@methiu/raigal 0.2.6 → 0.2.7

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-DtOeK-2T.js";
+import { t as APP_VERSION } from "./version-CXMYu17z.js";
 import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 import { n as isSecretClassRule, r as maskSecrets, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import { createRequire, isBuiltin } from "node:module";
@@ -1357,7 +1357,28 @@ const isSafeRegularProjectFile = (rootDirectory, absolutePath) => {
 		return false;
 	}
 };
-const hasAllowedSourceExtension = (filePath, extraExtensions) => SOURCE_EXTENSIONS$1.has(path.extname(filePath)) || extraExtensions.has(path.extname(filePath));
+const SECRET_CONFIG_EXTENSIONS = [
+	".env",
+	".yaml",
+	".yml",
+	".json",
+	".toml",
+	".ini",
+	".properties",
+	".tfvars"
+];
+const LOCKFILE_RE = /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|packages\.lock\.json|composer\.lock|bun\.lock)$/i;
+const isDotenvFile = (filePath) => {
+	const base = path.basename(filePath).toLowerCase();
+	return base === ".env" || base.startsWith(".env.");
+};
+const hasAllowedSourceExtension = (filePath, extraExtensions) => {
+	const extension = path.extname(filePath);
+	if (SOURCE_EXTENSIONS$1.has(extension)) return true;
+	if (LOCKFILE_RE.test(filePath)) return false;
+	if (extraExtensions.has(".env") && isDotenvFile(filePath)) return true;
+	return extraExtensions.has(extension);
+};
 const isInExcludedDirectory = (filePath, excludedDirectories) => {
 	const normalized = filePath.toLowerCase();
 	return excludedDirectories.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`) || normalized.includes(`/${directory}/`));
@@ -2588,6 +2609,7 @@ const collectScanFileScope = (request) => {
 		projectFiles: [.../* @__PURE__ */ new Set([...projectSourceFiles, ...declarations])],
 		scoreFileCount: projectSourceFiles.length + projectTestFiles.length,
 		scopeLabel: candidates.label,
+		secretFiles: filterEnumeratedProjectFiles(request.rootDirectory, candidates.files, [...SECRET_CONFIG_EXTENSIONS], request.excludePatterns, request.includePatterns),
 		testFiles
 	};
 };
@@ -14807,13 +14829,19 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /AKIA[0-9A-Z]{16}/g,
-		name: "AWS Access Key"
+		name: "AWS Access Key",
+		specific: true
 	},
 	{
-		pattern: /(?:aws[_-]?secret|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
+		pattern: /(?:aws[_-]?secret(?:[_-]?access)?[_-]?key|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
 		name: "AWS Secret Key",
 		keywordPrefixed: true
 	},
+	{
+		pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}/g,
+		name: "Stripe secret key",
+		specific: true
+	},
 	{
 		pattern: /(?:password|passwd|pwd|secret)\s*[:=]\s*["']([^"']{8,})["']/gi,
 		name: "Hardcoded password/secret",
@@ -14821,11 +14849,13 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
-		name: "Private key"
+		name: "Private key",
+		specific: true
 	},
 	{
 		pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-		name: "JWT token"
+		name: "JWT token",
+		specific: true
 	},
 	{
 		pattern: /(?:token|bearer)\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi,
@@ -14834,17 +14864,51 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
-		name: "GitHub token"
+		name: "GitHub token",
+		specific: true
 	},
 	{
 		pattern: /xox[baprs]-[A-Za-z0-9-]+/g,
-		name: "Slack token"
+		name: "Slack token",
+		specific: true
 	},
 	{
 		pattern: /(?:mongodb(?:\+srv)?|postgres|mysql|redis):\/\/[^:@/"'`\s]+:[^@"'`\s]+@[^"'`\s]+/gi,
-		name: "Database connection string with credentials"
+		name: "Database connection string with credentials",
+		specific: true
 	}
 ];
+const FORMAT_PATTERNS = SECRET_PATTERNS.filter((p) => p.specific);
+const CONFIG_ASSIGNMENT_RE = /([A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey)[A-Za-z0-9_.-]*)["']?[ \t]*[:=][ \t]*["']?([^\s"'#,]+)/gi;
