@blamejs/exceptd-skills 0.9.5 → 0.10.1

package/data/playbooks/secrets.json

@@ -0,0 +1,959 @@
+{
+  "_meta": {
+    "id": "secrets",
+    "version": "1.0.0",
+    "last_threat_review": "2026-05-11",
+    "threat_currency_score": 96,
+    "changelog": [
+      {
+        "version": "1.0.0",
+        "date": "2026-05-11",
+        "summary": "Initial seven-phase repo-scoped secret-exfiltration playbook. Walks the current repository to depth 6 (excluding node_modules, .git/objects, dist, build) for secret-shape regexes (AWS, GCP, GitHub, Slack, Stripe, JWT, SSH private keys, OpenAI, Anthropic), world-writable .env / .ssh files, and IaC files with embedded credentials. Closes the GRC loop with DLP framework-gap mapping + auditor-ready exception generation.",
+        "framework_gaps_updated": [
+          "nist-800-53-SC-28",
+          "iso-27001-2022-A.8.24",
+          "gdpr-art-32",
+          "pci-dss-4-req-3",
+          "soc2-cc6.1"
+        ]
+      }
+    ],
+    "owner": "@blamejs/grc",
+    "air_gap_mode": true,
+    "scope": "code",
+    "preconditions": [
+      {
+        "id": "repo-context",
+        "description": "Playbook runs against the current working directory tree. There must be a working directory and the agent must have read access to it.",
+        "check": "cwd_readable == true",
+        "on_fail": "halt"
+      },
+      {
+        "id": "regex-engine",
+        "description": "Host AI must support PCRE-equivalent regex for the catalogued secret patterns.",
+        "check": "agent_supports_pcre == true",
+        "on_fail": "warn"
+      }
+    ],
+    "mutex": [],
+    "feeds_into": [
+      {
+        "playbook_id": "cred-stores",
+        "condition": "finding.severity >= 'high'"
+      }
+    ]
+  },
+  "domain": {
+    "name": "Repository-scoped secret exfiltration risk",
+    "attack_class": "dlp-exfiltration",
+    "atlas_refs": [
+      "AML.T0055"
+    ],
+    "attack_refs": [
+      "T1552.001",
+      "T1552.004",
+      "T1552.005",
+      "T1078.004"
+    ],
+    "cve_refs": [],
+    "cwe_refs": [
+      "CWE-798",
+      "CWE-200",
+      "CWE-312",
+      "CWE-732"
+    ],
+    "d3fend_refs": [
+      "D3-CAA",
+      "D3-FCR"
+    ],
+    "frameworks_in_scope": [
+      "nist-800-53",
+      "iso-27001-2022",
+      "soc2",
+      "pci-dss-4",
+      "nis2",
+      "dora",
+      "uk-caf",
+      "hipaa"
+    ]
+  },
+  "phases": {
+    "govern": {
+      "jurisdiction_obligations": [
+        {
+          "jurisdiction": "EU",
+          "regulation": "GDPR Art.33",
+          "obligation": "notify_regulator",
+          "window_hours": 72,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "secret_inventory",
+            "data_subject_impact_assessment",
+            "containment_record"
+          ]
+        },
+        {
+          "jurisdiction": "EU",
+          "regulation": "GDPR Art.34",
+          "obligation": "notify_affected_individuals",
+          "window_hours": 72,
+          "clock_starts": "analyze_complete",
+          "evidence_required": [
+            "data_subject_categories_affected",
+            "containment_record"
+          ]
+        },
+        {
+          "jurisdiction": "EU",
+          "regulation": "NIS2 Art.23",
+          "obligation": "notify_regulator",
+          "window_hours": 24,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "secret_inventory",
+            "exposure_window_estimate",
+            "rotation_status"
+          ]
+        },
+        {
+          "jurisdiction": "UK",
+          "regulation": "UK GDPR Art.33",
+          "obligation": "notify_regulator",
+          "window_hours": 72,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "secret_inventory",
+            "data_subject_impact_assessment"
+          ]
+        },
+        {
+          "jurisdiction": "US-CA",
+          "regulation": "CCPA / CPRA Sec.1798.82",
+          "obligation": "notify_affected_individuals",
+          "window_hours": 1440,
+          "clock_starts": "analyze_complete",
+          "evidence_required": [
+            "california_resident_records_affected",
+            "containment_record"
+          ]
+        }
+      ],
+      "theater_fingerprints": [
+        {
+          "pattern_id": "gitleaks-in-ci-as-prevention",
+          "claim": "gitleaks / trufflehog runs in CI → no secrets in repo.",
+          "fast_detection_test": "Run a current scan against the repo HEAD and against the working tree (uncommitted files). CI catches committed-and-pushed secrets only. Uncommitted .env files, files in .gitignore, secrets in build artifacts under dist/, and IaC files staged-but-not-committed are all outside CI scope. Find any non-empty .env, .env.local, .npmrc, .pypirc, or terraform.tfvars in the working tree to verify.",
+          "implicated_controls": [
+            "nist-800-53-SA-11",
+            "soc2-cc7.1",
+            "iso-27001-2022-A.8.28"
+          ]
+        },
+        {
+          "pattern_id": "vault-attested-but-bypassed",
+          "claim": "We use Vault / Secrets Manager / KMS — no static credentials.",
+          "fast_detection_test": "Grep the working tree for AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS pointing to a JSON file, ANTHROPIC_API_KEY, OPENAI_API_KEY, GITHUB_TOKEN literals. Vault-attested orgs commonly bypass for 'just this one dev workflow' or 'CI bootstrap secrets'. Any non-templated secret in the working tree is theater regardless of Vault posture.",
+          "implicated_controls": [
+            "nist-800-53-SC-12",
+            "iso-27001-2022-A.8.24",
