecure_source" : "#{f["gem_name"]} #{f["installed_version"]} (#{f["advisory_id"]})"
+      identifier =
+        if f["kind"] == "insecure_source"
+          "insecure_source"
+        elsif f["advisory_id"]
+          "#{f["gem_name"]} #{f["installed_version"]} (#{f["advisory_id"]})"
+        else
+          "#{f["gem_name"]} #{f["installed_version"]}"
+        end
       [f["kind"], identifier, f["severity"], "Gemfile.lock", f["message"], f["suggested_fix"], nil, f["url"]]
     end
 
@@ -490,6 +510,86 @@ module Scryer
       s.match?(/[",\n\r]/) ? "\"#{s.gsub('"', '""')}\"" : s
     end
 
+    # kind/title/severity for the three DependencyAudit finding kinds, which
+    # (unlike security/performance/style findings) aren't backed by a
+    # Scryer::Rule — described here just so SARIF's tool.driver.rules[]
+    # taxonomy has an entry for them too.
+    DEPENDENCY_SARIF_RULES = [
+      { "id" => "vulnerable_dependency", "title" => "Known-vulnerable gem version (OSV.dev)", "severity" => "critical" },
+      { "id" => "insecure_source", "title" => "Insecure (unencrypted) Gemfile.lock source", "severity" => "warning" },
+      { "id" => "ruby_eol", "title" => "Ruby version is end-of-life", "severity" => "critical" },
+      { "id" => "credentials_exposure", "title" => "config/master.key present and not gitignored", "severity" => "critical" }
+    ].freeze
+
+    def sarif_hash
+      h = as_hash
+      findings = h["security_findings"] + h["performance_findings"] + h["style_findings"]
+
+      {
+        "$schema" => "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+        "version" => "2.1.0",
+        "runs" => [
+          {
+            "tool" => {
+              "driver" => {
+                "name" => "Scryer",
+                "version" => Scryer::VERSION,
+                "informationUri" => "https://ramlaxmanyadav.github.io/scryer/",
+                "rules" => sarif_rules
+              }
+            },
+            "results" => findings.map { |f| sarif_result(f) } + h["dependency_findings"].map { |f| sarif_dependency_result(f) }
+          }
+        ]
+      }
+    end
+
+    def sarif_rules
+      rule_entries = Scryer::RuleSet.all.map do |rule|
+        {
+          "id" => rule.rule_id,
+          "name" => rule.rule_id,
+          "shortDescription" => { "text" => rule.title },
+          "defaultConfiguration" => { "level" => SARIF_LEVEL_BY_SEVERITY[rule.default_severity] || "warning" }
+        }
+      end
+
+      dependency_entries = DEPENDENCY_SARIF_RULES.map do |r|
+        {
+          "id" => r["id"],
+          "name" => r["id"],
+          "shortDescription" => { "text" => r["title"] },
+          "defaultConfiguration" => { "level" => SARIF_LEVEL_BY_SEVERITY[r["severity"]] || "warning" }
+        }
+      end
+
+      rule_entries + dependency_entries
+    end
+
+    def sarif_result(f)
+      physical_location = { "artifactLocation" => { "uri" => f["file"] } }
+      physical_location["region"] = { "startLine" => f["line"] } if f["line"]
+
+      {
+        "ruleId" => f["rule_id"],
+        "level" => SARIF_LEVEL_BY_SEVERITY[f["severity"]] || "warning",
+        "message" => { "text" => f["message"] },
+        "locations" => [{ "physicalLocation" => physical_location }]
+      }
+    end
+
+    # Dependency findings don't point at a line in app source — Gemfile.lock
+    # itself is the meaningful "location" (no region: nothing to underline
+    # inside it the way a code finding underlines a specific line).
+    def sarif_dependency_result(f)
+      {
+        "ruleId" => f["kind"],
+        "level" => SARIF_LEVEL_BY_SEVERITY[f["severity"]] || "warning",
+        "message" => { "text" => f["message"] },
+        "locations" => [{ "physicalLocation" => { "artifactLocation" => { "uri" => "Gemfile.lock" } } }]
+      }
+    end
+
     CSS = <<~CSS
       body { font-family: -apple-system, Helvetica, Arial, sans-serif; margin: 2rem; color: #1e293b; }
       h1 { margin-bottom: 0.25rem; }