+const CONFIG_REFERENCE_KEY_RE = /(?:name|ref|path|file|arn|id|type|version|url|uri|length|count|env|header|field|prefix|policy|manager|store|provider)$/i;
+const CONFIG_REFERENCE_VALUE_RE = /^[<{$%]/;
+const CONFIG_PLACEHOLDER_VALUE_RE = /^(?:your|example|placeholder|redacted|dummy|xxx)/i;
+const VERSION_VALUE_RE = /^[~^<>=v]*\d+(?:\.\d+)+/;
+const CONFIG_LITERAL_VALUES = /* @__PURE__ */ new Set([
+	"true",
+	"false",
+	"null",
+	"none",
+	"nil"
+]);
+const isConfigFile = (filePath) => isDotenvFile(filePath) || SECRET_CONFIG_EXTENSIONS.includes(path.extname(filePath).toLowerCase());
+const DOTENV_TEMPLATE_RE = /^\.env\.(?:example|sample|template|dist|defaults)$/i;
+const isLocalDatabaseUrl = (value) => {
+	try {
+		return LOCAL_DB_HOSTS.has(new URL(value).hostname.toLowerCase());
+	} catch {
+		return false;
+	}
+};
+const configAssignmentName = (key) => {
+	const lower = key.toLowerCase();
+	if (/aws[_-]?secret/.test(lower)) return "AWS Secret Key";
+	if (/api[_-]?key|apikey/.test(lower)) return "API key";
+	if (/token/.test(lower) && !/password|passwd|pwd|secret/.test(lower)) return "Authentication token";
+	return "Hardcoded password/secret";
+};
+const URL_VALUE_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+const isConfigValueIgnorable = (key, value) => value.length < 8 || URL_VALUE_RE.test(value) || CONFIG_REFERENCE_KEY_RE.test(key) || CONFIG_REFERENCE_VALUE_RE.test(value) || CONFIG_PLACEHOLDER_VALUE_RE.test(value) || VERSION_VALUE_RE.test(value) || CONFIG_LITERAL_VALUES.has(value.toLowerCase()) || isNonProductionCredentialValue(value);
 const isInsideStringLiteral = (content, matchIndex) => {
 	const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
 	const prefix = content.slice(lineStart, matchIndex);
@@ -14989,16 +15053,69 @@ const shouldSkipSecretFinding = (relativePath, name, lineText, matchedText) => {
 	if ((name === "Hardcoded password/secret" || name === "Authentication token") && isSymbolicConstantValue(matchedText)) return true;
 	return false;
 };
+const collectSourceCandidates = (content, relativePath) => {
+	const candidates = [];
+	for (const { pattern, name, keywordPrefixed, specific } of SECRET_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const matchedText = match[1] ?? match[0];
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(matchedText)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
+		if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: Boolean(specific)
+		});
+	}
+	return candidates;
+};
+const collectConfigCandidates = (content, relativePath) => {
+	const candidates = [];
+	const template = DOTENV_TEMPLATE_RE.test(path.posix.basename(relativePath));
+	for (const { pattern, name } of FORMAT_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(match[0])) continue;
+		if (template && isLocalDatabaseUrl(match[0])) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, match[0])) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: true
+		});
+	}
+	for (const match of content.matchAll(new RegExp(CONFIG_ASSIGNMENT_RE.source, CONFIG_ASSIGNMENT_RE.flags))) {
+		const [, key, value] = match;
+		const name = configAssignmentName(key);
+		const lineText = lineForMatch(content, match.index);
+		if (isConfigValueIgnorable(key, value) || isPlaceholderValue(value)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, value)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: false
+		});
+	}
+	return candidates;
+};
+const dedupeCandidates = (candidates) => {
+	const ordered = [...candidates].sort((a, b) => Number(b.specific) - Number(a.specific) || a.start - b.start);
+	const kept = [];
+	for (const candidate of ordered) {
+		if (kept.some((k) => candidate.start < k.end && k.start < candidate.end)) continue;
+		kept.push(candidate);
+	}
+	return kept.sort((a, b) => a.start - b.start);
