@intentius/chant 0.57.0 → 0.58.0

package/src/audit/core.ts

@@ -22,7 +22,8 @@
 
 import { basename } from "path";
 import type { Severity } from "../lint/rule";
-import type { PostSynthCheck, PostSynthContext } from "../lint/post-synth";
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "../lint/post-synth";
+import { applyInlineSuppressions, type SuppressionMetaFinding } from "../lint/suppressions";
 import type { SerializerResult } from "../serializer";
 import type { LexiconPlugin } from "../lexicon";
 import type { Declarable } from "../declarable";
@@ -82,6 +83,8 @@ export interface AuditFinding {
    * itself.
    */
   fingerprint?: string;
+  /** Carried verbatim from the producing `PostSynthDiagnostic.missing` (chant #2113) — see its doc comment. */
+  missing?: { kind: string; scope: string };
 }
 
 /**
@@ -94,8 +97,10 @@ export type ChecksProvider = (lexicon: AuditLexicon) => Promise<PostSynthCheck[]
  * Parse one classified file's content into the lexicon's entity graph — the
  * parse-to-graph half of the audit (#1567). The returned map is what
  * `ctx.entities` holds during a build, so entity-reading checks run unchanged.
+ * May return a `Promise` for a lexicon whose parser is inherently async (e.g.
+ * terraform's HCL parser); `auditLexicon`'s `entitiesFor` awaits it.
  */
-export type EntitiesParser = (content: string) => Map<string, Declarable>;
+export type EntitiesParser = (content: string) => Map<string, Declarable> | Promise<Map<string, Declarable>>;
 
 /**
  * Resolve the entities parser for a lexicon (its plugin's `auditEntities`,
@@ -179,13 +184,25 @@ async function defaultEntitiesProvider(lexicon: AuditLexicon): Promise<EntitiesP
   return parser;
 }
 
+/**
+ * Mutable out-param for the inline (`# chant-ignore*`) suppression count
+ * (chant #2111): `auditFiles`'s return type stays `AuditFinding[]` for every
+ * existing caller, so a caller that wants the count (`chant audit`'s CLI, for
+ * its summary line) passes this in and reads `.count` back afterward, rather
+ * than `auditFiles` growing a `{findings, suppressedCount}` shape that would
+ * touch every existing call site.
+ */
+export interface SuppressionStats {
+  count: number;
+}
+
 /**
  * Audit a set of CI files and return all findings. Pure with respect to the
  * filesystem and network — callers supply file contents.
  */
 export async function auditFiles(
   inputs: AuditInput[],
-  opts: { checksProvider?: ChecksProvider; entitiesProvider?: EntitiesProvider } = {},
+  opts: { checksProvider?: ChecksProvider; entitiesProvider?: EntitiesProvider; suppressionStats?: SuppressionStats } = {},
 ): Promise<AuditFinding[]> {
   const provider = opts.checksProvider ?? defaultChecksProvider;
   const entitiesProvider = opts.entitiesProvider ?? defaultEntitiesProvider;
@@ -203,7 +220,7 @@ export async function auditFiles(
     const checks = await provider(lexicon);
     if (checks.length === 0) continue;
     const parseEntities = await entitiesProvider(lexicon);
-    findings.push(...auditLexicon(lexicon, files, checks, parseEntities));
+    findings.push(...(await auditLexicon(lexicon, files, checks, parseEntities, opts.suppressionStats)));
   }
 
   return findings;
@@ -224,14 +241,20 @@ function toOutput(file: AuditInput): string | SerializerResult {
   return { primary: file.content, files: { [basename(file.path)]: file.content } };
 }
 
