@korayda4/vibe-security 0.3.0

package/dist/engine/rules/backend/inputValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputValidation.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/inputValidation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,mDAAmD;IAC1D,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,uOAAuO;IACzO,MAAM,EAAE,6DAA6D;IACrE,WAAW,EACT,yEAAyE;QACzE,2DAA2D;QAC3D,qGAAqG;QACrG,qGAAqG;QACrG,qFAAqF;IACvF,UAAU,EAAE;QACV,iFAAiF;QACjF,kBAAkB;KACnB;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,8GAA8G;YACxG,gGAAgG;YACtG,8BAA8B;YAC9B,+BAA+B;YAC/B,iDAAiD;SAC5C,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/jwt.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/jwt.js

@@ -0,0 +1,42 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-003',
+    title: 'Insecure JWT configuration (alg: none / weak secret / no verify)',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'JWT token uretimi veya dogrulamasi yapilirken `alg: none`, zayif HMAC secret, hardcoded secret veya `verify` atlama gibi hatalar yapildiginda saldirgan imzayi atlayip kendi token\'ini uretebilir.',
+    threat: 'Authentication bypass → full account takeover',
+    remediation: '1) **Asla `alg: none`** kullanmayin; her zaman explicit `algorithms: [\'RS256\']` veya `[\'HS256\']` whitelist edin. ' +
+        '2) HMAC secret\'i en az 256-bit (32 byte) random uretin, **asla** commit\'lemeyin. Asimetrik (RS256/ES256) tercih edin. ' +
+        '3) `jwt.verify()` her zaman cagirin, payload\'i dogrudan kabul etmeyin. ' +
+        '4) `exp`, `iss`, `aud` claim\'lerini dogrulayin. ' +
+        '5) Access token\'i 15 dakika ile sinirlayin, refresh token icin rotation + revocation store kullanin. ' +
+        '6) `Authorization: Bearer` basligini okuyun, query string\'de token tasimalarini reddedin.',
+    references: [
+        'https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html',
+        'https://datatracker.ietf.org/doc/html/rfc8725',
+        'https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/',
+    ],
+    cwe: 'CWE-347',
+    owasp: 'A02:2021 Cryptographic Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /algorithm\s*[:=]\s*['"`]none['"`]/gi,
+            /algorithms\s*:\s*\[\s*['"`]none['"`]\s*\]/g,
+            /jwt\.sign\s*\([^)]*['"`\s]none['"`\s]/gi,
+            /jwt\.decode\s*\([^)]*\)/g, // decode without verify
+            /['"`]secret['"`]\s*[:=]\s*['"`][a-zA-Z0-9_\-]{1,31}['"`]/g, // short hardcoded secret
+            /JWT_SECRET\s*[:=]\s*['"`][^'"`\n]{1,15}['"`]/g,
+            /verify\s*:\s*false/gi,
+            /verify=False/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=jwt.js.map

package/dist/engine/rules/backend/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,kEAAkE;IACzE,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,qMAAqM;IACvM,MAAM,EAAE,+CAA+C;IACvD,WAAW,EACT,uHAAuH;QACvH,0HAA0H;QAC1H,0EAA0E;QAC1E,mDAAmD;QACnD,wGAAwG;QACxG,4FAA4F;IAC9F,UAAU,EAAE;QACV,yFAAyF;QACzF,+CAA+C;QAC/C,8EAA8E;KAC/E;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,iCAAiC;IACxC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YACzB,qCAAqC;YACrC,4CAA4C;YAC5C,yCAAyC;YACzC,0BAA0B,EAAE,wBAAwB;YACpD,2DAA2D,EAAE,yBAAyB;YACtF,+CAA+C;YAC/C,sBAAsB;YACtB,eAAe;SAChB,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/rateLimit.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/rateLimit.js