+            "pci-dss-4-req-3"
+          ]
+        },
+        {
+          "pattern_id": "pre-commit-hook-as-control",
+          "claim": "Pre-commit hooks catch secrets before commit.",
+          "fast_detection_test": "Check whether the repo's .pre-commit-config.yaml / lefthook.yml / husky config actually invokes a secret-scan tool AND whether the team has ever bypassed via --no-verify (visible in git log for repos with verified commits or in the reflog). Pre-commit is bypassable; pre-receive (server-side) is not. If only pre-commit exists, the control is advisory.",
+          "implicated_controls": [
+            "soc2-cc7.1",
+            "iso-27001-2022-A.8.28"
+          ]
+        }
+      ],
+      "framework_context": {
+        "gap_summary": "Secret scanning frameworks (DLP, GDPR Art.32, ISO A.8.24 cryptographic key management, PCI-DSS 4.0 Req.3, SOC 2 CC6.1) target storage + transit protection of sensitive data. They do not name 'committed/staged secrets in source-controlled repositories' as a distinct control class. NIS2 Art.21(2)(j) names cryptography but not key-material exposure in development artifacts. Real-world: GitGuardian's 2025 report flagged ~24M secrets leaked to public GitHub in 2024 alone — the dominant data-exfil vector is not the storage backend but the development workflow. SCOPE OF THIS SCAN: self-scoped to current working directory tree, depth 6, excluding node_modules, .git/objects, dist, build. Working-tree scan complements (does not replace) git-history scans done by gitleaks/trufflehog in CI. This is a point-in-time triage of what an attacker with read access to the working copy would find.",
+        "lag_score": 30,
+        "per_framework_gaps": [
+          {
+            "framework": "nist-800-53",
+            "control_id": "SC-28",
+            "designed_for": "Protection of information at rest — encryption + access control.",
+            "insufficient_because": "Names storage protections; assumes secret material lives in designated stores. Does not contemplate plaintext secret leakage into developer working trees + IaC source files + CI configuration files."
+          },
+          {
+            "framework": "iso-27001-2022",
+            "control_id": "A.8.24",
+            "designed_for": "Use of cryptography — key lifecycle management.",
+            "insufficient_because": "Manages keys-in-stores; silent on key-material-leaked-to-source-code. Audit evidence is typically a key inventory + rotation schedule, neither of which surfaces committed secrets."
+          },
+          {
+            "framework": "pci-dss-4",
+            "control_id": "Req.3.5",
+            "designed_for": "Cryptographic key protection — keys stored separately from data they protect.",
+            "insufficient_because": "Targets cardholder-data-encryption keys; does not cover API tokens / OAuth client secrets / cloud access keys that live in developer working trees."
+          },
+          {
+            "framework": "soc2",
+            "control_id": "CC6.1",
+            "designed_for": "Logical access controls — restrict logical access to data + system resources.",
+            "insufficient_because": "Logical access is about who can authenticate. Says nothing about where credentials are stored on disk in developer workflows."
+          },
+          {
+            "framework": "hipaa",
+            "control_id": "164.312(a)(2)(iv)",
+            "designed_for": "Encryption + decryption — mechanism to encrypt and decrypt ePHI.",
+            "insufficient_because": "Targets encryption mechanism, not key material storage in source artifacts."
+          }
+        ]
+      },
+      "skill_preload": [
+        "dlp-gap-analysis",
+        "framework-gap-analysis",
+        "compliance-theater",
+        "policy-exception-gen"
+      ]
+    },
+    "direct": {
+      "threat_context": "Secret-in-repo is the #1 cause of cloud account compromise in 2025-2026 IR data. AI-coding-assistant adoption has accelerated the rate: AI assistants generate boilerplate that embeds API keys directly (Anthropic's own published guidance warns against this). GitGuardian Q1 2026 report: ~7.2M secrets leaked to public GitHub in Q1 alone, with OpenAI and Anthropic API keys representing the fastest-growing leak categories. Attack pattern: scraper bots monitor GitHub firehose for committed secrets within minutes of push; AWS keys are exploited within ~5 minutes of public exposure, often before the developer notices the commit. Working-tree scan (this playbook) catches the pre-commit window AND uncommitted secrets that CI scanners miss entirely (build artifacts, .env files in .gitignore, IaC tfvars files, .npmrc auth tokens).",
+      "rwep_threshold": {
+        "escalate": 85,
+        "monitor": 60,
+        "close": 30
+      },
+      "framework_lag_declaration": "GDPR Art.32, ISO A.8.24, PCI-DSS Req.3, SOC 2 CC6.1 collectively cover encryption + key management + access control in production storage backends. None of them name 'secret in source artifact' as a distinct exposure category, despite this being the dominant 2025-2026 cloud-compromise vector. NIS2 Art.21(2)(j) names cryptography but not development-workflow exposure. Gap = ~30 days between developer commit and framework's quarterly access-review cadence; in practice, scraper bots exploit faster than any framework cadence.",
+      "skill_chain": [
+        {
+          "skill": "dlp-gap-analysis",
+          "purpose": "Inventory secret-shape findings in the working tree; assess exposure window; map to provider-specific rotation procedures.",