data/lib/scryer/rules/action_cable_forgery_protection_rule.rb

@@ -0,0 +1,47 @@
+module Scryer
+  module Rules
+    # Flags `config.action_cable.disable_request_forgery_protection = true`
+    # — an explicit opt-out of Action Cable's default check that a
+    # WebSocket connection's request `Origin` header matches the app's own
+    # allowed origins, which otherwise blocks cross-site WebSocket hijacking.
+    # Same shape/reasoning as ForceSslRule: only the explicit opt-in to the
+    # insecure behavior is flagged, not its absence.
+    class ActionCableForgeryProtectionRule < Rule
+      self.rule_id = "action_cable_forgery_protection_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Action Cable request forgery protection explicitly disabled"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "disable_request_forgery_protection"
+
+          value = node[2]
+          next unless Ast.true_literal?(value)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`config.action_cable.disable_request_forgery_protection = true` explicitly " \
+                      "disables Action Cable's default check that a WebSocket connection's " \
+                      "`Origin` header matches an allowed origin — without it, another site can " \
+                      "open a WebSocket connection to this app in a visitor's browser and act as " \
+                      "that visitor (cross-site WebSocket hijacking).",
+            suggested_fix: "Remove this override and set `config.action_cable.allowed_request_origins` " \
+                            "to the app's real origin(s) instead, unless request forgery protection is " \
+                            "deliberately being handled some other way — if so, leave a comment " \
+                            "explaining that."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/active_storage_inline_disposition_rule.rb

@@ -0,0 +1,47 @@
+module Scryer
+  module Rules
+    # Flags an explicit `disposition: "inline"`/`:inline` on a blob/variant
+    # URL helper (`rails_blob_path`, `rails_blob_url`, `url_for`, a
+    # `.variant(...)` chain). Serving user-uploaded content inline (rendered
+    # directly in the browser, rather than downloaded) can lead to stored
+    # XSS if the uploaded file's content-type isn't tightly restricted — an
+    # uploaded SVG or HTML file executes in the page's own origin.
+    class ActiveStorageInlineDispositionRule < Rule
+      self.rule_id = "active_storage_inline_disposition"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Active Storage content served with inline disposition"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          name_pair = Ast.call_name(inner)
+          next unless name_pair
+
+          args = Ast.call_arguments(node)
+          disposition = Ast.keyword_arg(args, "disposition")
+          next unless disposition && Ast.literal_text(disposition) == "inline"
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`disposition: \"inline\"` renders this attachment's content directly in " \
+                      "the browser instead of downloading it — if the attachment's content-type " \
+                      "isn't tightly restricted, a user-uploaded SVG or HTML file served this way " \
+                      "executes as if it were part of the site.",
+            suggested_fix: "Prefer the default `disposition: \"attachment\"` (or drop the option " \
+                            "entirely) unless inline rendering is genuinely required — and if it " \
+                            "is, make sure the attachment has a strict `content_type:` allowlist " \
+                            "(e.g. image types only) so nothing executable can reach this code path."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/active_storage_missing_content_type_validation_rule.rb

@@ -0,0 +1,76 @@
+module Scryer
+  module Rules
+    # Flags `has_one_attached`/`has_many_attached :name` with no
+    # `validates :name, content_type: [...]` anywhere in the same class —
+    # without a content-type allowlist, a user can upload anything (an SVG
+    # or HTML file that executes script when served, an executable, ...),
+    # not just the file type the feature was built for.
+    class ActiveStorageMissingContentTypeValidationRule < Rule
+      self.rule_id = "active_storage_missing_content_type_validation"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Active Storage attachment without a content-type validation"
+
+      ATTACHMENT_METHODS = %w[has_one_attached has_many_attached].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          body = node[3]
+          validated_names = each_content_type_validated_names(body)
+
+          each_attachment(body).each do |call_node, name|
+            next if validated_names.include?(name)
+
+            line = Ast.line_of(call_node)
+            findings << finding(
+              line: line,
+              message: "`:#{name}` is attached via Active Storage with no `content_type:` " \
+                        "validation anywhere in this class — any file type can be uploaded, " \
+                        "including ones that execute in a browser if ever served back (e.g. SVG, " \
+                        "HTML) or aren't safe to store at all.",
+              suggested_fix: "Add an explicit allowlist: `validates :#{name}, content_type: " \
+                              "['image/png', 'image/jpeg']` (whatever types this feature actually " \
+                              "needs) so anything else is rejected at upload time."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_attachment(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && ATTACHMENT_METHODS.include?(name_pair[1])
+
+          name = Ast.call_arguments(n).filter_map { |a| Ast.literal_text(a) }.first
+          [n, name] if name
+        end
+      end
+
+      def each_content_type_validated_names(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :command, :command_call, :method_add_arg)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && name_pair[1] == "validates"
+
+          args = Ast.call_arguments(n)
+          next unless Ast.keyword_arg(args, "content_type")
+
+          Ast.literal_text(args.first)
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/authentication_bypass_rule.rb