@@ -0,0 +1,45 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-006',
+    title: 'Missing rate limiting / throttling on sensitive endpoints',
+    layer: 'backend',
+    severity: 'medium',
+    description: 'Login, signup, password reset, OTP dogrulama gibi endpointlerde rate limiting yoksa brute-force, credential stuffing ve DoS kolaylastirilir.',
+    threat: 'Brute force, credential stuffing, OTP enumeration, denial of service, scraping',
+    remediation: '1) **express-rate-limit**, **rate-limiter-flexible**, **slowapi** (Python) kullanin. ' +
+        '2) IP bazli + user/token bazli iki katman uygulayin. ' +
+        '3) Login endpointleri icin 5 deneme / 15 dakika cap\'i koyun. ' +
+        '4) Exponential backoff ile basarisiz denemeleri yavaslatin. ' +
+        '5) 5 basarisiz denemede account\'u gecici kilitleyin + kullaniciya bildirim gonderin. ' +
+        '6) Captcha veya Turnstile ekleyin. ' +
+        '7) Edge seviyesinde (Cloudflare, API Gateway) global limit ekleyin.',
+    references: [
+        'https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#login-throttling',
+    ],
+    cwe: 'CWE-307',
+    owasp: 'A07:2021 Identification and Authentication Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const isServerFile = /(?:server|app|main|index|routes)\.(?:ts|js|py|go|java)$/i.test(ctx.relativePath) ||
+            /\/routes?\//i.test(ctx.relativePath) ||
+            /\/api\//i.test(ctx.relativePath);
+        if (!isServerFile)
+            return [];
+        const hasRateLimit = /rate[-_]?limit|rateLimit|throttle|bruteforce|slowapi|express-rate-limit/i.test(ctx.source);
+        if (hasRateLimit)
+            return [];
+        const authRoutes = [
+            /\bapp\.(?:post|put|get)\s*\(\s*['"`](?:\/api)?\/?(?:login|signin|signup|register|auth|reset-?password|forgot-?password|verify-?otp|2fa)/gi,
+            /@app\.route\s*\(\s*['"`](?:\/api)?\/?(?:login|signin|signup|register|auth|reset-?password|forgot-?password)/gi,
+            /router\.post\s*\(\s*['"`](?:\/api)?\/?(?:login|signin|signup|register|auth|reset-?password|forgot-?password)/gi,
+        ];
+        const findings = [];
+        for (const re of authRoutes) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=rateLimit.js.map

package/dist/engine/rules/backend/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/rateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,2DAA2D;IAClE,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,8IAA8I;IAChJ,MAAM,EAAE,gFAAgF;IACxF,WAAW,EACT,uFAAuF;QACvF,uDAAuD;QACvD,gEAAgE;QAChE,8DAA8D;QAC9D,wFAAwF;QACxF,qCAAqC;QACrC,qEAAqE;IACvE,UAAU,EAAE;QACV,uEAAuE;QACvE,iGAAiG;KAClG;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,qDAAqD;IAC5D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,YAAY,GAChB,0DAA0D,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACjF,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAEpC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAE7B,MAAM,YAAY,GAChB,0EAA0E,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE9F,IAAI,YAAY;YAAE,OAAO,EAAE,CAAC;QAE5B,MAAM,UAAU,GAAG;YACjB,2IAA2I;YAC3I,+GAA+G;YAC/G,gHAAgH;SACjH,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/sqlInjection.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/sqlInjection.js

@@ -0,0 +1,41 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'BE-004',
+    title: 'SQL / NoSQL injection via string concatenation',
+    layer: 'backend',
+    severity: 'critical',
+    description: 'SQL sorgulari veya NoSQL filtreleri string concatenation / template literals ile olusturuldugunda, kullanici girdisi sorgu yapisina enjekte edilebilir. ' +
+        'Senaryolar: `query: "SELECT * FROM users WHERE id = " + req.params.id` veya `db.users.find({ $where: req.body.filter })` gibi.',
+    threat: 'Data breach, authentication bypass, remote code execution (DB-specific), full DB compromise',
+    remediation: '1) **Parametrik sorgular** / prepared statements kullanin: `db.query(\'SELECT * FROM users WHERE id = $1\', [id])`. ' +
+        '2) ORM (Prisma, TypeORM, Sequelize, SQLAlchemy) otomatik parameterize eder. ' +
+        '3) String concatenation ile SQL asla olusturmayin. ' +
+        '4) NoSQL: `$where`, `$function`, `$regex` gibi operatorlari kullanici girdisinden GEÇMEYIN; explicit whitelist kullanin. ' +
+        '5) Stored procedure kullaniyorsaniz bile icindeki SQL\'i dinamik olusturmayin. ' +
+        '6) Tum user input\'u once validate edin (Zod, Joi, class-validator).',
+    references: [
+        'https://owasp.org/www-community/attacks/SQL_Injection',
+        'https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html',
+        'https://owasp.org/www-project-top-ten/2017/A1_2017-Injection',
+    ],
+    cwe: 'CWE-89',
+    owasp: 'A03:2021 Injection',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\s+[^;\n]*['"`]\s*\+\s*(req\.|request\.|input|params|body|query)/gi,
+            /\$\{[^}]*(req\.|request\.|input|params|body|query)[^}]*\}\s*['"`]\s*(SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)/gi,
+            /f['"`](?:SELECT|INSERT|UPDATE|DELETE|DROP).*\{[^}]*(?:request|input|args|params)/gi,
+            /['"`](?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)[^'"`]*['"`]\s*%\s*\(/g,
+            /(?:createQuery|createNativeQuery)\s*\([^)]*\+[^)]*(?:request|param)/g,
+            /\$(?:where|function|regex|ne|gt|lt)\s*:/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=sqlInjection.js.map