+          "required": true
+        },
+        {
+          "skill": "framework-gap-analysis",
+          "purpose": "Map findings to which framework controls claim to address secret protection and where the gap is.",
+          "required": true
+        },
+        {
+          "skill": "compliance-theater",
+          "purpose": "Run the theater test on the org's secret-scanning attestation (CI gitleaks + Vault posture).",
+          "required": true
+        },
+        {
+          "skill": "policy-exception-gen",
+          "purpose": "Generate auditor-ready exception language for secrets that cannot be rotated immediately (e.g. requires coordinated multi-system rotation).",
+          "skip_if": "close.exception_generation.trigger_condition == false",
+          "required": false
+        }
+      ],
+      "token_budget": {
+        "estimated_total": 19000,
+        "breakdown": {
+          "govern": 2600,
+          "direct": 1600,
+          "look": 2400,
+          "detect": 3000,
+          "analyze": 4000,
+          "validate": 3000,
+          "close": 2400
+        }
+      }
+    },
+    "look": {
+      "artifacts": [
+        {
+          "id": "repo-tree",
+          "type": "file",
+          "source": "Walk cwd to depth 6, exclude **/node_modules/**, **/.git/objects/**, **/dist/**, **/build/**",
+          "description": "Repository file tree within scope. The entry list bounds every subsequent regex scan.",
+          "required": true,
+          "air_gap_alternative": "Use native filesystem walk; no network required."
+        },
+        {
+          "id": "env-files",
+          "type": "file",
+          "source": "Walk for filenames matching .env, .env.*, .envrc, *.env, .env.local, .env.production, .env.development",
+          "description": "Environment files. Standard secret-carrier in modern dev workflows.",
+          "required": true
+        },
+        {
+          "id": "auth-config-files",
+          "type": "file",
+          "source": "Walk for filenames .npmrc, .pypirc, .netrc, .git-credentials, .docker/config.json, .yarnrc.yml, .yarnrc, settings.xml, gradle.properties",
+          "description": "Package manager / VCS auth config files commonly containing tokens.",
+          "required": true
+        },
+        {
+          "id": "ssh-private-keys",
+          "type": "file",
+          "source": "Walk for filenames id_rsa, id_ed25519, id_ecdsa, id_dsa, *.pem, *.key, *.p12, *.pfx (excluding *.pub)",
+          "description": "Private key material. Even encrypted private keys are findings (offline brute-force surface).",
+          "required": true
+        },
+        {
+          "id": "iac-credential-bearers",
+          "type": "file",
+          "source": "Walk for *.tf, *.tfvars, *.tfvars.json, terraform.tfstate, pulumi.*.yaml, *.bicep, *.arm.json, ansible playbooks (*.yml + *.yaml in roles/group_vars/host_vars), helm values.yaml, k8s secret.yaml",
+          "description": "Infrastructure-as-code files frequently containing embedded credentials.",
+          "required": true
+        },
+        {
+          "id": "secret-regex-scan-text-files",
+          "type": "file",
+          "source": "For every text file in scope: grep against the catalogued secret patterns (AWS, GCP, GitHub, Slack, Stripe, JWT, OpenAI, Anthropic) — see detect.indicators for the regex set.",
+          "description": "Full-content regex scan against the working tree. Produces match locations + surrounding context for each finding.",
+          "required": true
+        },
+        {
+          "id": "world-writable-secret-files",
+          "type": "file",
+          "source": "For every file matched by env-files OR auth-config-files OR ssh-private-keys: stat for world-writable (perm o+w) OR world-readable (perm o+r) on .ssh contents.",
+          "description": "Permission posture on secret-carrier files. .ssh/id_* should be 0600; .env should not be world-readable.",
+          "required": true
+        }
+      ],
+      "collection_scope": {
+        "time_window": "current",
+        "asset_scope": "current_repository_working_tree",
+        "depth": "deep",
+        "sampling": "complete walk of cwd to depth 6 with named exclusions; no sampling — every file in scope is scanned"
+      },
+      "environment_assumptions": [
+        {
+          "assumption": "cwd is a development repository (not a deployed production filesystem)",
+          "if_false": "If cwd is a deployed-app filesystem, regex set still applies but interpretation changes: secrets at runtime in /etc, /opt, /home are operationally normal (Vault agent caches, kubelet service-account tokens). Mark such findings as 'deployed-runtime' class and defer to cred-stores playbook for proper treatment."
+        },
+        {
+          "assumption": "agent has read access to all files in cwd",
+          "if_false": "Some files unreadable (different UID, ACL). Mark per-file inconclusive rather than treating absence as clean."
+        },
+        {
+          "assumption": "cwd is under reasonable depth (large monorepos may exceed scope at depth 6)",
+          "if_false": "Files at depth > 6 are excluded. Emit a 'scope-truncated' visibility note. Operator may re-run with --depth flag if needed."
+        },
+        {
+          "assumption": "host filesystem supports POSIX permission bits (not Windows ACL-only)",
+          "if_false": "On Windows, world-writable check is replaced with Everyone:Write ACL check; same conceptual finding but different artifact shape."