@@ -0,0 +1,72 @@
+module Scryer
+  module Rules
+    # Flags a controller class that calls `skip_before_action`/
+    # `skip_action_callback` naming a common authentication filter
+    # (`authenticate_user!`, `authenticate!`, ...) — same shape and reasoning
+    # as CsrfProtectionRule, just for auth filters instead of CSRF: skipping
+    # one is sometimes correct (a public endpoint, a webhook) but is also a
+    # common way to accidentally leave an action reachable without login,
+    # especially with a broad `except:`/no scoping at all.
+    class AuthenticationBypassRule < Rule
+      self.rule_id = "authentication_bypass"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "Authentication filter explicitly skipped"
+
+      SKIP_METHODS = %w[skip_before_action skip_action_callback skip_before_filter].freeze
+      AUTH_FILTER_NAMES = %w[
+        authenticate_user! authenticate! authenticate_admin! authenticate_account!
+        require_login require_authentication authorize_request
+      ].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          next unless class_name.to_s.end_with?("Controller")
+
+          each_skip_call(node[3]).each do |skip_node, filter_name|
+            line = Ast.line_of(skip_node)
+            findings << finding(
+              line: line,
+              message: "`#{class_name}` skips the `#{filter_name}` authentication filter " \
+                        "(`#{skip_call_method(skip_node)} :#{filter_name}`) — every action this " \
+                        "applies to is reachable without logging in unless something else in " \
+                        "this controller re-checks authentication.",
+              suggested_fix: "If this is genuinely a public action (a webhook, a login/signup " \
+                              "page), scope the skip tightly with `only: [:action_name]` rather " \
+                              "than leaving it unscoped or using a broad `except:`. If it's not " \
+                              "meant to be public, remove the skip."
+            )
+          end
+        end
+
+        findings
+      end
+
+      private
+
+      def each_skip_call(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && SKIP_METHODS.include?(name_pair[1])
+
+          args = Ast.call_arguments(n)
+          filter_name = args.filter_map { |a| Ast.literal_text(a) }.find { |v| AUTH_FILTER_NAMES.include?(v) }
+          [n, filter_name] if filter_name
+        end
+      end
+
+      def skip_call_method(node)
+        inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+        Ast.call_name(inner)&.last
+      end
+    end
+  end
+end

data/lib/scryer/rules/cors_misconfiguration_rule.rb

@@ -0,0 +1,69 @@
+module Scryer
+  module Rules
+    # Flags the well-known Rack::Cors antipattern: a wildcard origin
+    # (`origins '*'`) combined with `credentials: true` on a `resource` call.
+    # Per the CORS spec, browsers reject this combination in practice, but
+    # it's still the standard misconfiguration flagged in security reviews —
+    # either half alone (wildcard origin with no credentials, or credentials
+    # with a real origin allowlist) is fine.
+    #
+    # `config/initializers/cors.rb` is small and self-contained, so this
+    # checks "does `origins(...)` with a literal `'*'` appear anywhere in the
+    # file AND does a `resource` call with `credentials: true` appear
+    # anywhere in the file" rather than requiring both inside the exact same
+    # `allow do ... end` block — the same file-wide-evidence looseness
+    # IdorRule uses for its class-wide authorization check.
+    class CorsMisconfigurationRule < Rule
+      self.rule_id = "cors_misconfiguration"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "CORS wildcard origin combined with credentials"
+
+      def scan
+        findings = []
+        return findings unless wildcard_origin_anywhere?(sexp)
+
+        each_credentialed_resource(sexp).each do |node|
+          findings << finding(
+            line: Ast.line_of(node),
+            message: "This file allows a wildcard origin (`origins '*'`) somewhere and this " \
+                      "`resource` call sets `credentials: true` — browsers won't honor that " \
+                      "combination for actual credentialed requests, and Rack::Cors handling it " \
+                      "inconsistently is the standard CORS misconfiguration flagged in reviews. " \
+                      "Either restrict origins to a real allowlist, or drop `credentials: true`.",
+            suggested_fix: "Replace the wildcard with an explicit origin allowlist wherever " \
+                            "`credentials: true` is set: `origins 'https://app.example.com'` " \
+                            "instead of `origins '*'` — a wildcard origin should only be paired " \
+                            "with `credentials: false` (the default)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def wildcard_origin_anywhere?(node)
+        Ast.each_node(node).any? do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          next false unless Ast.call_name(inner)&.last == "origins"
+
+          Ast.call_arguments(n).any? { |a| Ast.plain_string_value(a) == "*" }
+        end
+      end
+
+      def each_credentialed_resource(node)
+        Ast.each_node(node).select do |n|
+          next false unless Ast.tagged?(n, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          next false unless Ast.call_name(inner)&.last == "resource"
+
+          Ast.true_literal?(Ast.keyword_arg(Ast.call_arguments(n), "credentials"))
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/force_ssl_rule.rb