package/dist/engine/rules/backend/sqlInjection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlInjection.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/sqlInjection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,gDAAgD;IACvD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,0JAA0J;QAC1J,gIAAgI;IAClI,MAAM,EAAE,6FAA6F;IACrG,WAAW,EACT,sHAAsH;QACtH,8EAA8E;QAC9E,qDAAqD;QACrD,2HAA2H;QAC3H,iFAAiF;QACjF,sEAAsE;IACxE,UAAU,EAAE;QACV,uDAAuD;QACvD,0FAA0F;QAC1F,8DAA8D;KAC/D;IACD,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,mHAAmH;YAC7G,gHAAgH;YACtH,oFAAoF;YAC9E,uEAAuE;YAC7E,sEAAsE;YACtE,0CAA0C;SACrC,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/tokenExpiry.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/tokenExpiry.js

@@ -0,0 +1,85 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'BE-009',
+    title: 'Long-lived token — missing or excessive expiry',
+    layer: 'backend',
+    severity: 'high',
+    description: 'JWT access token\'larinda `expiresIn` claim yoksa veya asiri uzunsa (30 gun+) token sizdirildiginda sonsuza kadar gecerli kalir. Ayni sekilde session cookie maxAge > 24 saat veya "remember me" tarzi kalici oturumlar kontrolsuzse saldırganin eline gecmis token ile yapacagi hasar sinirsiz olur.',
+    threat: 'Stolen token remains valid indefinitely → no logout, no password reset can revoke access',
+    remediation: '1) **Access token** icin `expiresIn: \'15m\'` veya daha kisa (5m). ' +
+        '2) **Refresh token** icin 7-30 gun + her kullanimda rotation + revocation store (Redis). ' +
+        '3) `jwt.sign()`\'de mutlaka `expiresIn` veya `exp` belirt, default davranisa guvenme. ' +
+        '4) `jwt.verify()`\'de `maxAge` veya explicit `exp` kontrolu yap. ' +
+        '5) `req.session.cookie.maxAge` 24 saatten fazla olmasin. ' +
+        '6) "Remember me" icin ayri, rotation\'lu, revocation\'lu token uret. ' +
+        '7) Tum sizdirilmis token\'lar icin blacklist / revocation list tut.',
+    references: [
+        'https://datatracker.ietf.org/doc/html/rfc8725#section-3.12',
+        'https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html#token-expiration',
+        'https://auth0.com/docs/secure/tokens/access-tokens/access-token-lifetime',
+    ],
+    cwe: 'CWE-613',
+    owasp: 'A07:2021 Identification and Authentication Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const findings = [];
+        const longExpiry = [
+            /expiresIn\s*:\s*['"`](?:30d|60d|90d|365d|1y|'none'|"none"|0|null|undefined)['"`]/gi,
+            /expiresIn\s*:\s*['"`]\d{4,}\s*d['"`]/gi, // >999 gun
+            /jwt\.sign\s*\([^)]*\)\s*;(?![^]*expiresIn)/g, // expiresIn yok
+            /pyjwt\.encode\s*\([^)]*\)\s*(?![^]*exp)/g,
+            /new\s+UnsecuredJWT\s*\([^)]*\)/g,
+        ];
+        for (const re of longExpiry) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}-e`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        const longSession = [
+            /maxAge\s*:\s*\d{2,}\s*\*\s*60\s*\*\s*60\s*\*\s*1000/g, // > 24 saat
+            /cookie\s*:\s*\{[^}]*maxAge\s*:\s*\d{8,}/g, // cok buyuk sayi (ms olarak)
+        ];
+        for (const re of longSession) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}-s`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=tokenExpiry.js.map