+        }
+      ],
+      "fallback_if_unavailable": [
+        {
+          "artifact_id": "repo-tree",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "env-files",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "auth-config-files",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "ssh-private-keys",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "iac-credential-bearers",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "secret-regex-scan-text-files",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "world-writable-secret-files",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        }
+      ]
+    },
+    "detect": {
+      "indicators": [
+        {
+          "id": "aws-access-key-id",
+          "type": "log_pattern",
+          "value": "AKIA[0-9A-Z]{16}",
+          "description": "AWS Access Key ID. Long-lived IAM user credential. Scraper-bot priority target.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "aws-secret-access-key",
+          "type": "log_pattern",
+          "value": "(?i)aws_secret_access_key[\"']?\\s*[:=]\\s*[\"']?[A-Za-z0-9/+=]{40}[\"']?",
+          "description": "AWS Secret Access Key. Always findable in tandem with AKIA*. Independent finding because both halves are needed.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "gcp-service-account-json",
+          "type": "log_pattern",
+          "value": "\"type\"\\s*:\\s*\"service_account\"[^{}]*\"private_key\"\\s*:\\s*\"-----BEGIN PRIVATE KEY-----",
+          "description": "GCP service account JSON file with embedded private key. Plaintext key material.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.004"
+        },
+        {
+          "id": "github-personal-access-token",
+          "type": "log_pattern",
+          "value": "gh[ps]_[A-Za-z0-9]{36}",
+          "description": "GitHub Personal Access Token (ghp_) or Server Token (ghs_).",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "github-fine-grained-pat",
+          "type": "log_pattern",
+          "value": "github_pat_[A-Za-z0-9_]{82}",
+          "description": "GitHub fine-grained personal access token.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "slack-bot-or-user-token",
+          "type": "log_pattern",
+          "value": "xox[baprs]-[A-Za-z0-9-]{10,}",
+          "description": "Slack bot / user / refresh / app token.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "stripe-secret-key",
+          "type": "log_pattern",
+          "value": "sk_(live|test)_[A-Za-z0-9]{24,}",
+          "description": "Stripe live or test secret key. Live keys are direct financial exposure.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "jwt-token-with-secret-context",
+          "type": "log_pattern",
+          "value": "eyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}",
+          "description": "JWT (header.payload.signature). May or may not be sensitive depending on signing context; surface for triage.",
+          "confidence": "medium",
+          "deterministic": false,
+          "attack_ref": "T1552.004"
+        },
+        {
+          "id": "ssh-private-key-block",
+          "type": "log_pattern",
+          "value": "-----BEGIN ((RSA|EC|DSA|OPENSSH|ENCRYPTED) )?PRIVATE KEY-----",
+          "description": "Inline SSH/PEM private key material in a text file.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.004"
+        },
+        {
+          "id": "openai-api-key",
+          "type": "log_pattern",
+          "value": "sk-(proj-)?[A-Za-z0-9_-]{40,}",
+          "description": "OpenAI API key (incl. project-scoped sk-proj-* form). Active key spend exposure.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "anthropic-api-key",
+          "type": "log_pattern",
+          "value": "sk-ant-(api03|admin01)-[A-Za-z0-9_-]{80,}",
+          "description": "Anthropic API key. Active key spend exposure.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "world-writable-env-file",
+          "type": "file_path",
+          "value": ".env / .env.* / .envrc with mode 0666 or 0664 (group/world writable)",
+          "description": "Env file writable by group or world. Tampering primitive.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.001"
+        },
+        {
+          "id": "ssh-key-bad-perms",
+          "type": "file_path",
+          "value": "~/.ssh/id_* file with mode != 0600",
+          "description": "SSH private key with permissive permissions. ssh-agent refuses to load; user often chmods to 0644 or 0666 'to make it work'.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1552.004"
+        }
+      ],
+      "false_positive_profile": [
+        {
+          "indicator_id": "aws-access-key-id",
+          "benign_pattern": "AKIA-shaped string in test fixtures, documentation, or sample-data files (e.g. AKIAIOSFODNN7EXAMPLE — AWS's own published example).",
+          "distinguishing_test": "Check whether the exact string equals one of the published AWS example keys (AKIAIOSFODNN7EXAMPLE is the canonical). If yes, suppress as known-test. Otherwise check whether the secret-half also resolves (call sts:GetCallerIdentity if network available; in air-gap mode, treat as deterministic finding regardless)."
+        },
+        {
+          "indicator_id": "jwt-token-with-secret-context",
+          "benign_pattern": "JWT example token from documentation, OIDC discovery flows, test fixtures.",
+          "distinguishing_test": "Decode the JWT header + payload (base64 decode; no signature verification needed). If 'iss' / 'aud' / 'sub' claims point to test/example/localhost issuers OR the token's 'exp' is in the past, downgrade to low confidence. Real production JWTs targeting prod issuers stay high."
+        },
+        {
+          "indicator_id": "ssh-private-key-block",
+          "benign_pattern": "Test fixture private keys used in unit/integration tests (e.g. cryptography library test vectors).",
+          "distinguishing_test": "Check filename context (path contains /test/, /__tests__/, /fixtures/, /spec/) AND check whether the key has a corresponding .pub fixture in the same directory. If both heuristics match AND the key bits match a known test-vector hash, downgrade to medium. Otherwise hold deterministic."