+interface CheckRunResult {
+  diagnostics: PostSynthDiagnostic[];
+  suppressed: PostSynthDiagnostic[];
+  meta: SuppressionMetaFinding[];
+}
+
 function runChecks(
   checks: PostSynthCheck[],
   outputs: Map<string, string | SerializerResult>,
   entities: Map<string, Declarable> = new Map(),
-): ReturnType<PostSynthCheck["check"]> {
+): CheckRunResult {
   const buildResult: PostSynthContext["buildResult"] = { outputs, entities, warnings: [], errors: [], sourceFileCount: outputs.size };
   const ctx: PostSynthContext = { outputs, entities: buildResult.entities, buildResult };
-  const diags = [];
+  const diags: PostSynthDiagnostic[] = [];
   for (const check of checks) {
     try {
       diags.push(...check.check(ctx));
@@ -239,7 +262,11 @@ function runChecks(
       // A check that throws on unusual external YAML must not abort the audit.
     }
   }
-  return diags;
+  // chant #2111: `rules` (for `ignorable: false`) is omitted, since `chant audit`
+  // has no project `lint.rules` to read here (see `applyInlineSuppressions`'s
+  // doc comment for why that's a deliberate scope line, not an oversight), so
+  // every rule id reads as ignorable, same as an unconfigured one everywhere.
+  return applyInlineSuppressions(diags, entities);
 }
 
 function diagKey(d: { checkId: string; entity?: string; message: string }): string {
@@ -281,40 +308,57 @@ function mergeEntities(maps: Array<Map<string, Declarable>>): Map<string, Declar
  * the entity graph parsed from its files — per file for the per-file pass, all
  * files merged for the all-files pass — so entity-reading checks fire and
  * cross-file facts (an Agent's Environment declared elsewhere, a name declared
- * twice across the apply directory) resolve in the all-files pass.
+ * twice across the apply directory) resolve in the all-files pass. The parser
+ * may be async (a lexicon's own choice, e.g. a wasm-backed HCL parser); this
+ * function awaits each file's entities before either pass runs.
  */
-function auditLexicon(lexicon: AuditLexicon, files: AuditInput[], checks: PostSynthCheck[], parseEntities?: EntitiesParser): AuditFinding[] {
-  const entitiesFor = (file: AuditInput): Map<string, Declarable> => {
+async function auditLexicon(
+  lexicon: AuditLexicon,
+  files: AuditInput[],
+  checks: PostSynthCheck[],
+  parseEntities?: EntitiesParser,
+  suppressionStats?: SuppressionStats,
+): Promise<AuditFinding[]> {
+  const entitiesFor = async (file: AuditInput): Promise<Map<string, Declarable>> => {
     if (!parseEntities) return new Map();
     try {
-      return parseEntities(file.content);
+      return await parseEntities(file.content);
     } catch {
       // The audit contract is "runs against any repo" — unparseable content
       // contributes no entities, never a crash.
       return new Map();
     }
   };
-  const perEntities = new Map(files.map((f) => [f.path, entitiesFor(f)]));
+  const perEntities = new Map(await Promise.all(files.map(async (f) => [f.path, await entitiesFor(f)] as const)));
 
   const perFindings: AuditFinding[] = [];
   const perKeys = new Set<string>();
+  // chant #2111: meta findings (an expired/misplaced/denied suppression
+  // directive) are collected from the per-file pass only: the all-files pass
+  // below sees the same entities merged, so it would report the identical
+  // directive again. Counted the same way, once, here too.
+  const metaFindings: AuditFinding[] = [];
   for (const file of files) {
-    const diags = runChecks(checks, new Map([[file.path, toOutput(file)]]), perEntities.get(file.path));
+    const { diagnostics: diags, suppressed, meta } = runChecks(checks, new Map([[file.path, toOutput(file)]]), perEntities.get(file.path));
+    if (suppressionStats) suppressionStats.count += suppressed.length;
+    for (const m of meta) {
+      metaFindings.push({ checkId: m.checkId, severity: m.severity, message: m.message, file: m.file, lexicon, line: m.line });
+    }
     for (const d of diags) {
-      perFindings.push({ checkId: d.checkId, severity: d.severity, message: d.message, file: file.path, lexicon: d.lexicon ?? lexicon, entity: d.entity });
+      perFindings.push({ checkId: d.checkId, severity: d.severity, message: d.message, file: file.path, lexicon: d.lexicon ?? lexicon, entity: d.entity, missing: d.missing });
       perKeys.add(diagKey(d));
     }
   }
 