package/dist/engine/rules/backend/tokenExpiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenExpiry.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/tokenExpiry.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,gDAAgD;IACvD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,uSAAuS;IACzS,MAAM,EACJ,0FAA0F;IAC5F,WAAW,EACT,qEAAqE;QACrE,2FAA2F;QAC3F,wFAAwF;QACxF,mEAAmE;QACnE,2DAA2D;QAC3D,uEAAuE;QACvE,qEAAqE;IACvE,UAAU,EAAE;QACV,4DAA4D;QAC5D,0GAA0G;QAC1G,0EAA0E;KAC3E;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,qDAAqD;IAC5D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG;YACb,oFAAoF;YACpF,wCAAwC,EAAE,WAAW;YACrD,6CAA6C,EAAE,gBAAgB;YAC/D,0CAA0C;YAC1C,iCAAiC;SAClC,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;oBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACL,MAAM,WAAW,GAAG;YACd,sDAAsD,EAAE,YAAY;YACpE,0CAA0C,EAAE,6BAA6B;SAC1E,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;oBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/backend/tokenInUrl.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/backend/tokenInUrl.js

@@ -0,0 +1,112 @@
+import { lineColumnFromIndex, snippetAt } from '../_helpers.js';
+const rule = {
+    id: 'BE-008',
+    title: 'Token transmitted in URL (query string or path)',
+    layer: 'backend',
+    severity: 'high',
+    description: 'Access token, API key, session ID veya baska hassas token URL\'in query string\'inde (`?token=...`) veya path\'inde (`/users/:token/...`) tasindiginda, sunucu access log\'larinda, reverse proxy log\'larinda, browser history\'de, referer header\'inda veya ekran goruntulerinde ifsa olur. Ayni zamanda OWASP API3:2023 (Broken Object Property Level Authorization) ile zincir saldirilara kapilar acar.',
+    threat: 'Token leakage via logs/history/referer → session hijack, account takeover, lateral movement',
+    remediation: '1) Token\'i **MUTLAKA Authorization: Bearer** header\'inda tasima (query veya path degil). ' +
+        '2) API key gibi kalici secret\'lari client\'a hic gonderme; server-side proxy kullan. ' +
+        '3) Frontend\'den API\'ye istek atarken `fetch(url, { headers: { Authorization: \'Bearer \' + token } })`. ' +
+        '4) Express middleware: `app.use((req, res, next) => { if (req.query.token) return res.status(400).send(\'token in URL\'); next(); })` — hard reject. ' +
+        '5) Reverse proxy / Nginx log format\'larindan query string\'i cikar. ' +
+        '6) Eger gercekten URL\'de olmasi gerekiyorsa (ornek: download link\'i) one-time, short-TTL signed URL kullan.',
+    references: [
+        'https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/',
+        'https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html',
+        'https://cwe.mitre.org/data/definitions/598.html',
+    ],
+    cwe: 'CWE-598',
+    owasp: 'A07:2021 Identification and Authentication Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const findings = [];
+        const queryToken = [
+            /req\.query\.(?:token|api_?key|apikey|access_?token|session)/gi,
+            /request\.GET\[['"](?:token|api_?key|apikey|access_?token|session)['"]\]/g,
+            /c\.Query\s*\(\s*['"`](?:token|api_?key|apikey|access_?token|session)/gi,
+            /request\.query_params\.get\s*\(\s*['"`](?:token|api_?key|apikey)/gi,
+        ];
+        for (const re of queryToken) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}-q`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        const fetchWithToken = [
+            /fetch\s*\(\s*[`'"](?:[^`'"]*)\$\{[^}]*(?:token|api_?key|apikey|secret)[^}]*\}/gi,
+            /fetch\s*\(\s*[`'"][^`'"]*\?(?:[^`'"]*)\$\{[^}]*(?:token|api_?key|apikey|secret)/gi,
+            /axios\.(?:get|post)\s*\(\s*[`'"](?:[^`'"]*)\$\{[^}]*(?:token|api_?key|apikey|secret)/gi,
+            /requests\.(?:get|post)\s*\(\s*[`'"]f?(?:[^`'"]*)\{[^}]*(?:token|api_?key|apikey|secret)/gi,
+        ];
+        for (const re of fetchWithToken) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}-f`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        const pathParam = [
+            /\/:\s*(?:token|api_?key|apikey|secret)\b/gi,
+            /\/<(?:\w+:)?(?:token|api_?key|apikey|secret)>/gi,
+            /\/\{(?:token|api_?key|apikey|secret)\}/gi,
+        ];
+        for (const re of pathParam) {
+            for (const m of ctx.source.matchAll(re)) {
+                if (m.index === undefined)
+                    continue;
+                const { line } = lineColumnFromIndex(ctx.source, m.index);
+                findings.push({
+                    id: `${rule.id}-${ctx.relativePath}-${line}-p`,
+                    ruleId: rule.id,
+                    title: rule.title,
+                    layer: rule.layer,
+                    severity: rule.severity,
+                    file: ctx.relativePath,
+                    match: { snippet: snippetAt(ctx.source, line), line, column: m.index },
+                    description: rule.description,
+                    impact: rule.threat,
+                    remediation: rule.remediation,
+                    references: rule.references,
+                    cwe: rule.cwe,
+                    owasp: rule.owasp,
+                });
+            }
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=tokenInUrl.js.map

