@akasecurity/cli 0.8.1 → 0.9.0-rc1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/cli",
-  "version": "0.8.1",
+  "version": "0.9.0-rc1",
   "description": "AI Traffic Control — local-first CLI to inspect and govern AI agent traffic on your machine",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,10 @@
     "react-dom": "^19.2.7"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^24.13.3",
     "@types/react": "^19.2.17",
     "eslint": "^9.0.0",
+    "postject": "^1.0.0-alpha.6",
     "tsup": "^8.0.0",
     "tsx": "^4.23.1",
     "typescript": "^5.8.0",
@@ -43,16 +44,21 @@
     "@akasecurity/detections": "0.8.0",
     "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/local-ops": "0.8.0",
-    "@akasecurity/plugin-sdk": "0.8.0",
-    "@akasecurity/schema": "0.8.0",
     "@akasecurity/persistence": "0.8.0",
-    "@akasecurity/web-ui": "0.8.0"
+    "@akasecurity/web-ui": "0.8.0",
+    "@akasecurity/plugin-sdk": "0.8.0",
+    "@akasecurity/schema": "0.8.0"
   },
   "scripts": {
     "dev": "tsx src/cli.ts",
     "build": "tsup",
+    "build:sea": "tsup --config tsup.sea.config.ts",
+    "smoke:sea": "node scripts/smoke-sea.mjs",
+    "smoke:dashboard": "node scripts/smoke-dashboard.mjs",
+    "package:sea": "node scripts/package-sea.mjs",
+    "archive:sea": "node scripts/archive-sea.mjs",
     "bundle:web-ui": "node scripts/bundle-web-ui.mjs",
-    "lint": "eslint src",
+    "lint": "eslint src test",
     "test": "vitest run",
     "typecheck": "tsc --noEmit"
   }

package/web-ui/packages/dashboard-ui/package.json

@@ -8,7 +8,7 @@
     "./recommendations": "./src/security/recommendations.ts"
   },
   "scripts": {
-    "lint": "eslint src",
+    "lint": "eslint src test",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },

package/web-ui/packages/detections/package.json

@@ -7,7 +7,7 @@
     ".": "./src/index.ts"
   },
   "scripts": {
-    "lint": "eslint src",
+    "lint": "eslint src test",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },
@@ -17,7 +17,7 @@
   "devDependencies": {
     "@akasecurity/eslint-config": "workspace:*",
     "@akasecurity/extract": "workspace:*",
-    "@types/node": "^26.1.1",
+    "@types/node": "^24.13.3",
     "eslint": "^9.0.0",
     "typescript": "^5.8.0",
     "vitest": "^4.1.10"

package/web-ui/packages/local-ops/package.json

@@ -7,19 +7,20 @@
     ".": "./src/index.ts"
   },
   "scripts": {
-    "lint": "eslint src",
+    "lint": "eslint src test",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },
   "dependencies": {
     "@akasecurity/detections": "workspace:*",
     "@akasecurity/persistence": "workspace:*",
+    "@akasecurity/plugin-sdk": "workspace:*",
     "@akasecurity/schema": "workspace:*",
     "ignore": "^7.0.6"
   },
   "devDependencies": {
     "@akasecurity/eslint-config": "workspace:*",
-    "@types/node": "^26.1.1",
+    "@types/node": "^24.13.3",
     "eslint": "^9.0.0",
     "typescript": "^5.8.0",
     "vitest": "^4.1.10"

package/web-ui/packages/persistence/package.json

@@ -7,7 +7,7 @@
     ".": "./src/index.ts"
   },
   "scripts": {
-    "lint": "eslint src",
+    "lint": "eslint src test",
     "typecheck": "tsc --noEmit",
     "test": "vitest run"
   },
@@ -16,7 +16,7 @@
   },
   "devDependencies": {
     "@akasecurity/eslint-config": "workspace:*",
-    "@types/node": "^26.1.1",
+    "@types/node": "^24.13.3",
     "eslint": "^9.0.0",
     "typescript": "^5.8.0",
     "vitest": "^4.1.10"

package/web-ui/packages/plugin-sdk/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@akasecurity/plugin-sdk",
+  "version": "0.8.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "gen:bundled-packs": "node scripts/gen-bundled-packs.mjs",
+    "lint": "eslint src test",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@akasecurity/detections": "workspace:*",
+    "@akasecurity/persistence": "workspace:*",
+    "@akasecurity/schema": "workspace:*",
+    "ignore": "^7.0.6",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "@akasecurity/eslint-config": "workspace:*",
+    "@types/node": "^24.13.3",
+    "eslint": "^9.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^4.1.10"
+  }
+}