@@ -0,0 +1,45 @@
+module Scryer
+  module Rules
+    # Flags `config.force_ssl = false` — an explicit opt-out of Rails'
+    # built-in HTTPS enforcement (redirects, HSTS, secure cookie flag).
+    # Absence of `config.force_ssl = true` isn't flagged — that would require
+    # confirming no environment file sets it anywhere, which needs whole-app
+    # context this per-file rule doesn't have. Only the explicit opt-out is a
+    # reliable, low-noise signal on its own.
+    class ForceSslRule < Rule
+      self.rule_id = "force_ssl_disabled"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "HTTPS enforcement explicitly disabled"
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "force_ssl"
+
+          value = node[2]
+          next unless Ast.false_literal?(value)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`config.force_ssl = false` explicitly disables Rails' HTTPS enforcement " \
+                      "(redirects, HSTS, and the secure flag on cookies) — traffic can be served " \
+                      "and session cookies transmitted over plain HTTP.",
+            suggested_fix: "Set `config.force_ssl = true` (the default for a new Rails production " \
+                            "environment) unless this app is deliberately terminating TLS " \
+                            "elsewhere (a load balancer already enforcing HTTPS) — and if so, " \
+                            "leave a comment explaining that so this doesn't look like an oversight."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/graphql_missing_query_limits_rule.rb

@@ -0,0 +1,75 @@
+module Scryer
+  module Rules
+    # Flags a `class X < GraphQL::Schema` (or a class whose superclass
+    # constant path text is exactly `GraphQL::Schema`) whose body calls
+    # neither `max_depth` nor `max_complexity` anywhere — without at least
+    # one of those, a client can send an arbitrarily deep/expensive query
+    # and the server will try to resolve all of it, a common
+    # denial-of-service vector for GraphQL APIs. Both missing is flagged as
+    # a single finding per class (not one per missing directive), the same
+    # "did the class do the safe thing at all" pattern as
+    # ActiveStorageMissingContentTypeValidationRule/IdorRule.
+    class GraphqlMissingQueryLimitsRule < Rule
+      self.rule_id = "graphql_missing_query_limits"
+      self.category = "security"
+      self.default_severity = "warning"
+      self.title = "GraphQL schema without query depth/complexity limits"
+
+      LIMIT_METHODS = %w[max_depth max_complexity].freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :class)
+
+          superclass = superclass_name(node[2])
+          next unless superclass == "GraphQL::Schema"
+
+          body = node[3]
+          next if each_call_names(body).any? { |name| LIMIT_METHODS.include?(name) }
+
+          class_name = Ast.ident_text(node[1].is_a?(Array) ? node[1][1] : nil)
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`#{class_name}` extends `GraphQL::Schema` but calls neither `max_depth` nor " \
+                      "`max_complexity` — without either limit, a client can send an arbitrarily " \
+                      "deep or expensive query and the server will attempt to resolve all of it, a " \
+                      "common denial-of-service vector for GraphQL APIs.",
+            suggested_fix: "Add at least one limit to the schema, e.g. `max_depth 15` and/or " \
+                            "`max_complexity 300` (tune both to what this API's real queries need)."
+          )
+        end
+
+        findings
+      end
+
+      private
+
+      def each_call_names(body)
+        Ast.each_node(body).filter_map do |n|
+          next unless Ast.tagged?(n, :method_add_arg, :command, :command_call, :fcall, :vcall)
+
+          inner = Ast.tagged?(n, :method_add_arg) ? n[1] : n
+          Ast.call_name(inner)&.last
+        end
+      end
+
+      # Textual name of a (possibly namespaced) constant superclass node —
+      # "GraphQL::Schema" for the `[:const_path_ref, ...]` chain a `< X::Y`
+      # superclass parses into, or the bare name for an unnamespaced
+      # superclass (`[:var_ref, [:@const, ...]]`). nil if there's no
+      # superclass (`node[2]` is nil for a plain `class X` with no `< ...`).
+      def superclass_name(node)
+        if Ast.tagged?(node, :var_ref) && node[1].is_a?(Array) && node[1][0] == :@const
+          node[1][1]
+        elsif Ast.tagged?(node, :const_path_ref)
+          left = superclass_name(node[1])
+          right = node[2].is_a?(Array) && node[2][0] == :@const ? node[2][1] : nil
+          [left, right].compact.join("::")
+        end
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_basic_auth_rule.rb