package/dist/engine/rules/backend/tokenInUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenInUrl.js","sourceRoot":"","sources":["../../../../src/engine/rules/backend/tokenInUrl.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,mBAAmB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,iDAAiD;IACxD,KAAK,EAAE,SAAS;IAChB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,+YAA+Y;IACjZ,MAAM,EACJ,6FAA6F;IAC/F,WAAW,EACT,6FAA6F;QAC7F,wFAAwF;QACxF,4GAA4G;QAC5G,uJAAuJ;QACvJ,uEAAuE;QACvE,+GAA+G;IACjH,UAAU,EAAE;QACV,6EAA6E;QAC7E,+EAA+E;QAC/E,iDAAiD;KAClD;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,qDAAqD;IAC5D,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG;YACb,+DAA+D;YAC/D,0EAA0E;YAC1E,wEAAwE;YACxE,oEAAoE;SACrE,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;oBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACL,MAAM,cAAc,GAAG;YACjB,iFAAiF;YACjF,mFAAmF;YACnF,wFAAwF;YACxF,2FAA2F;SAC5F,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;oBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACL,MAAM,SAAS,GAAG;YACZ,4CAA4C;YAC5C,iDAAiD;YACjD,0CAA0C;SAC3C,CAAC;QAEF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;oBAAE,SAAS;gBACpC,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,IAAI;oBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE;oBACtE,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/cicd/dependencies.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/cicd/dependencies.js