package/web-ui/packages/schema/package.json

@@ -9,7 +9,7 @@
     "./drizzle": "./src/drizzle/index.ts"
   },
   "scripts": {
-    "lint": "eslint src",
+    "lint": "eslint src test",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "gen:sqlite-ddl": "drizzle-kit generate --config drizzle.config.local.ts && node scripts/gen-sqlite-ddl.mjs"
@@ -20,7 +20,7 @@
   },
   "devDependencies": {
     "@akasecurity/eslint-config": "workspace:*",
-    "@types/node": "^26.1.1",
+    "@types/node": "^24.13.3",
     "drizzle-kit": "^0.31.0",
     "eslint": "^9.0.0",
     "typescript": "^5.8.0",

package/web-ui/rules/code-flaws/auth-jwt-no-verify.json

@@ -0,0 +1,20 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/auth-jwt-no-verify",
+  "name": "JWT decoded without signature verification",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(verify\\s*=\\s*false|verify_signature.*false|algorithms\\s*=\\s*\\[\\])",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "labels": ["jwt", "decode", "token"],
+    "windowChars": 160
+  },
+  "examples": [
+    "jwt.decode(token, options={\"verify_signature\": False})",
+    "jwt.decode(token, algorithms=[])"
+  ]
+}

package/web-ui/rules/code-flaws/auth-ssl-verify-false.json

@@ -0,0 +1,19 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/auth-ssl-verify-false",
+  "name": "SSL certificate verification disabled",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\brequests\\.(get|post|put|delete|patch|request)\\s*\\([^)]*verify\\s*=\\s*False",
+    "flags": "gi"
+  },
+  "examples": [
+    "requests.get(url, verify=False)",
+    "requests.post(endpoint, data=payload, verify=False)"
+  ],
+  "appliesTo": {
+    "extensions": [".py"]
+  }
+}

package/web-ui/rules/code-flaws/cmd-inject-exec.json

@@ -0,0 +1,20 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/cmd-inject-exec",
+  "name": "Command injection via Java Runtime.exec",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "Runtime\\.getRuntime\\(\\)\\.exec\\(",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["input", "request", "param", "user"],
+    "windowChars": 200
+  },
+  "examples": ["Runtime.getRuntime().exec(userInput)"],
+  "appliesTo": {
+    "extensions": [".java"]
+  }
+}

package/web-ui/rules/code-flaws/cmd-inject-node-exec.json

@@ -0,0 +1,20 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/cmd-inject-node-exec",
+  "name": "Command injection via Node.js exec with variable argument",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bexec(?:Sync)?\\s*\\(\\s*(?!['\"`])",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["input", "request", "param", "argv", "user", "query", "body"],
+    "windowChars": 200
+  },
+  "examples": ["exec(req.query.cmd)", "execSync(userInput)"],
+  "appliesTo": {
+    "extensions": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]
+  }
+}

package/web-ui/rules/code-flaws/cmd-inject-shell.json

@@ -0,0 +1,20 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/cmd-inject-shell",
+  "name": "Command injection via subprocess shell=True",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "subprocess\\.(run|Popen|call|check_output)\\s*\\([^)]*shell\\s*=\\s*True",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "labels": ["input", "request", "param", "argv", "user"],
+    "windowChars": 300
+  },
+  "examples": ["subprocess.run(user_input, shell=True)"],
+  "appliesTo": {
+    "extensions": [".py"]
+  }
+}

package/web-ui/rules/code-flaws/crypto-insecure-random.json

@@ -0,0 +1,20 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/crypto-insecure-random",
+  "name": "Insecure random number generator used for security-sensitive value",
+  "category": "code_flaw",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(Math\\.random\\(\\)|random\\.random\\(\\)|random\\.randint\\()",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "labels": ["token", "session", "key", "password", "secret", "nonce", "salt"],
+    "windowChars": 160
+  },
+  "examples": ["const token = Math.random().toString(36)", "session_key = str(random.random())"],
+  "appliesTo": {
+    "extensions": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".py"]
+  }
+}

package/web-ui/rules/code-flaws/crypto-weak-hash-md5.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/crypto-weak-hash-md5",
+  "name": "Weak cryptographic hash: MD5",
+  "category": "code_flaw",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(hashlib\\.md5\\s*\\(|MD5\\.(?:digest|hash)\\b|Digest::MD5|MessageDigest\\.getInstance\\s*\\(\\s*[\"']MD5[\"'])",
+    "flags": "gi"
+  },
+  "examples": ["hashlib.md5(password.encode())", "MessageDigest.getInstance(\"MD5\")"],
+  "appliesTo": {
+    "extensions": [".py", ".rb", ".java"]
+  }
+}