+};
+const resolveSecretFiles = (context) => {
+	const extras = [...SECRET_CONFIG_EXTENSIONS];
+	return context.secretFiles ? filterExplicitFiles(context.rootDirectory, context.secretFiles, extras) : getSourceFilesWithExtras(context, extras);
+};
 const scanSecrets = async (context) => {
-	const files = getSourceFilesWithExtras(context, [
-		".env",
-		".yaml",
-		".yml",
-		".json",
-		".toml"
-	]);
 	const diagnostics = [];
-	for (const filePath of files) {
+	for (const filePath of resolveSecretFiles(context)) {
 		let content;
 		try {
 			content = fs.readFileSync(filePath, "utf-8");
@@ -15007,30 +15124,20 @@ const scanSecrets = async (context) => {
 		}
 		content = maskComments(content, path.extname(filePath));
 		const relativePath = relativePosix(context.rootDirectory, filePath);
-		for (const { pattern, name, keywordPrefixed } of SECRET_PATTERNS) {
-			const regex = new RegExp(pattern.source, pattern.flags);
-			for (const match of content.matchAll(regex)) {
-				const matchedText = match[1] ?? match[0];
-				const lineText = lineForMatch(content, match.index);
-				if (isPlaceholderValue(matchedText)) continue;
-				if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
-				if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
-				const line = content.slice(0, match.index).split("\n").length;
-				diagnostics.push({
-					filePath: relativePath,
-					engine: "security",
-					rule: "security/hardcoded-secret",
-					severity: "error",
-					message: `Possible ${name} detected in source code`,
-					help: "Move secrets to environment variables or a secrets manager",
-					line,
-					column: 0,
-					category: "Security",
-					fixable: false,
-					redactSource: true
-				});
-			}
-		}
+		const candidates = isConfigFile(filePath) ? collectConfigCandidates(content, relativePath) : collectSourceCandidates(content, relativePath);
+		for (const { name, start } of dedupeCandidates(candidates)) diagnostics.push({
+			filePath: relativePath,
+			engine: "security",
+			rule: "security/hardcoded-secret",
+			severity: "error",
+			message: `Possible ${name} detected in source code`,
+			help: "Move secrets to environment variables or a secrets manager",
+			line: content.slice(0, start).split("\n").length,
+			column: 0,
+			category: "Security",
+			fixable: false,
+			redactSource: true
+		});
 	}
 	return diagnostics;
 };
@@ -16311,7 +16418,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
+	iss: z.literal("https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -16419,14 +16526,6 @@ const fetchEntitlementFromApi = async (token, oidcToken, orgId) => {
 const EMBEDDED_PUBLIC_KEYS = { rgl_key_2026_1: "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA69B+1w8c4yJpEURW4Ps2b4BZcoIzeBg3jkCfIo2n2eM=\n-----END PUBLIC KEY-----" };
 const keyObjectCache = /* @__PURE__ */ new Map();
 const getPublicKey = (kid) => {
-	if (process.env.RAIGAL_KEY_ID === kid && process.env.RAIGAL_PUBLIC_KEY) {
-		const customKey = process.env.RAIGAL_PUBLIC_KEY.replace(/\\n/g, "\n");
-		try {
-			return createPublicKey(customKey);
-		} catch {
-			return null;
-		}
-	}
 	const cached = keyObjectCache.get(kid);
 	if (cached) return cached;
 	const pem = EMBEDDED_PUBLIC_KEYS[kid];
@@ -16486,9 +16585,8 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const parsed = EntitlementClaims.safeParse(rawPayload);
 	if (!parsed.success) throw new JwtVerificationError(`Invalid entitlement claims: ${parsed.error.message}`, "invalid_claims");
 	const claims = parsed.data;
-	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
-	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.6", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (claims.iss !== "https://app.raigal.dev") throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