@@ -0,0 +1,44 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'CI-001',
+    title: 'Dependency hygiene — missing lockfile, audit, or pinning',
+    layer: 'cicd',
+    severity: 'medium',
+    description: 'Lockfile (package-lock.json / yarn.lock / poetry.lock / go.sum) eksikse bagimlilik versiyonlari tekrarlanamaz sekilde cozumlenir (tedarik zinciri riski). Audit script\'i yoksa CVE\'ler sessizce slider.',
+    threat: 'Software supply chain attack, dependency confusion, known CVE exploitation',
+    remediation: '1) Lockfile\'i her zaman commit\'leyin ve `.gitignore`\'a ALMAYIN. ' +
+        '2) CI\'da `npm audit --audit-level=high`, `pip-audit`, `govulncheck`, `snyk test`, `dependabot` calistirin. ' +
+        '3) Container imajlarinda minimal taban (`distroless`, `alpine`) ve **non-root** user kullanin. ' +
+        '4) `npm ci` ile build yapin (lockfile\'a zorlar). ' +
+        '5) Renovate / Dependabot ile guvenlik PR\'leri otomatik acilsin. ' +
+        '6) `package.json` `scripts.audit` tanimlayin.',
+    references: [
+        'https://docs.npmjs.com/cli/v10/commands/npm-audit',
+        'https://github.com/pypa/pip-audit',
+        'https://github.com/govulncheck/govulncheck',
+    ],
+    cwe: 'CWE-1357',
+    owasp: 'A06:2021 Vulnerable and Outdated Components',
+    languages: ['javascript', 'typescript', 'python', 'go', 'json'],
+    check: (ctx) => {
+        const patterns = [
+            /^(\s*)\}\s*$/gm,
+            /pip\s+install\s+(?!.*--require-hashes)/g,
+            /npm\s+install\s+(?!.*--ignore-scripts)/g,
+            /FROM\s+[^:\n]+:latest/g,
+        ];
+        if (/(?:package\.json|requirements\.txt|pyproject\.toml|go\.mod)$/i.test(ctx.relativePath)) {
+            const hasAudit = /"audit"|pip-audit|snyk|dependabot|renovate/i.test(ctx.source);
+            if (!hasAudit && /(?:package\.json)$/i.test(ctx.relativePath)) {
+                return grepRule(rule, ctx, /"scripts"\s*:\s*\{/g);
+            }
+        }
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=dependencies.js.map

package/dist/engine/rules/cicd/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../../../src/engine/rules/cicd/dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,0DAA0D;IACjE,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,2MAA2M;IAC7M,MAAM,EAAE,4EAA4E;IACpF,WAAW,EACT,qEAAqE;QACrE,8GAA8G;QAC9G,iGAAiG;QACjG,oDAAoD;QACpD,mEAAmE;QACnE,+CAA+C;IACjD,UAAU,EAAE;QACV,mDAAmD;QACnD,mCAAmC;QACnC,4CAA4C;KAC7C;IACD,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,6CAA6C;IACpD,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,gBAAgB;YAChB,yCAAyC;YACnC,yCAAyC;YAC/C,wBAAwB;SACnB,CAAC;QAEF,IAAI,+DAA+D,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3F,MAAM,QAAQ,GAAG,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChF,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9D,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/cicd/dockerfile.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/cicd/dockerfile.js

@@ -0,0 +1,42 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'CI-003',
+    title: 'Insecure Dockerfile (root user, latest tag, ADD with URL)',
+    layer: 'cicd',
+    severity: 'medium',
+    description: 'Dockerfile\'da `USER` belirtilmemisse konteyner root olarak calisir; `latest` tag tekrarlanamaz; `ADD` URL\'den dosya cekmek MITM\'e aciktir.',
+    threat: 'Container escape, root privilege escalation, unpredictable builds, supply chain',
+    remediation: '1) `FROM <image>:<pinned-version>` kullanin (digest\'e pinleyin: `@sha256:...`). ' +
+        '2) `USER nonroot:nonroot` veya specific UID ile calistirin. ' +
+        '3) `COPY` kullanin; sadece gerekli dosyalari kopyalayin. `ADD <url>` kullanmayin (curl/wget ile indirip checksum dogrulayin). ' +
+        '4) Multi-stage build ile build tool\'lari final imaja sokmayin. ' +
+        '5) Minimal taban (`gcr.io/distroless/*`, `alpine`) kullanin. ' +
+        '6) `.dockerignore` ile secret / node_modules / .git\'i disarida birakin.',
+    references: [
+        'https://docs.docker.com/develop/dev-best-practices/',
+        'https://snyk.io/learn/docker-security/',
+        'https://github.com/hadolint/hadolint',
+    ],
+    cwe: 'CWE-250',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['dockerfile'],
+    check: (ctx) => {
+        const findings = [];
+        const lines = ctx.lines;
+        const hasUser = /^USER\s+/m.test(ctx.source);
+        const hasLatest = /FROM\s+\S+:latest\b/.exec(ctx.source);
+        const hasAddUrl = /^ADD\s+https?:\/\//m.test(ctx.source);
+        if (!hasUser) {
+            findings.push(...grepRule(rule, ctx, /^FROM\s+/gm));
+        }
+        if (hasLatest) {
+            findings.push(...grepRule(rule, ctx, /FROM\s+\S+:latest\b/g));
+        }
+        if (hasAddUrl) {
+            findings.push(...grepRule(rule, ctx, /^ADD\s+https?:\/\//gm));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=dockerfile.js.map