package/web-ui/rules/code-flaws/crypto-weak-hash-sha1.json

@@ -0,0 +1,23 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/crypto-weak-hash-sha1",
+  "name": "Weak cryptographic hash: SHA-1 in security context",
+  "category": "code_flaw",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(hashlib\\.sha1\\s*\\(|SHA1\\.(?:digest|hash)\\b|Digest::SHA1|MessageDigest\\.getInstance\\s*\\(\\s*[\"']SHA-?1[\"'])",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "labels": ["password", "credential", "hash", "token", "secret"],
+    "windowChars": 160
+  },
+  "examples": [
+    "password_hash = hashlib.sha1(password.encode()).hexdigest()",
+    "MessageDigest.getInstance(\"SHA1\")"
+  ],
+  "appliesTo": {
+    "extensions": [".py", ".rb", ".java"]
+  }
+}

package/web-ui/rules/code-flaws/deser-java-ois.json

@@ -0,0 +1,22 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/deser-java-ois",
+  "name": "Insecure deserialization via Java ObjectInputStream",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bObjectInputStream\\b",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["readObject"],
+    "windowChars": 200
+  },
+  "examples": [
+    "ObjectInputStream ois = new ObjectInputStream(inputStream); Object obj = ois.readObject();"
+  ],
+  "appliesTo": {
+    "extensions": [".java"]
+  }
+}

package/web-ui/rules/code-flaws/deser-pickle.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/deser-pickle",
+  "name": "Insecure deserialization via Python pickle",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bpickle\\.loads?\\s*\\(",
+    "flags": "gi"
+  },
+  "examples": ["data = pickle.loads(user_data)", "obj = pickle.load(request.stream)"],
+  "appliesTo": {
+    "extensions": [".py"]
+  }
+}

package/web-ui/rules/code-flaws/deser-yaml-unsafe.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/deser-yaml-unsafe",
+  "name": "Insecure deserialization via yaml.load without SafeLoader",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\byaml\\.load\\s*\\((?![^)]*SafeLoader|[^)]*safe_load)",
+    "flags": "gi"
+  },
+  "examples": ["data = yaml.load(user_input)", "config = yaml.load(f)"],
+  "appliesTo": {
+    "extensions": [".py"]
+  }
+}

package/web-ui/rules/code-flaws/dev-debug-enabled.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/dev-debug-enabled",
+  "name": "Debug mode enabled in configuration",
+  "category": "code_flaw",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bdebug\\s*[=:]\\s*(true|1|yes)",
+    "flags": "gi"
+  },
+  "examples": ["DEBUG = True", "debug: true", "app.debug = True"]
+}

package/web-ui/rules/code-flaws/dev-placeholder-secret.json

@@ -0,0 +1,24 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/dev-placeholder-secret",
+  "name": "Placeholder or default secret left in code",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "keyword",
+    "keywords": [
+      "changeme",
+      "placeholder",
+      "your-secret",
+      "dev-secret",
+      "replace-me",
+      "todo-secret"
+    ],
+    "caseSensitive": false
+  },
+  "requiresNearby": {
+    "labels": ["key", "secret", "password", "token"],
+    "windowChars": 80
+  },
+  "examples": ["SECRET_KEY = 'changeme'", "api_token = 'your-secret'"]
+}

package/web-ui/rules/code-flaws/dev-wildcard-cors.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/dev-wildcard-cors",
+  "name": "CORS wildcard allowing all origins",
+  "category": "code_flaw",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(Access-Control-Allow-Origin:\\s*\\*|origin:\\s*[\"']\\*[\"']|allow_all_origins\\s*=\\s*True|CORS_ALLOW_ALL_ORIGINS\\s*=\\s*True)",
+    "flags": "gi"
+  },
+  "examples": [
+    "Access-Control-Allow-Origin: *",
+    "cors({ origin: '*' })",
+    "CORS_ALLOW_ALL_ORIGINS = True"
+  ]
+}

package/web-ui/rules/code-flaws/eval-dynamic-exec.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/eval-dynamic-exec",
+  "name": "Dynamic code execution with user-controlled input",
+  "category": "code_flaw",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(eval|exec)\\s*\\(\\s*(?!['\"`])",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["input", "request", "param", "user", "query", "body"],
+    "windowChars": 200
+  },
+  "examples": ["eval(request.body.code)", "exec(user_input)"]
+}

package/web-ui/rules/code-flaws/hardcoded-password.json

@@ -0,0 +1,23 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/hardcoded-password",
+  "name": "Hardcoded password in source code",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?:password|passwd|pwd)\\s*=\\s*[\"']([^\"']{3,})[\"']",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "postValidators": [
+    {
+      "name": "entropy",
+      "config": {
+        "minLength": 8,
+        "threshold": 3.0
+      }
+    }
+  ],
+  "examples": ["password = \"Tr0ub4dor&3\"", "DB_PASSWORD = 'c0rr3ctH0rseBatt3ry'"]
+}