+        },
+        {
+          "indicator_id": "openai-api-key",
+          "benign_pattern": "sk- prefix is also used by Stripe (sk_live_, sk_test_) and other vendors; loose regex may collide.",
+          "distinguishing_test": "OpenAI keys are sk-[A-Za-z0-9_-]{40,} OR sk-proj-[A-Za-z0-9_-]{40,}; Stripe keys are sk_live_ / sk_test_ with underscores after sk. Pattern boundary on the third character (-/underscore) distinguishes deterministically."
+        },
+        {
+          "indicator_id": "github-personal-access-token",
+          "benign_pattern": "Revoked tokens left in old code or in security training materials.",
+          "distinguishing_test": "GitHub PATs have a checksum in the last 6 characters. Verify checksum if doing offline. If checksum valid, the token was real at issuance time; even if revoked, treat as finding because revocation status cannot be verified in air-gap mode. If checksum invalid, downgrade to low."
+        }
+      ],
+      "minimum_signal": {
+        "detected": "At least one deterministic indicator fires AND the false-positive distinguishing test does not clear it.",
+        "inconclusive": "Match found but distinguishing test cannot be performed in air-gap mode (e.g. cannot call sts:GetCallerIdentity to confirm AWS key validity). Treat as detected with the caveat noted.",
+        "not_detected": "Full repo walk completed AND zero deterministic patterns matched AND no high-confidence patterns matched AND no world-writable secret files AND .ssh keys (if present) have mode 0600."
+      }
+    },
+    "analyze": {
+      "rwep_inputs": [
+        {
+          "signal_id": "aws-access-key-id",
+          "rwep_factor": "active_exploitation",
+          "weight": 30,
+          "notes": "Scraper bots monetize within minutes of public exposure. Treat as exploitation-imminent."
+        },
+        {
+          "signal_id": "aws-access-key-id",
+          "rwep_factor": "ai_weaponization",
+          "weight": 10,
+          "notes": "AI-powered scrapers triage and weaponize at scale."
+        },
+        {
+          "signal_id": "gcp-service-account-json",
+          "rwep_factor": "active_exploitation",
+          "weight": 30,
+          "notes": "Same as AWS."
+        },
+        {
+          "signal_id": "github-personal-access-token",
+          "rwep_factor": "active_exploitation",
+          "weight": 25,
+          "notes": "PAT exposure = repo + CI compromise + supply chain pivot."
+        },
+        {
+          "signal_id": "openai-api-key",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Spend abuse is automatic; AI account compromise extends to fine-tunes / files / projects in account."
+        },
+        {
+          "signal_id": "anthropic-api-key",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Same as OpenAI."
+        },
+        {
+          "signal_id": "ssh-private-key-block",
+          "rwep_factor": "blast_radius",
+          "weight": 20,
+          "notes": "Inline private key = lateral movement primitive."
+        },
+        {
+          "signal_id": "world-writable-env-file",
+          "rwep_factor": "blast_radius",
+          "weight": 15,
+          "notes": "Tampering primitive on dev workstation; supply-chain implications if CI pulls from same path."
+        },
+        {
+          "signal_id": "ssh-key-bad-perms",
+          "rwep_factor": "blast_radius",
+          "weight": 10,
+          "notes": "Permission flaw enables credential theft by any local user."
+        }
+      ],
+      "blast_radius_model": {
+        "scope_question": "Given the secret(s) found in the working tree, what is the blast radius if this repo (or its working copy) is read by an unauthorized party?",
+        "scoring_rubric": [
+          {
+            "condition": "Single test/expired/example credential matched with FP distinguishing test passing",
+            "blast_radius_score": 1,
+            "description": "False-positive shaped match; no live exposure."
+          },
+          {
+            "condition": "Single non-production credential (test env, sandbox account) confirmed live",
+            "blast_radius_score": 2,
+            "description": "Sandbox-scope compromise. Cleanup required but limited."
+          },
+          {
+            "condition": "Single production credential confirmed live (or unconfirmed but production-shaped) on a single-cloud or single-vendor account",
+            "blast_radius_score": 3,
+            "description": "Production single-account compromise. Spend + data exposure within that account's IAM scope."
+          },
+          {
+            "condition": "Production credential AND credential has broad IAM scope (admin / wildcard / service-account JSON with project owner)",
+            "blast_radius_score": 4,
+            "description": "Cloud-account-wide compromise. Data exfil + resource creation + lateral to other tenants."
+          },
+          {
+            "condition": "Multiple production credentials AND credentials span identity layers (cloud + SaaS + SCM) AND repo is or was public",
+            "blast_radius_score": 5,
+            "description": "Org-wide identity boundary collapse. Treat as confirmed incident."
+          }
+        ]
+      },
+      "compliance_theater_check": {
+        "claim": "Org runs gitleaks/trufflehog in CI + uses Vault for runtime secrets → no exposed secrets.",
+        "audit_evidence": "CI logs showing secret-scanner runs; Vault audit log showing secret retrievals.",
+        "reality_test": "Run a working-tree scan today (this playbook). Count: (a) secrets in tracked files that CI missed, (b) secrets in .gitignore'd files that CI cannot see at all, (c) secrets in dist/ build/ artifacts that CI scanned source but not build, (d) world-writable .env files. Any count > 0 is gap between CI-attested clean state and actual working-tree state. Additionally cross-reference any matched OpenAI/Anthropic key against Vault's secret inventory — if the key is not in Vault, the 'Vault for runtime secrets' attestation is incomplete.",
+        "theater_verdict_if_gap": "CI-only secret scanning misses the dominant exposure paths (uncommitted, gitignored, build-artifact, IaC tfvars). Either (a) extend scanning to working tree + build output + IaC files, (b) require Vault-templated secret consumption with pre-commit blocking on raw literals, OR (c) generate policy exception documenting the scope gap + compensating controls + remediation timeline."