package/dist/engine/rules/cicd/dockerfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerfile.js","sourceRoot":"","sources":["../../../../src/engine/rules/cicd/dockerfile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,2DAA2D;IAClE,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,QAAQ;IAClB,WAAW,EACT,+IAA+I;IACjJ,MAAM,EAAE,iFAAiF;IACzF,WAAW,EACT,mFAAmF;QACnF,8DAA8D;QAC9D,gIAAgI;QAChI,kEAAkE;QAClE,+DAA+D;QAC/D,0EAA0E;IAC5E,UAAU,EAAE;QACV,qDAAqD;QACrD,wCAAwC;QACxC,sCAAsC;KACvC;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,CAAC;IACzB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAExB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/cicd/index.d.ts

@@ -0,0 +1,6 @@
+export declare const rules: {
+    dependencies: import("../../../types.js").Rule;
+    secrets: import("../../../types.js").Rule;
+    dockerfile: import("../../../types.js").Rule;
+};
+export default rules;

package/dist/engine/rules/cicd/index.js

@@ -0,0 +1,10 @@
+import dependencies from './dependencies.js';
+import secrets from './secrets.js';
+import dockerfile from './dockerfile.js';
+export const rules = {
+    dependencies,
+    secrets,
+    dockerfile,
+};
+export default rules;
+//# sourceMappingURL=index.js.map

package/dist/engine/rules/cicd/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/engine/rules/cicd/index.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,mBAAmB,CAAC;AAC7C,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,YAAY;IACZ,OAAO;IACP,UAAU;CACX,CAAC;AAEF,eAAe,KAAK,CAAC"}

package/dist/engine/rules/cicd/secrets.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/cicd/secrets.js

@@ -0,0 +1,41 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'CI-002',
+    title: 'Hardcoded secret / credential in source',
+    layer: 'cicd',
+    severity: 'critical',
+    description: 'API key, private key, DB password, OAuth secret, AWS access key gibi hassas degerlerin kaynak kodunda veya .env dosyasinda duz metin bulunmasi, Git reposuna sizmasi demektir.',
+    threat: 'Cloud takeover, financial fraud, data breach, lateral movement',
+    remediation: '1) Tum secret\'lari **Vault / AWS Secrets Manager / GCP Secret Manager / Doppler** ile yonetin. ' +
+        '2) Pre-commit hook olarak **gitleaks** veya **trufflehog** kurun. ' +
+        '3) `.gitignore`\'a `.env`, `.env.local`, `*.pem`, `*.key` ekleyin. ' +
+        '4) `.env.example` sadece anahtar isimlerini icersin, degerler bos olmali. ' +
+        '5) CI ortaminda secret\'lari environment variable olarak inject edin (GitHub Actions secrets, GitLab CI variables). ' +
+        '6) Bir secret commit olduysa HEMEN rotate edin; Git history\'de kalir.',
+    references: [
+        'https://github.com/gitleaks/gitleaks',
+        'https://github.com/trufflesecurity/trufflehog',
+        'https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html',
+    ],
+    cwe: 'CWE-798',
+    owasp: 'A05:2021 Security Misconfiguration',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go', 'yaml', 'dockerfile'],
+    check: (ctx) => {
+        const patterns = [
+            /AKIA[0-9A-Z]{16}/g,
+            /api[_-]?key\s*[:=]\s*['"`]([a-zA-Z0-9_\-]{20,})['"`]/gi,
+            /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+            /(?:password|passwd|pwd|secret)\s*[:=]\s*['"`]([^'"`\s]{6,})['"`]/gi,
+            /sk_live_[0-9a-zA-Z]{24,}/g,
+            /gh[pousr]_[0-9a-zA-Z]{36,}/g,
+            /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=secrets.js.map