+	if (!isVersionAtLeast("0.2.7", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -19829,22 +19927,10 @@ const printEngineStatus = (result) => {
 	}
 };
 //#endregion
-//#region src/commands/scan-hook-nudge.ts
-const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
-const buildHookNudge = (ctx) => {
-	if (!shouldShowHookNudge(ctx)) return null;
-	return [
-		"",
-		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
-		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
-		""
-	].join("\n");
-};
-//#endregion
 //#region src/commands/scan-coverage.ts
 const coverageReason = (c) => {
 	if (c.supportedFiles === 0 && c.dominantUnsupported) return `This repository is ${c.dominantUnsupported} (${c.unsupportedFiles} files), which Raigal does not analyze. No score — it would not reflect this code.`;
-	if (c.supportedFiles === 0) return "No files in a language Raigal analyzes (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP, Java). Nothing to score.";
+	if (c.supportedFiles === 0) return "No files in a language Raigal analyzes (TypeScript, JavaScript, Python, Go, Rust, Ruby, PHP, C#, C/C++). Nothing to score.";
 	const lang = c.dominantUnsupported ?? "an unsupported language";
 	const files = `${c.supportedFiles} supported file${c.supportedFiles === 1 ? "" : "s"}`;
 	return `This repository is mostly ${lang} (${c.unsupportedFiles} files); Raigal analyzed only ${files}. Score withheld — it would represent a sliver of the codebase.`;
@@ -20045,6 +20131,18 @@ const computeScanExitCode = (opts) => {
 */
 const computeCiExitCode = (opts) => opts.hasErrors || opts.scoreable && opts.score < opts.failBelow ? 1 : 0;
 //#endregion
+//#region src/commands/scan-hook-nudge.ts
+const shouldShowHookNudge = (ctx) => ctx.isTty && !ctx.isCi && ctx.installedAgentCount === 0;
+const buildHookNudge = (ctx) => {
+	if (!shouldShowHookNudge(ctx)) return null;
+	return [
+		"",
+		"Next: install the per-edit hook so your coding agent fixes slop before it lands.",
+		ctx.invocation === "raigal" ? "  raigal hook install" : "  npm install -g @methiu/raigal && raigal hook install",
+		""
+	].join("\n");
+};
+//#endregion
 //#region src/output/rule-labels.ts
 const RULE_LABELS = {
 	formatting: "Code not formatted",
@@ -20556,7 +20654,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 	const projectName = projectInfo.projectName ?? "project";
 	const language = projectInfo.languages[0] ?? "unknown";
 	const printedHumanHeader = !machineOutput && showHeader;
-	const { dependencyAuditFiles, dependencyAuditScope, files, projectFiles, scoreFileCount, scopeLabel, testFiles } = scanScope;
+	const { dependencyAuditFiles, dependencyAuditScope, files, projectFiles, scoreFileCount, scopeLabel, secretFiles, testFiles } = scanScope;
 	const excludePatterns = [...config.exclude, ...readAislopIgnorePatterns(resolvedDir)];
 	const scanCoverage = deriveScanCoverage(projectInfo.coverage, scoreFileCount);
 	const reportProjectInfo = {
@@ -20597,6 +20695,7 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		excludePatterns,
 		testFiles,
 		projectFiles,
+		secretFiles,
 		installedTools: projectInfo.installedTools,
 		config: engineConfig
 	}, config.engines, machineOutput)).map((result) => ({
@@ -20663,12 +20762,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-Cu7Rm1Ma.js");
+		const { buildSarifLog } = await import("./sarif-CpMse0iL.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-DxIA7CCt.js");
+		const { buildJsonOutput } = await import("./json-B2Kc7_rw.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;

package/dist/{json-DxIA7CCt.js → json-B2Kc7_rw.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-DtOeK-2T.js";
+import { t as APP_VERSION } from "./version-CXMYu17z.js";
 import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-CGpt5YUR.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {

package/dist/mcp.js

@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.2.6";
+const APP_VERSION = "0.2.7";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -185,7 +185,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
+	iss: z.literal("https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -293,14 +293,6 @@ const fetchEntitlementFromApi = async (token, oidcToken, orgId) => {
 const EMBEDDED_PUBLIC_KEYS = { rgl_key_2026_1: "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA69B+1w8c4yJpEURW4Ps2b4BZcoIzeBg3jkCfIo2n2eM=\n-----END PUBLIC KEY-----" };
 const keyObjectCache = /* @__PURE__ */ new Map();
 const getPublicKey = (kid) => {
-	if (process.env.RAIGAL_KEY_ID === kid && process.env.RAIGAL_PUBLIC_KEY) {
-		const customKey = process.env.RAIGAL_PUBLIC_KEY.replace(/\\n/g, "\n");
-		try {
-			return createPublicKey(customKey);
-		} catch {
-			return null;
-		}
-	}
 	const cached = keyObjectCache.get(kid);
 	if (cached) return cached;
 	const pem = EMBEDDED_PUBLIC_KEYS[kid];
@@ -360,9 +352,8 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const parsed = EntitlementClaims.safeParse(rawPayload);
 	if (!parsed.success) throw new JwtVerificationError(`Invalid entitlement claims: ${parsed.error.message}`, "invalid_claims");
 	const claims = parsed.data;
-	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
-	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.2.6", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (claims.iss !== "https://app.raigal.dev") throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
+	if (!isVersionAtLeast("0.2.7", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -1872,7 +1863,28 @@ const isSafeRegularProjectFile = (rootDirectory, absolutePath) => {
 		return false;
 	}
 };
-const hasAllowedSourceExtension = (filePath, extraExtensions) => SOURCE_EXTENSIONS$1.has(path.extname(filePath)) || extraExtensions.has(path.extname(filePath));
+const SECRET_CONFIG_EXTENSIONS = [
+	".env",
+	".yaml",
+	".yml",
+	".json",
+	".toml",
+	".ini",
+	".properties",
+	".tfvars"
+];
+const LOCKFILE_RE = /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|packages\.lock\.json|composer\.lock|bun\.lock)$/i;
+const isDotenvFile = (filePath) => {
+	const base = path.basename(filePath).toLowerCase();
+	return base === ".env" || base.startsWith(".env.");
+};
+const hasAllowedSourceExtension = (filePath, extraExtensions) => {
+	const extension = path.extname(filePath);
+	if (SOURCE_EXTENSIONS$1.has(extension)) return true;
+	if (LOCKFILE_RE.test(filePath)) return false;
+	if (extraExtensions.has(".env") && isDotenvFile(filePath)) return true;
+	return extraExtensions.has(extension);
+};
 const isInExcludedDirectory = (filePath, excludedDirectories) => {
 	const normalized = filePath.toLowerCase();
 	return excludedDirectories.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`) || normalized.includes(`/${directory}/`));
@@ -13796,13 +13808,19 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /AKIA[0-9A-Z]{16}/g,
-		name: "AWS Access Key"
+		name: "AWS Access Key",
+		specific: true
 	},
 	{
-		pattern: /(?:aws[_-]?secret|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
+		pattern: /(?:aws[_-]?secret(?:[_-]?access)?[_-]?key|secret[_-]?key)\s*[:=]\s*["']([A-Za-z0-9/+=]{40})["']/gi,
 		name: "AWS Secret Key",
 		keywordPrefixed: true
 	},
+	{
+		pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}/g,
+		name: "Stripe secret key",
+		specific: true
+	},
 	{
 		pattern: /(?:password|passwd|pwd|secret)\s*[:=]\s*["']([^"']{8,})["']/gi,
 		name: "Hardcoded password/secret",
@@ -13810,11 +13828,13 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/g,
-		name: "Private key"
+		name: "Private key",
+		specific: true
 	},
 	{
 		pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-		name: "JWT token"
+		name: "JWT token",