   const allOutputs = new Map<string, string | SerializerResult>(files.map((f) => [f.path, toOutput(f)]));
-  const allDiags = runChecks(checks, allOutputs, mergeEntities([...perEntities.values()]));
+  const { diagnostics: allDiags } = runChecks(checks, allOutputs, mergeEntities([...perEntities.values()]));
   const allKeys = new Set(allDiags.map(diagKey));
 
   const out: AuditFinding[] = perFindings.filter((f) => allKeys.has(diagKey(f)));
   for (const d of allDiags) {
     if (!perKeys.has(diagKey(d))) {
-      out.push({ checkId: d.checkId, severity: d.severity, message: d.message, file: CROSS_FILE, lexicon: d.lexicon ?? lexicon, entity: d.entity });
+      out.push({ checkId: d.checkId, severity: d.severity, message: d.message, file: CROSS_FILE, lexicon: d.lexicon ?? lexicon, entity: d.entity, missing: d.missing });
     }
   }
-  return out;
+  return [...out, ...metaFindings];
 }

package/src/audit/discover.test.ts

@@ -92,6 +92,45 @@ describe("discoverByDetection (unified, detectTemplate-driven)", () => {
     const plugins = await loadAuditPlugins(["github", "definitely-not-a-real-lexicon"]);
     expect(plugins.map((p) => p.name)).toEqual(["github"]);
   });
+
+  test("loadAuditPlugins skips a lexicon whose package is not installed, quietly", async () => {
+    const plugins = await loadAuditPlugins(["github", "not-a-lexicon"]);
+    expect(plugins.map((p) => p.name)).toEqual(["github"]);
+  });
+
+  describe("Terraform directories as bundles, modeled on classifyHelm", () => {
+    // No real @intentius/chant-lexicon-terraform package exists yet (#2085), so
+    // these tests supply a bare stand-in plugin rather than loadAuditPlugins().
+    const terraform = { name: "terraform" };
+
+    test("a directory with two .tf files, and a nested subdirectory with its own .tf file, classify as two separate terraform inputs", () => {
+      const found = discoverByDetection(fixture("audit-terraform"), [terraform]);
+      const tf = found.filter((i) => i.lexicon === "terraform");
+      expect(targets(tf)).toEqual(["terraform:infra", "terraform:infra/modules/foo"]);
+      const root = tf.find((i) => i.path === "infra")!;
+      expect(Object.keys(root.files!).sort()).toEqual(["main.tf", "variables.tf"]);
+      const nested = tf.find((i) => i.path === "infra/modules/foo")!;
+      expect(Object.keys(nested.files!).sort()).toEqual(["main.tf"]);
+    });
+
+    test("a bundle's content is the whole root module in filename order, each file behind a `# file:` marker", () => {
+      const found = discoverByDetection(fixture("audit-terraform"), [terraform]);
+      const root = found.find((i) => i.lexicon === "terraform" && i.path === "infra")!;
+      expect(root.content).toContain("# file: main.tf\nresource \"null_resource\" \"root\" {}");
+      expect(root.content).toContain("# file: variables.tf\nvariable \"region\"");
+      expect(root.content.indexOf("# file: main.tf")).toBeLessThan(root.content.indexOf("# file: variables.tf"));
+    });
+
+    test(".terraform/ contributes no bundle (walkFiles already skips dot-directories outside WALK_DOT_DIRS)", () => {
+      const found = discoverByDetection(fixture("audit-terraform"), [terraform]);
+      expect(found.some((i) => i.path.includes(".terraform"))).toBe(false);
+    });
+
+    test("without the terraform plugin, .tf files are classified into nothing (skipped, same as an unloaded helm)", () => {
+      const found = discoverByDetection(fixture("audit-terraform"), []);
+      expect(found).toEqual([]);
+    });
+  });
 });
 