+      },
+      "framework_gap_mapping": [
+        {
+          "finding_id": "secret-in-repo",
+          "framework": "nist-800-53",
+          "claimed_control": "SC-28 — Protection of Information at Rest",
+          "actual_gap": "Targets designated storage. Does not name source-control working trees as 'at-rest' for sensitive data. Permits attestation focused on production storage encryption.",
+          "required_control": "Extend SC-28 scope to source artifacts. Require evidence that secrets are not present in working-tree files (env, IaC, package configs) at any time, with continuous attestation."
+        },
+        {
+          "finding_id": "secret-in-repo",
+          "framework": "iso-27001-2022",
+          "claimed_control": "A.8.24 — Use of Cryptography",
+          "actual_gap": "Key lifecycle management focuses on key-in-store. Silent on key-material-in-source.",
+          "required_control": "Add a footnote requiring inventory of credentials present in source artifacts AND evidence of removal prior to commit + at point of working-tree creation."
+        },
+        {
+          "finding_id": "secret-in-repo",
+          "framework": "pci-dss-4",
+          "claimed_control": "Req.3.5 — Cryptographic Key Protection",
+          "actual_gap": "Cardholder-data-encryption keys only. API tokens / cloud keys handling cardholder-data-adjacent operations outside scope.",
+          "required_control": "Extend Req.3 to all credentials granting access to systems within CDE, including cloud-API tokens that could pivot to CDE."
+        },
+        {
+          "finding_id": "secret-in-repo",
+          "framework": "soc2",
+          "claimed_control": "CC6.1 — Logical Access Controls",
+          "actual_gap": "Authentication-shaped, not credential-storage-shaped.",
+          "required_control": "Add a CC6 sub-criterion requiring evidence that credentials granting logical access are not exposed in source-controlled artifacts."
+        }
+      ],
+      "escalation_criteria": [
+        {
+          "condition": "rwep >= 90 AND credential_appears_live == true",
+          "action": "page_on_call"
+        },
+        {
+          "condition": "blast_radius_score >= 4",
+          "action": "trigger_playbook",
+          "target_playbook": "cred-stores"
+        },
+        {
+          "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'",
+          "action": "notify_legal"
+        },
+        {
+          "condition": "any_secret_in_committed_history == true",
+          "action": "raise_severity"
+        }
+      ]
+    },
+    "validate": {
+      "remediation_paths": [
+        {
+          "id": "rotate-and-purge",
+          "description": "(1) Rotate the credential at the provider (AWS IAM, GCP, GitHub, Slack, Stripe, OpenAI, Anthropic), (2) revoke any sessions tied to the old credential, (3) remove the literal from the working tree + replace with a Vault/Secrets Manager template, (4) if the credential ever entered git history, BFG / git-filter-repo the history AND notify any forks/mirrors.",
+          "preconditions": [
+            "provider_supports_revocation == true",
+            "rotation_ownership_identified == true"
+          ],
+          "priority": 1,
+          "compensating_controls": [
+            "session-revocation",
+            "cloudtrail-or-audit-log-review-for-misuse-window"
+          ],
+          "estimated_time_hours": 2
+        },
+        {
+          "id": "fix-file-permissions",
+          "description": "For world-writable .env / .ssh / auth-config files: chmod 0600 (private keys) or 0640 (env files). For SSH key with bad perms: chmod 0600 and re-load via ssh-add.",
+          "preconditions": [
+            "file_owner_is_current_user OR has_sudo == true"
+          ],
+          "priority": 2,
+          "compensating_controls": [
+            "perm-change-recorded"
+          ],
+          "estimated_time_hours": 0.5
+        },
+        {
+          "id": "tighten-prevention",
+          "description": "Install pre-commit hook + pre-receive server-side hook running gitleaks/trufflehog. Add .gitignore entries for env/auth-config files. Add CI step scanning build artifacts under dist/build.",
+          "preconditions": [
+            "repo_governance_authority == true"
+          ],
+          "priority": 2,
+          "compensating_controls": [
+            "pre-commit-config-versioned",
+            "ci-config-versioned"
+          ],
+          "estimated_time_hours": 2
+        },
+        {
+          "id": "policy-exception",
+          "description": "If rotation requires coordinated multi-system rollout (e.g. credential is consumed by 50+ services), generate exception with bounded duration + compensating audit-log monitoring.",
+          "preconditions": [
+            "coordinated_rotation_required == true",
+            "credential_misuse_monitoring_in_place == true"
+          ],
+          "priority": 4,
+          "compensating_controls": [
+            "enhanced-audit-log-alerting-on-credential",
+            "incident-response-team-on-standby"
+          ],
+          "estimated_time_hours": 24
+        }
+      ],
+      "validation_tests": [
+        {
+          "id": "regex-rescan-clean",
+          "test": "Re-run the working-tree regex scan post-remediation. Expect zero deterministic-confidence findings.",
+          "expected_result": "No deterministic matches; any remaining medium/low matches passed FP distinguishing tests.",
+          "test_type": "negative"
+        },
+        {
+          "id": "credential-revoked-at-provider",