package/dist/engine/rules/cicd/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../../src/engine/rules/cicd/secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,yCAAyC;IAChD,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,UAAU;IACpB,WAAW,EACT,gLAAgL;IAClL,MAAM,EAAE,gEAAgE;IACxE,WAAW,EACT,kGAAkG;QAClG,oEAAoE;QACpE,qEAAqE;QACrE,4EAA4E;QAC5E,sHAAsH;QACtH,wEAAwE;IAC1E,UAAU,EAAE;QACV,sCAAsC;QACtC,+CAA+C;QAC/C,oFAAoF;KACrF;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,oCAAoC;IAC3C,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC;IACrF,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,mBAAmB;YACnB,wDAAwD;YACxD,8DAA8D;YAC9D,oEAAoE;YACpE,2BAA2B;YAC3B,6BAA6B;YAC7B,gEAAgE;SAC3D,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/engine/rules/database/encryption.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from '../../../types.js';
+declare const rule: Rule;
+export default rule;

package/dist/engine/rules/database/encryption.js

@@ -0,0 +1,37 @@
+import { grepRule } from '../_helpers.js';
+const rule = {
+    id: 'DB-002',
+    title: 'Sensitive data not encrypted at rest (PII / payment / health)',
+    layer: 'database',
+    severity: 'high',
+    description: 'TC kimlik, kredi karti, saglik verisi, parolalar gibi PII alanlari duz metin (plain text) ile saklaniyorsa fiziksel veya yedek sizintisinda aninda okunabilir hale gelir.',
+    threat: 'GDPR / KVKK / PCI-DSS violation, identity theft, regulatory fines',
+    remediation: '1) In-transit: tum baglantilari **TLS 1.2+** ile sifreleyin. Baglanti string\'inde `sslmode=require` veya `ssl=true`. ' +
+        '2) At-rest: kritik kolonlari uygulama seviyesinde **AES-256-GCM** ile sifreleyin (deterministic olmayan, random IV). ' +
+        '3) Veya TDE / column-level encryption (pgcrypto, AWS RDS encryption, MongoDB CSFLE). ' +
+        '4) KMS / Vault ile key\'leri yonetin, kodda saklamayin. ' +
+        '5) Backup\'lar da sifrelenmis olmali. ' +
+        '6) PCI scope\'a giren veriler icin tokenization (Stripe, Adyen) kullanin, ham PAN\'i ASLA saklamayin.',
+    references: [
+        'https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html',
+        'https://www.postgresql.org/docs/current/encryption-options.html',
+        'https://www.pcisecuritystandards.org/',
+    ],
+    cwe: 'CWE-311',
+    owasp: 'A02:2021 Cryptographic Failures',
+    languages: ['javascript', 'typescript', 'python', 'java', 'go'],
+    check: (ctx) => {
+        const patterns = [
+            /(?:nationalId|tckimlik|ssn|socialSecurityNumber|creditCard|cardNumber|cvv|pan|tc_kimlik)\s*[:=]\s*['"`]?String['"`]?/gi,
+            /(?:nationalId|tckimlik|ssn|socialSecurityNumber|creditCard|cardNumber|cvv|pan)\s+(?:String|VARCHAR|TEXT)/g,
+            /(?:postgres|mysql|mongodb):\/\/[^@\s]+@/gi,
+        ];
+        const findings = [];
+        for (const re of patterns) {
+            findings.push(...grepRule(rule, ctx, re));
+        }
+        return findings;
+    },
+};
+export default rule;
+//# sourceMappingURL=encryption.js.map

package/dist/engine/rules/database/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../../src/engine/rules/database/encryption.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,IAAI,GAAS;IACjB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,+DAA+D;IACtE,KAAK,EAAE,UAAU;IACjB,QAAQ,EAAE,MAAM;IAChB,WAAW,EACT,2KAA2K;IAC7K,MAAM,EAAE,mEAAmE;IAC3E,WAAW,EACT,wHAAwH;QACxH,uHAAuH;QACvH,uFAAuF;QACvF,0DAA0D;QAC1D,wCAAwC;QACxC,uGAAuG;IACzG,UAAU,EAAE;QACV,uFAAuF;QACvF,iEAAiE;QACjE,uCAAuC;KACxC;IACD,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,iCAAiC;IACxC,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC/D,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,QAAQ,GAAa;YAC/B,wHAAwH;YAClH,2GAA2G;YACjH,2CAA2C;SACtC,CAAC;QAEF,MAAM,QAAQ,GAAG,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}