+		specific: true
 	},
 	{
 		pattern: /(?:token|bearer)\s*[:=]\s*["']([A-Za-z0-9_-]{20,})["']/gi,
@@ -13823,17 +13843,51 @@ const SECRET_PATTERNS = [
 	},
 	{
 		pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
-		name: "GitHub token"
+		name: "GitHub token",
+		specific: true
 	},
 	{
 		pattern: /xox[baprs]-[A-Za-z0-9-]+/g,
-		name: "Slack token"
+		name: "Slack token",
+		specific: true
 	},
 	{
 		pattern: /(?:mongodb(?:\+srv)?|postgres|mysql|redis):\/\/[^:@/"'`\s]+:[^@"'`\s]+@[^"'`\s]+/gi,
-		name: "Database connection string with credentials"
+		name: "Database connection string with credentials",
+		specific: true
 	}
 ];
+const FORMAT_PATTERNS = SECRET_PATTERNS.filter((p) => p.specific);
+const CONFIG_ASSIGNMENT_RE = /([A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey)[A-Za-z0-9_.-]*)["']?[ \t]*[:=][ \t]*["']?([^\s"'#,]+)/gi;
+const CONFIG_REFERENCE_KEY_RE = /(?:name|ref|path|file|arn|id|type|version|url|uri|length|count|env|header|field|prefix|policy|manager|store|provider)$/i;
+const CONFIG_REFERENCE_VALUE_RE = /^[<{$%]/;
+const CONFIG_PLACEHOLDER_VALUE_RE = /^(?:your|example|placeholder|redacted|dummy|xxx)/i;
+const VERSION_VALUE_RE = /^[~^<>=v]*\d+(?:\.\d+)+/;
+const CONFIG_LITERAL_VALUES = /* @__PURE__ */ new Set([
+	"true",
+	"false",
+	"null",
+	"none",
+	"nil"
+]);
+const isConfigFile = (filePath) => isDotenvFile(filePath) || SECRET_CONFIG_EXTENSIONS.includes(path.extname(filePath).toLowerCase());
+const DOTENV_TEMPLATE_RE = /^\.env\.(?:example|sample|template|dist|defaults)$/i;
+const isLocalDatabaseUrl = (value) => {
+	try {
+		return LOCAL_DB_HOSTS.has(new URL(value).hostname.toLowerCase());
+	} catch {
+		return false;
+	}
+};
+const configAssignmentName = (key) => {
+	const lower = key.toLowerCase();
+	if (/aws[_-]?secret/.test(lower)) return "AWS Secret Key";
+	if (/api[_-]?key|apikey/.test(lower)) return "API key";
+	if (/token/.test(lower) && !/password|passwd|pwd|secret/.test(lower)) return "Authentication token";
+	return "Hardcoded password/secret";
+};
+const URL_VALUE_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
+const isConfigValueIgnorable = (key, value) => value.length < 8 || URL_VALUE_RE.test(value) || CONFIG_REFERENCE_KEY_RE.test(key) || CONFIG_REFERENCE_VALUE_RE.test(value) || CONFIG_PLACEHOLDER_VALUE_RE.test(value) || VERSION_VALUE_RE.test(value) || CONFIG_LITERAL_VALUES.has(value.toLowerCase()) || isNonProductionCredentialValue(value);
 const isInsideStringLiteral = (content, matchIndex) => {
 	const lineStart = content.lastIndexOf("\n", matchIndex - 1) + 1;
 	const prefix = content.slice(lineStart, matchIndex);
@@ -13978,16 +14032,69 @@ const shouldSkipSecretFinding = (relativePath, name, lineText, matchedText) => {
 	if ((name === "Hardcoded password/secret" || name === "Authentication token") && isSymbolicConstantValue(matchedText)) return true;
 	return false;
 };
+const collectSourceCandidates = (content, relativePath) => {
+	const candidates = [];
+	for (const { pattern, name, keywordPrefixed, specific } of SECRET_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const matchedText = match[1] ?? match[0];
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(matchedText)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
+		if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: Boolean(specific)
+		});
+	}
+	return candidates;
+};
+const collectConfigCandidates = (content, relativePath) => {
+	const candidates = [];
+	const template = DOTENV_TEMPLATE_RE.test(path.posix.basename(relativePath));
+	for (const { pattern, name } of FORMAT_PATTERNS) for (const match of content.matchAll(new RegExp(pattern.source, pattern.flags))) {
+		const lineText = lineForMatch(content, match.index);
+		if (isPlaceholderValue(match[0])) continue;