+          "test": "At the provider (AWS IAM list-access-keys / GitHub /user/token endpoints / OpenAI revoke list / etc.), confirm the old credential's status is revoked/inactive AND the new credential is active.",
+          "expected_result": "Old credential inactive; new credential active.",
+          "test_type": "functional"
+        },
+        {
+          "id": "audit-log-shows-no-misuse",
+          "test": "Review provider audit log (CloudTrail / GitHub Audit / OpenAI usage history) for the credential's full lifetime. Confirm no anomalous activity in the exposure window.",
+          "expected_result": "No anomalous activity from unexpected IPs/UAs/regions.",
+          "test_type": "functional"
+        },
+        {
+          "id": "permissions-correct",
+          "test": "stat -c '%a' on remediated files. Expect 0600 for private keys, 0640 or 0600 for env files.",
+          "expected_result": "All secret-carrier files have correct permissions.",
+          "test_type": "negative"
+        },
+        {
+          "id": "preventive-control-active",
+          "test": "Verify pre-commit hook exists, is executable, and the secret scanner is invoked. Attempt to commit a known-test-pattern (e.g. AKIAIOSFODNN7EXAMPLE) and confirm hook blocks.",
+          "expected_result": "Pre-commit hook blocks test pattern.",
+          "test_type": "functional"
+        }
+      ],
+      "residual_risk_statement": {
+        "risk": "Even after rotation + purge + hook installation, the prior credential may have been scraped during the exposure window. The credential is revoked, but any data exfiltrated during the window is gone.",
+        "why_remains": "Credential exposure is irreversible at the data-exfil level. Revocation prevents future misuse but does not undo prior misuse. Audit log review establishes upper bound on misuse but cannot prove negative for all classes (e.g. provider API calls within normal-looking patterns).",
+        "acceptance_level": "ciso",
+        "compensating_controls_in_place": [
+          "credential-rotated",
+          "session-revoked",
+          "audit-log-baseline-captured",
+          "pre-commit-hook-active",
+          "ci-secret-scan-extended-to-build-artifacts"
+        ]
+      },
+      "evidence_requirements": [
+        {
+          "evidence_type": "scan_report",
+          "description": "Pre-remediation full working-tree scan output with file paths + line offsets + matched indicator IDs + RWEP per finding. Plus post-remediation rescan showing clean state.",
+          "retention_period": "7_years",
+          "framework_satisfied": [
+            "gdpr-art-32",
+            "iso-27001-2022-A.8.24",
+            "soc2-cc6.1",
+            "pci-dss-4-req-3"
+          ]
+        },
+        {
+          "evidence_type": "log_excerpt",
+          "description": "Provider audit log excerpt for the exposure window for each rotated credential.",
+          "retention_period": "7_years",
+          "framework_satisfied": [
+            "gdpr-art-33",
+            "soc2-cc7.2",
+            "nis2-art21-2c"
+          ]
+        },
+        {
+          "evidence_type": "ticket_reference",
+          "description": "Rotation ticket(s) with timestamps, approvers, provider rotation confirmation IDs.",
+          "retention_period": "7_years",
+          "framework_satisfied": [
+            "soc2-cc8.1",
+            "iso-27001-2022-A.8.32"
+          ]
+        },
+        {
+          "evidence_type": "attestation",
+          "description": "Signed exceptd attestation: repo identity, scan timestamp, finding count, RWEP at detection, RWEP post-remediation, rotated credential IDs (hashed).",
+          "retention_period": "7_years",
+          "framework_satisfied": [
+            "nist-800-53-CA-7",
+            "iso-27001-2022-A.5.36",
+            "nis2-art21-2c"
+          ]
+        }
+      ],
+      "regression_trigger": [
+        {
+          "condition": "pre_commit",
+          "interval": "on_event"
+        },
+        {
+          "condition": "weekly",
+          "interval": "7d"
+        },
+        {
+          "condition": "post_dependency_update",
+          "interval": "on_event"
+        },
+        {
+          "condition": "new_secret_pattern_published",
+          "interval": "on_event"
+        }
+      ]
+    },
+    "close": {
+      "evidence_package": {
+        "bundle_format": "json",
+        "contents": [
+          "scan_report",
+          "log_excerpt",
+          "ticket_reference",
+          "attestation",
+          "framework_gap_mapping",
+          "compliance_theater_verdict",
+          "residual_risk_statement"
+        ],
+        "destination": "local_only",
+        "signed": true
+      },
+      "learning_loop": {
+        "enabled": true,
+        "lesson_template": {
+          "attack_vector": "Credential exposure via $secret_class ($provider) committed/staged in working tree / IaC source / build artifact / world-writable env file.",
+          "control_gap": "Secret-scanning controls scoped to git history miss the working-tree, gitignored-file, build-artifact, and IaC-tfvars exposure paths. Vault-attested key management coexists with developer-workflow bypass.",
+          "framework_gap": "GDPR Art.32 / ISO A.8.24 / PCI Req.3 / SOC 2 CC6.1 + NIS2 Art.21(2)(j) collectively cover storage backend protection. None name source-artifact exposure as a distinct control class.",
+          "new_control_requirement": "Continuous working-tree scanning + pre-commit + pre-receive secret blocking + build-artifact scan + Vault-templated secret enforcement. Source-artifact exposure becomes its own control class with quarterly attestation requirement."