@@ -0,0 +1,48 @@
+module Scryer
+  module Rules
+    # Flags `http_basic_authenticate_with` calls whose `password:` (or
+    # `name:`) keyword argument is a plain string literal — a shape
+    # `HardcodedSecretRule` doesn't cover (that rule only looks at
+    # `x = "literal"` assignment targets, not keyword-argument values in a
+    # method call).
+    class HardcodedBasicAuthRule < Rule
+      self.rule_id = "hardcoded_basic_auth"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded HTTP Basic Auth credential"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|your[_-]?password|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :method_add_arg, :command, :command_call)
+
+          inner = Ast.tagged?(node, :method_add_arg) ? node[1] : node
+          name_pair = Ast.call_name(inner)
+          next unless name_pair && name_pair[1] == "http_basic_authenticate_with"
+
+          args = Ast.call_arguments(node)
+          password_value = Ast.plain_string_value(Ast.keyword_arg(args, "password"))
+          next unless password_value && !password_value.strip.empty? && !PLACEHOLDER_VALUES.match?(password_value.strip)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`http_basic_authenticate_with` is called with a literal `password:` — " \
+                      "anyone with read access to this source (including git history) has the " \
+                      "credential, and it can't be rotated without a code change and deploy.",
+            suggested_fix: "Move the credential out of source: " \
+                            "`http_basic_authenticate_with name: ENV.fetch(\"BASIC_AUTH_USER\"), " \
+                            "password: ENV.fetch(\"BASIC_AUTH_PASSWORD\")` (or Rails encrypted " \
+                            "credentials), and rotate this password since it's likely already " \
+                            "exposed in git history."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end

data/lib/scryer/rules/hardcoded_secret_key_base_rule.rb

@@ -0,0 +1,55 @@
+module Scryer
+  module Rules
+    # Flags `config.secret_key_base = "literal"` (or
+    # `Rails.application.config.secret_key_base = "literal"`) — a plain
+    # string literal assigned to `secret_key_base` via a `.field=` target.
+    #
+    # HardcodedSecretRule doesn't catch this shape: its `target_name` walks
+    # the assignment target depth-first and returns the *first* identifier
+    # it finds, which for a `.field=` target with a receiver is the
+    # receiver's own name (`config`) rather than the attribute being
+    # assigned (`secret_key_base`) — so `config.secret_key_base = "..."`
+    # never matches its NAME_PATTERN, even though the value is exactly the
+    # kind of credential that rule exists to catch. Bare assignment
+    # (`secret_key_base = "..."` with no receiver) IS already caught by
+    # HardcodedSecretRule, since there the identifier IS the target name —
+    # this rule only covers the receiver'd shape it misses.
+    class HardcodedSecretKeyBaseRule < Rule
+      self.rule_id = "hardcoded_secret_key_base"
+      self.category = "security"
+      self.default_severity = "critical"
+      self.title = "Hardcoded secret_key_base"
+
+      PLACEHOLDER_VALUES = /\A(x+|0+|change-?me|placeholder|example|dummy|fake|test|redacted|\*+)\z/i.freeze
+
+      def scan
+        findings = []
+
+        Ast.each_node(sexp) do |node|
+          next unless Ast.tagged?(node, :assign)
+
+          target = node[1]
+          next unless Ast.tagged?(target, :field)
+          next unless Ast.ident_text(target[3]) == "secret_key_base"
+
+          value = Ast.plain_string_value(node[2])
+          next unless value && !value.strip.empty? && !PLACEHOLDER_VALUES.match?(value.strip)
+
+          line = Ast.line_of(node)
+          findings << finding(
+            line: line,
+            message: "`secret_key_base` is assigned a literal string — this key signs/encrypts " \
+                      "Rails sessions and other secrets; anyone with read access to this source " \
+                      "(including git history) can forge session cookies and other signed data.",
+            suggested_fix: "Use `Rails.application.credentials.secret_key_base` (the Rails default, " \
+                            "set via `bin/rails credentials:edit`) or `ENV.fetch(\"SECRET_KEY_BASE\")` " \
+                            "instead, and rotate this key since it's likely already exposed in git " \
+                            "history."
+          )
+        end
+
+        findings
+      end
+    end
+  end
+end