+		if (template && isLocalDatabaseUrl(match[0])) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, match[0])) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: true
+		});
+	}
+	for (const match of content.matchAll(new RegExp(CONFIG_ASSIGNMENT_RE.source, CONFIG_ASSIGNMENT_RE.flags))) {
+		const [, key, value] = match;
+		const name = configAssignmentName(key);
+		const lineText = lineForMatch(content, match.index);
+		if (isConfigValueIgnorable(key, value) || isPlaceholderValue(value)) continue;
+		if (shouldSkipSecretFinding(relativePath, name, lineText, value)) continue;
+		candidates.push({
+			name,
+			start: match.index,
+			end: match.index + match[0].length,
+			specific: false
+		});
+	}
+	return candidates;
+};
+const dedupeCandidates = (candidates) => {
+	const ordered = [...candidates].sort((a, b) => Number(b.specific) - Number(a.specific) || a.start - b.start);
+	const kept = [];
+	for (const candidate of ordered) {
+		if (kept.some((k) => candidate.start < k.end && k.start < candidate.end)) continue;
+		kept.push(candidate);
+	}
+	return kept.sort((a, b) => a.start - b.start);
+};
+const resolveSecretFiles = (context) => {
+	const extras = [...SECRET_CONFIG_EXTENSIONS];
+	return context.secretFiles ? filterExplicitFiles(context.rootDirectory, context.secretFiles, extras) : getSourceFilesWithExtras(context, extras);
+};
 const scanSecrets = async (context) => {
-	const files = getSourceFilesWithExtras(context, [
-		".env",
-		".yaml",
-		".yml",
-		".json",
-		".toml"
-	]);
 	const diagnostics = [];
-	for (const filePath of files) {
+	for (const filePath of resolveSecretFiles(context)) {
 		let content;
 		try {
 			content = fs.readFileSync(filePath, "utf-8");
@@ -13996,30 +14103,20 @@ const scanSecrets = async (context) => {
 		}
 		content = maskComments(content, path.extname(filePath));
 		const relativePath = relativePosix(context.rootDirectory, filePath);
-		for (const { pattern, name, keywordPrefixed } of SECRET_PATTERNS) {
-			const regex = new RegExp(pattern.source, pattern.flags);
-			for (const match of content.matchAll(regex)) {
-				const matchedText = match[1] ?? match[0];
-				const lineText = lineForMatch(content, match.index);
-				if (isPlaceholderValue(matchedText)) continue;
-				if (shouldSkipSecretFinding(relativePath, name, lineText, matchedText)) continue;
-				if (keywordPrefixed && isInsideStringLiteral(content, match.index)) continue;
-				const line = content.slice(0, match.index).split("\n").length;
-				diagnostics.push({
-					filePath: relativePath,
-					engine: "security",
-					rule: "security/hardcoded-secret",
-					severity: "error",
-					message: `Possible ${name} detected in source code`,
-					help: "Move secrets to environment variables or a secrets manager",
-					line,
-					column: 0,
-					category: "Security",
-					fixable: false,
-					redactSource: true
-				});
-			}
-		}
+		const candidates = isConfigFile(filePath) ? collectConfigCandidates(content, relativePath) : collectSourceCandidates(content, relativePath);
+		for (const { name, start } of dedupeCandidates(candidates)) diagnostics.push({
+			filePath: relativePath,
+			engine: "security",
+			rule: "security/hardcoded-secret",
+			severity: "error",
+			message: `Possible ${name} detected in source code`,
+			help: "Move secrets to environment variables or a secrets manager",
+			line: content.slice(0, start).split("\n").length,
+			column: 0,
+			category: "Security",
+			fixable: false,
+			redactSource: true
+		});
 	}
 	return diagnostics;
 };

package/dist/{sarif-Cu7Rm1Ma.js → sarif-CpMse0iL.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-DtOeK-2T.js";
+import { t as APP_VERSION } from "./version-CXMYu17z.js";
 import { n as isSecretClassRule, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import path from "node:path";
 //#region src/output/sarif.ts