+        },
+        "feeds_back_to_skills": [
+          "dlp-gap-analysis",
+          "framework-gap-analysis",
+          "compliance-theater"
+        ]
+      },
+      "notification_actions": [
+        {
+          "obligation_ref": "EU/GDPR Art.33 72h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "secret_inventory",
+            "data_subject_impact_assessment",
+            "containment_record"
+          ],
+          "draft_notification": "GDPR Art.33 72-hour notification: Credential exposure event affecting ${credential_count} credential(s) of type ${credential_class}. Exposure window: ${exposure_window}. Affected processing operations: ${processing_operations}. Categories of data subjects potentially affected: ${data_subject_categories}. Containment actions: credentials rotated, sessions revoked, audit logs reviewed for misuse. Risk assessment: ${risk_level}. No notification to data subjects required because ${art34_reasoning} OR notification to data subjects required and being prepared. Contact: ${dpo_contact}."
+        },
+        {
+          "obligation_ref": "EU/GDPR Art.34 72h",
+          "deadline": "computed_at_runtime",
+          "recipient": "data_subjects",
+          "evidence_attached": [
+            "data_subject_categories_affected",
+            "containment_record"
+          ],
+          "draft_notification": "GDPR Art.34 notification to data subjects (draft for review): We are writing to inform you of a credential exposure incident affecting systems that process your personal data. Affected systems: ${affected_systems}. Exposure window: ${exposure_window}. Containment actions completed: credentials rotated and revoked, audit logs reviewed. Steps you can take: ${recommended_actions}. Our DPO can be reached at ${dpo_contact}."
+        },
+        {
+          "obligation_ref": "EU/NIS2 Art.23 24h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "secret_inventory",
+            "exposure_window_estimate",
+            "rotation_status"
+          ],
+          "draft_notification": "NIS2 Art.23 early-warning notification: Credential exposure ${credential_class} on ${affected_system_count} system(s). Suspected window of exposure: ${exposure_window}. Initial containment: credentials rotated. Full incident assessment within 72h per Art.23(4)."
+        },
+        {
+          "obligation_ref": "UK/UK GDPR Art.33 72h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "secret_inventory",
+            "data_subject_impact_assessment"
+          ],
+          "draft_notification": "UK GDPR Art.33 72-hour notification to ICO: Credential exposure event. Mirror of GDPR Art.33 notification body, addressed to ICO casework team."
+        },
+        {
+          "obligation_ref": "US-CA/CCPA / CPRA Sec.1798.82 1440h",
+          "deadline": "computed_at_runtime",
+          "recipient": "data_subjects",
+          "evidence_attached": [
+            "california_resident_records_affected",
+            "containment_record"
+          ],
+          "draft_notification": "California breach notification: We are writing to notify you of a security incident that may have affected your personal information. ${incident_description}. ${types_of_information_affected}. ${steps_taken}. ${steps_individuals_can_take}. ${contact_information}."
+        }
+      ],
+      "exception_generation": {
+        "trigger_condition": "coordinated_rotation_required == true OR (credential_class == 'high_blast_radius' AND rotation_eta > obligation_window)",
+        "exception_template": {
+          "scope": "Credential of class ${credential_class} (${credential_id_hash}) cannot be rotated within ${obligation_window} due to ${blocking_reason}.",
+          "duration": "until_vendor_patch",
+          "compensating_controls": [
+            "enhanced-audit-log-alerting-on-credential-use",
+            "incident-response-team-on-standby",
+            "ip-allowlist-tightened-on-credential",
+            "rate-limit-on-credential-tightened"
+          ],
+          "risk_acceptance_owner": "ciso",
+          "auditor_ready_language": "Pursuant to ${framework_id} ${control_id}, the organization documents a time-bound risk acceptance for unrotated credential ${credential_class} (${credential_id_hash}) on ${affected_system_count} system(s). Blocking reason: ${blocking_reason_narrative}. Rotation ETA: ${rotation_eta}. Compensating controls in place: ${compensating_controls}. Residual exposure: credential remains valid; provider audit logs are reviewed daily during the exception window for misuse indicators. Risk accepted by ${ciso_name} on ${acceptance_date}. Time-bound until ${duration_expiry} OR rotation completion, whichever is first. Detection coverage is provided by ${detection_controls}. The exception will be re-evaluated on (a) rotation completion, (b) listed expiry date, (c) any audit-log anomaly on the credential — whichever is first."
+        }
+      },
+      "regression_schedule": {
+        "next_run": "computed_at_runtime",
+        "trigger": "both",
+        "notify_on_skip": true
+      }
+    }
+  },
+  "directives": [
+    {
+      "id": "full-repo-secret-scan",
+      "title": "Full working-tree secret scan with all catalogued patterns + permission checks",
+      "applies_to": {
+        "always": true
+      }
+    },
+    {
+      "id": "high-velocity-credentials",
+      "title": "Targeted directive — AWS / GCP / GitHub / OpenAI / Anthropic high-velocity credentials",
+      "applies_to": {
+        "attack_technique": "T1552.001"
+      }
+    },
+    {
+      "id": "private-key-material",
+      "title": "Targeted directive — SSH/PEM private key material in working tree",
+      "applies_to": {
+        "attack_technique": "T1552.004"
+      }
+    }
+  ]
+}