 describe("lexicon hints for unclaimed files (#1623)", () => {

package/src/audit/discover.ts

@@ -21,6 +21,11 @@
  *     `detectTemplate` (which only knows Compose's `services:`) can't see them.
  *   - Helm charts are a directory BUNDLE keyed by `Chart.yaml`; the helm checks
  *     read `output.files`, so the whole chart is one AuditInput.
+ *   - Terraform is also a directory BUNDLE, keyed by that directory's own
+ *     `.tf` filenames, not recursively: a nested directory with its own
+ *     `.tf` files (e.g. `modules/foo`) is a separate root module and gets its
+ *     own AuditInput. `.tf` isn't YAML/JSON either, so `detectTemplate` can't
+ *     see it.
  *   - k8s `detectTemplate` matches any `apiVersion`+`kind`, including GCP Config
  *     Connector (`cnrm.cloud.google.com`) resources and fountain
  *     (`fountain.dev/v1`) manifests, so gcp and fountain must be tried first.
@@ -34,9 +39,10 @@ import { parseYAML } from "../yaml";
 import type { LexiconPlugin } from "../lexicon";
 import type { AuditInput, AuditLexicon } from "./core";
 import { isNginxConfigPath } from "./nginx";
+import { gitignoreCoversTerraformState, isTerraformStatePath } from "./terraform-state";
 
 /** Lexicons the auditor knows how to detect and run checks for. */
-export const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"] as const;
+export const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain", "terraform"] as const;
 
 /**
  * Load the plugins used for detection. Each is loaded in isolation (no
@@ -63,6 +69,8 @@ export async function loadAuditPlugins(names: readonly string[] = AUDIT_LEXICONS
 }
 
 const WALK_SKIP = new Set(["node_modules", ".git", "dist"]);
+/** Terraform's local working directory: recorded by the walk, never entered (TF023). */
+const TERRAFORM_WORK_DIR = ".terraform";
 /** Dot-directories the walk descends into anyway (CI lives here). */
 const WALK_DOT_DIRS = new Set([".github", ".forgejo"]);
 const MAX_WALK_FILES = 1000;
@@ -80,7 +88,15 @@ function walkFiles(dir: string, out: string[]): void {
   }
   for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
     if (out.length >= MAX_WALK_FILES) return;
-    if (e.name.startsWith(".") && e.isDirectory() && !WALK_DOT_DIRS.has(e.name)) continue;
+    if (e.name.startsWith(".") && e.isDirectory() && !WALK_DOT_DIRS.has(e.name)) {
+      // `.terraform/` is never descended into: it is machine-generated,
+      // routinely hundreds of megabytes of provider binaries, and nothing in
+      // it is worth reading. Its presence is itself the finding (TF023), so
+      // the directory path alone is recorded and `collectCandidates` hands it
+      // on with no content.
+      if (e.name === TERRAFORM_WORK_DIR) out.push(join(dir, e.name));
+      continue;
+    }
     if (WALK_SKIP.has(e.name)) continue;
     const full = join(dir, e.name);
     if (e.isDirectory()) walkFiles(full, out);
@@ -105,6 +121,10 @@ function isDockerfileName(name: string): boolean {
   return name === "Dockerfile" || name.startsWith("Dockerfile.") || name.endsWith(".Dockerfile") || name.endsWith(".dockerfile");
 }
 
+function isTerraformFileName(name: string): boolean {
+  return /\.tf$/i.test(name);
+}
+
 /**
  * Filenames the secrets scan (#443) wants that no lexicon otherwise reads —
  * dotenv files and key/cert material. Included in `isCandidatePath` so both
@@ -294,11 +314,11 @@ export function isCandidatePath(path: string): boolean {
  * (path, filename, a few content markers) with no lexicon plugin involved.
  * Names the lexicon that would have claimed a file when that lexicon isn't
  * installed (#1623). Deliberately coarse: precision comes from the plugin's
- * `detectTemplate`, which is exactly what's missing in that case.
- * `terraform` is not an audit lexicon; `*.tf` is surfaced so the user learns
- * the audit never reads it (see `chant carve`).
+ * `detectTemplate`, which is exactly what's missing in that case. `terraform`
+ * is a lexicon like any other here: a `.tf` file hints at it by name, the
+ * same way `Chart.yaml` hints at helm.
  */
-export type LexiconHint = AuditLexicon | "terraform";
+export type LexiconHint = AuditLexicon;
 