package/web-ui/rules/code-flaws/hardcoded-secret-key.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/hardcoded-secret-key",
+  "name": "Hardcoded API key or secret key in source code",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(secret[_-]?key|api[_-]?key|auth[_-]?token)\\s*=\\s*[\"'][^\"']{8,}[\"']",
+    "flags": "gi"
+  },
+  "postValidators": ["entropy"],
+  "examples": [
+    "SECRET_KEY = \"a9f2c8e1b4d7f3a6c9e2b5d8f1a4c7e0\"",
+    "api_key = 'sk-proj-abc123XYZ789def456'"
+  ]
+}

package/web-ui/rules/code-flaws/path-traversal-join.json

@@ -0,0 +1,19 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/path-traversal-join",
+  "name": "Path traversal via os.path.join with user-controlled component",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "os\\.path\\.join\\s*\\([^,)]+,\\s*(request|req|params|user)",
+    "flags": "gi"
+  },
+  "examples": [
+    "os.path.join(base_dir, request.args['file'])",
+    "os.path.join(upload_dir, user_filename)"
+  ],
+  "appliesTo": {
+    "extensions": [".py"]
+  }
+}

package/web-ui/rules/code-flaws/path-traversal-open.json

@@ -0,0 +1,20 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/path-traversal-open",
+  "name": "Path traversal via open() with user-controlled path",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bopen\\s*\\(\\s*(request|req|params|argv|input)",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "labels": ["request", "param", "input", "argv", "user"],
+    "windowChars": 200
+  },
+  "examples": ["open(request.args['filename'])", "open(params['path'])"],
+  "appliesTo": {
+    "extensions": [".py", ".rb"]
+  }
+}

package/web-ui/rules/code-flaws/prototype-pollution-merge.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/prototype-pollution-merge",
+  "name": "Prototype pollution via merge with user-controlled input",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(Object\\.assign\\s*\\(\\s*\\w+\\s*,\\s*(req|request|body|params|query)|_\\.merge\\s*\\(\\s*\\w+\\s*,\\s*(req|request))",
+    "flags": "gi"
+  },
+  "examples": ["Object.assign(config, req.body)", "_.merge(target, request.body)"],
+  "appliesTo": {
+    "extensions": [".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]
+  }
+}

package/web-ui/rules/code-flaws/regex-redos-backtrack.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/regex-redos-backtrack",
+  "name": "ReDoS via catastrophic backtracking pattern",
+  "category": "code_flaw",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\((?:\\?:)?(?:\\\\.|\\[[^\\]]*\\]|[^\\\\()\\[\\]+*?|])[+*](?:(?:\\\\.|\\[[^\\]]*\\]|[^\\\\()\\[\\]+*?|])\\*)?\\)[+*]|\\((?:\\?:)?([^()|]+)\\|\\1\\)[+*]",
+    "flags": "g"
+  },
+  "examples": ["/(a+)+/", "/(\\w+\\s*)+/"]
+}

package/web-ui/rules/code-flaws/sql-inject-concat-dot.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/sql-inject-concat-dot",
+  "name": "SQL injection via string concatenation (PHP dot operator)",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "[\"'][^\\n]*?(select|insert|update|delete|drop|where)[^\\n]*?[\"']\\s*\\.",
+    "flags": "gi"
+  },
+  "appliesTo": {
+    "extensions": [".php"]
+  },
+  "examples": ["$query = \"SELECT * FROM orders WHERE user = \" . $username;"]
+}

package/web-ui/rules/code-flaws/sql-inject-concat.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/sql-inject-concat",
+  "name": "SQL injection via string concatenation",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "[\"']\\s*(?:select\\b[^\\n]*?\\bfrom\\b|insert\\s+into\\b|update\\s+\\S+\\s+set\\b|delete\\s+from\\b|drop\\s+(?:table|database)\\b|where\\b[^\\n]*?=)[^\\n]*?[\"']\\s*\\+",
+    "flags": "gi"
+  },
+  "examples": ["\"SELECT * FROM users WHERE id = \" + userId"]
+}

package/web-ui/rules/code-flaws/sql-inject-format.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "code-flaws/sql-inject-format",
+  "name": "SQL injection via format string or f-string",
+  "category": "code_flaw",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:select\\b[^\\n]*?\\bfrom\\b|insert\\s+into\\b|update\\s+\\S+\\s+set\\b|delete\\s+from\\b|drop\\s+(?:table|database)\\b|where\\b[^\\n]*?=)[^\\n]*?(?:[%][sd]|\\{[^}]+\\})",
+    "flags": "gi"
+  },
+  "examples": [
+    "f\"SELECT * FROM users WHERE id = {user_id}\"",
+    "\"SELECT * FROM users WHERE name = '%s'\" % name"
+  ]
+}