 export function hintLexiconForFile(path: string, content: string): LexiconHint | undefined {
   const name = basename(path);
@@ -306,7 +326,7 @@ export function hintLexiconForFile(path: string, content: string): LexiconHint |
   if (ci) return ci;
   if (isDockerfileName(name)) return "docker";
   if (name === "Chart.yaml") return "helm";
-  if (/\.tf$/i.test(name)) return "terraform";
+  if (isTerraformFileName(name)) return "terraform";
   const head = content.slice(0, 64 * 1024);
   if (/cnrm\.cloud\.google\.com/.test(head)) return "gcp";
   if (/fountain\.dev\/v1/.test(head)) return "fountain";
@@ -371,13 +391,53 @@ function classifyHelm(files: RepoFile[], plugin: DetectPlugin | undefined): { in
   return { inputs, prefixes };
 }
 
+/**
+ * Collect Terraform root modules as directory bundles from an in-memory file
+ * set, modeled on `classifyHelm`. Unlike a Helm chart (its whole subtree is
+ * one bundle), a Terraform root module references only its own sibling
+ * files, so grouping is by each `.tf` file's immediate directory, not
+ * recursive: a nested directory with its own `.tf` files (`modules/foo`) is
+ * a separate root module and gets its own AuditInput. Returns inputs plus
+ * the exact `.tf` paths claimed, so the loose-file pass in `classifyFiles`
+ * can skip them.
+ */
+function classifyTerraform(files: RepoFile[], plugin: DetectPlugin | undefined): { inputs: AuditInput[]; claimed: Set<string> } {
+  const inputs: AuditInput[] = [];
+  const claimed = new Set<string>();
+  if (!plugin) return { inputs, claimed };
+  const byDir = new Map<string, Record<string, string>>();
+  for (const f of files) {
+    if (!isTerraformFileName(basename(f.path))) continue;
+    const slash = f.path.lastIndexOf("/");
+    const dir = slash === -1 ? "" : f.path.slice(0, slash);
+    const name = slash === -1 ? f.path : f.path.slice(slash + 1);
+    const bundle = byDir.get(dir) ?? {};
+    bundle[name] = f.content;
+    byDir.set(dir, bundle);
+    claimed.add(f.path);
+  }
+  for (const [dir, bundle] of byDir) {
+    // `content` is the whole root module, every `.tf` in filename order with a
+    // `# file:` line comment (legal HCL) marking each boundary, so a lexicon's
+    // `auditEntities(content)` sees the module Terraform itself would load,
+    // not one arbitrary file of it. `files` keeps the per-file split.
+    const content = Object.keys(bundle)
+      .sort()
+      .map((name) => `# file: ${name}\n${bundle[name]}`)
+      .join("\n");
+    inputs.push({ path: dir === "" ? "." : dir, content, lexicon: "terraform", files: bundle });
+  }
+  return { inputs, claimed };
+}
+
 /**
  * Classify an in-memory set of repo files into per-lexicon audit inputs. Pure
  * (no fs, no network) so the local walk and the remote tree-fetch share exactly
  * one detection path. Each file maps to at most one lexicon: CI by path,
- * Dockerfiles by name, Helm charts as a bundle, everything else by the
- * precedence-ordered content detectors (delegating to each plugin's
- * `detectTemplate`). Lexicons whose plugin isn't provided are skipped.
+ * Dockerfiles by name, Helm charts and Terraform root modules as directory
+ * bundles, everything else by the precedence-ordered content detectors
+ * (delegating to each plugin's `detectTemplate`). Lexicons whose plugin isn't
+ * provided are skipped.
  */
 export function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): AuditInput[] {
   const byName = new Map(plugins.map((p) => [p.name, p]));
@@ -387,9 +447,12 @@ export function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): Audit
   const helm = classifyHelm(files, byName.get("helm"));
   const underChart = (p: string): boolean => helm.prefixes.some((pre) => (pre === "" ? true : p.startsWith(pre)));
 
-  const inputs: AuditInput[] = [...helm.inputs];
+  const terraform = classifyTerraform(files, byName.get("terraform"));
+
+  const inputs: AuditInput[] = [...helm.inputs, ...terraform.inputs];
   for (const { path, content } of files) {
     if (underChart(path)) continue;
+    if (terraform.claimed.has(path)) continue;
     const name = basename(path);
 
     const ci = ciLexiconForPath(path);
@@ -427,13 +490,26 @@ export function discoverByDetection(root: string, plugins: DetectPlugin[]): Audi
 export function collectCandidates(root: string): RepoFile[] {
   const all: string[] = [];
   walkFiles(root, all);
+  // TF023 reads paths, not content: a `.tfstate` can be tens of megabytes of
+  // machine-generated JSON, and the finding is that it is in the repository at
+  // all. The root `.gitignore` is what separates "committed" from "merely on
+  // disk" here — a Terraform working tree almost always has an ignored
+  // `.terraform/` in it, and reporting that would make TF023 fire on every
+  // local audit. A fetched repository has no such ambiguity (its file list is
+  // the tracked files) and is not filtered.
+  const gitignore = readSafe(join(root, ".gitignore")) ?? "";
   const files: RepoFile[] = [];
   for (const full of all) {
     const path = relative(root, full);
-    // Terraform is never audited; the path alone is enough to say so (#1623).
-    // Kept out of `isCandidatePath` so remote fetches never pull HCL.
-    if (/\.tf$/i.test(path)) {
-      files.push({ path, content: "" });
+    if (isTerraformStatePath(path)) {
+      if (!gitignoreCoversTerraformState(gitignore, path)) files.push({ path, content: "" });
+      continue;
+    }
+    // `.tf` is read locally so `classifyTerraform` can bundle real content.
+    // It stays out of `isCandidatePath` so remote fetches still never pull HCL.
+    if (isTerraformFileName(basename(path))) {
+      const content = readSafe(full);
+      if (content !== undefined) files.push({ path, content });
       continue;
     }
     if (!isCandidatePath(path)) continue;

package/src/audit/lineage.ts

@@ -0,0 +1,100 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "./prior-art";
+
+export const coreAuditLineage: Record<string, Lineage[]> = {
+  AGT002: [
+    { tool: "agent-audit", rule: "auth-bypass/env-secret-in-config", url: "https://raw.githubusercontent.com/piiiico/agent-audit/main/README.md", relation: "equivalent" },
+    { tool: "mcp-audit", rule: "Secrets Detection", url: "https://raw.githubusercontent.com/apisec-inc/mcp-audit/main/README.md", relation: "overlaps" },
+    { tool: "agent-scan", rule: "W008", url: "https://raw.githubusercontent.com/invariantlabs-ai/mcp-scan/main/docs/issue-codes.md", relation: "overlaps" },
+  ],
+  COR020: [
+    { tool: "cfn-lint", rule: "E3004", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3004", relation: "equivalent" },
+  ],
+  EXT001: [
+    { tool: "cfn-lint", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/cfn-schema-specification.md#extending-the-schemas-with-new-keywords", relation: "equivalent" },
+    { tool: "cfn-lint", rule: "E3014", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3014", relation: "equivalent" },
+    { tool: "cfn-lint", rule: "E3021", url: "https://github.com/aws-cloudformation/cfn-lint/blob/main/docs/rules.md#E3021", relation: "equivalent" },
+  ],
+  NGX001: [
+    { tool: "gixy-ng", rule: "weak_ssl_tls", url: "https://gixy.getpagespeed.com/plugins/weak_ssl_tls/", relation: "overlaps" },
+  ],
+  NGX002: [
+    { tool: "gixy-ng", rule: "weak_ssl_tls", url: "https://gixy.getpagespeed.com/plugins/weak_ssl_tls/", relation: "overlaps" },
+  ],
+  NGX004: [
+    { tool: "gixy", rule: "alias_traversal", url: "https://github.com/yandex/gixy", relation: "equivalent" },
+    { tool: "gixy-ng", rule: "alias_traversal", url: "https://gixy.getpagespeed.com/plugins/aliastraversal/", relation: "equivalent" },
+  ],
+  NGX005: [
+    { tool: "gixy-ng", rule: "status_page_exposed", url: "https://gixy.getpagespeed.com/checks/status-page-exposed/", relation: "overlaps" },
+  ],
+  NGX006: [
+    { tool: "gixy-ng", rule: "version_disclosure", url: "https://gixy.getpagespeed.com/plugins/version_disclosure/", relation: "equivalent" },
+  ],
+  SEC001: [
+    { tool: "gitleaks", rule: "aws-access-token", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "equivalent" },
+    { tool: "trufflehog", rule: "aws", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/aws/access_keys/accesskey.go", relation: "overlaps" },
+    { tool: "detect-secrets", rule: "AWSKeyDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/aws.py", relation: "equivalent" },
+  ],
+  SEC002: [
+    { tool: "gitleaks", rule: "generic-api-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    { tool: "trufflehog", rule: "aws", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/aws/access_keys/accesskey.go", relation: "overlaps" },
+    { tool: "detect-secrets", rule: "AWSKeyDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/aws.py", relation: "overlaps" },
+  ],
+  SEC003: [
+    { tool: "gitleaks", rule: "github-pat", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    { tool: "trufflehog", rule: "github", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/github/v2/github.go", relation: "equivalent" },
+    { tool: "detect-secrets", rule: "GitHubTokenDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/github_token.py", relation: "overlaps" },
+  ],
+  SEC004: [
+    { tool: "gitleaks", rule: "slack-bot-token", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    { tool: "trufflehog", rule: "slack", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/slack/slack.go", relation: "overlaps" },
+    { tool: "detect-secrets", rule: "SlackDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/slack.py", relation: "overlaps" },
+  ],
+  SEC005: [
+    { tool: "gitleaks", rule: "gcp-api-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "equivalent" },
+    { tool: "trufflehog", rule: "googlegemini", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/googlegemini/googlegemini.go", relation: "overlaps" },
+  ],
+  SEC006: [
+    { tool: "gitleaks", rule: "stripe-access-token", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+    { tool: "trufflehog", rule: "stripe", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/stripe/stripe.go", relation: "overlaps" },
+    { tool: "detect-secrets", rule: "StripeDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/stripe.py", relation: "overlaps" },
+  ],
+  SEC007: [
+    { tool: "gitleaks", rule: "private-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "equivalent" },
+    { tool: "trufflehog", rule: "privatekey", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/privatekey/privatekey.go", relation: "equivalent" },
+    { tool: "detect-secrets", rule: "PrivateKeyDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/private_key.py", relation: "equivalent" },
+  ],
+  SEC008: [
+    { tool: "gitleaks", rule: "curl-auth-header", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+  ],
+  SEC009: [
+    { tool: "detect-secrets", rule: "BasicAuthDetector", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/basic_auth.py", relation: "equivalent" },
+    { tool: "trufflehog", rule: "uri", url: "https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/uri/uri.go", relation: "overlaps" },
+    { tool: "gitleaks", rule: "curl-auth-user", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+  ],
+  SEC010: [
+    { tool: "detect-secrets", rule: "Base64HighEntropyString", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/high_entropy_strings.py", relation: "overlaps" },
+    { tool: "detect-secrets", rule: "HexHighEntropyString", url: "https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/high_entropy_strings.py", relation: "overlaps" },
+    { tool: "gitleaks", rule: "generic-api-key", url: "https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml", relation: "overlaps" },
+  ],
+  // TF023 is the one TF id core owns (./terraform-state.ts); the rest of the
+  // family credits its prior art from lexicons/terraform/src/lint/audit-lineage.ts.
+  // No linter or scanner in #2107's survey checks for committed state, but the
+  // style guide's .gitignore section names the exact files, so the document is
+  // both the authority and the first written statement of the rule.
+  TF023: [
+    {
+      tool: "hashicorp-style-guide",
+      rule: ".gitignore: do not commit terraform.tfstate, terraform.tfstate.* backups, or the .terraform directory",
+      url: "https://developer.hashicorp.com/terraform/language/style#gitignore",
+      relation: "equivalent",
+    },
+  ],
+};