@octocodeai/octocode-engine 16.5.0

package/dist/security/regexes/databases.js

@@ -0,0 +1,135 @@
+export const databasePatterns = [
+    {
+        name: 'postgresqlConnectionString',
+        description: 'PostgreSQL connection string with credentials',
+        regex: /\bpostgresql:\/\/[^:]+:[^@]+@[^/\s]+\/[^?\s]+\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mysqlConnectionString',
+        description: 'MySQL connection string with credentials',
+        regex: /\bmysql:\/\/[^:]+:[^@]+@[^/\s]+\/[^?\s]+\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'jdbcConnectionStringWithCredentials',
+        description: 'JDBC connection string with embedded credentials',
+        regex: /\bjdbc:(?:postgresql|mysql):\/\/[^:]+:[^@]+@[^/\s]+\b/gi,
+        matchAccuracy: 'medium',
+        fileContext: /(?:\.env|config|settings|secrets)/i,
+    },
+    {
+        name: 'mongodbConnectionString',
+        description: 'MongoDB connection string with credentials (incl. mongodb+srv://)',
+        regex: /\bmongodb(?:\+srv)?:\/\/[a-zA-Z0-9._%-]+:[a-zA-Z0-9._%-]+@[a-zA-Z0-9._-]+(?::[0-9]+)?(?:\/[a-zA-Z0-9._-]*)?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'redisConnectionString',
+        description: 'Redis connection string with credentials (incl. rediss:// TLS)',
+        regex: /\brediss?:\/\/[a-zA-Z0-9._%-]+:[a-zA-Z0-9._%-]+@[a-zA-Z0-9._-]+:[0-9]+\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'redisAuthPassword',
+        description: 'Redis AUTH password command',
+        regex: /^[ \t]*(?:(?:redis-cli(?:[ \t]+|>)|[a-zA-Z0-9_.-]+:\d+>[ \t]*))?AUTH[ \t]+(?:[a-zA-Z0-9_.@-]+[ \t]+)?[a-zA-Z0-9_-]{8,}\b/gm,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'elasticsearchCredentials',
+        description: 'Elasticsearch credentials in URL',
+        regex: /\bhttps?:\/\/[^:]+:[^@]+@[^/\s]+:9200\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'couchdbCredentials',
+        description: 'CouchDB credentials in URL',
+        regex: /\bhttp[s]?:\/\/[^:]+:[^@]+@[^/\s]+:5984\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'neo4jCredentials',
+        description: 'Neo4j database credentials in URL',
+        regex: /\bbolt[s]?:\/\/[^:]+:[^@]+@[^/\s]+:7687\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'timescaledbConnectionString',
+        description: 'TimescaleDB connection string with credentials',
+        regex: /\btimescaledb:\/\/[^:]+:[^@]+@[^/\s]+\/[^?\s]+\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'clickhouseCredentials',
+        description: 'ClickHouse connection string with credentials',
+        regex: /\bclickhouse:\/\/[^:]+:[^@]+@[^/\s]+:8123\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'cassandraConnectionString',
+        description: 'Cassandra connection string with credentials',
+        regex: /\bcassandra:\/\/[^:]+:[^@]+@[^/\s]+:9042\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'faunadbKey',
+        description: 'FaunaDB secret key',
+        regex: /\bfn[a-zA-Z0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'databricksApiToken',
+        description: 'Databricks API token',
+        regex: /\bdapi[a-f0-9]{32}(?:-\d)?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pineconeApiKey',
+        description: 'Pinecone API key',
+        regex: /\bpinecone[\s\w]*(?:api|key|env)[\s:=]*["']?[a-zA-Z0-9_-]{32}["']?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'databaseUrlWithCredentials',
+        description: 'Generic database URL with embedded credentials',
+        regex: /\b(?:postgres|mysql|mongodb|redis):\/\/[^:]+:[^@]+@[^/\s]+\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'clickhouseCloudApiKey',
+        description: 'ClickHouse Cloud API secret key',
+        regex: /\b4b1d[A-Za-z0-9]{38}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'neonDatabaseConnectionString',
+        description: 'Neon database connection string',
+        regex: /\bpostgres:\/\/[^:]+:[^@]+@[^/\s]*neon\.tech[^?\s]*\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'tursoDatabaseToken',
+        description: 'Turso database auth token',
+        regex: /\b['"]?(?:turso|libsql)(?:[\s\w.-]{0,20})(?:token|auth)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9._-]{50,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'upstashRedisToken',
+        description: 'Upstash Redis REST token',
+        regex: /\b['"]?(?:upstash)(?:[\s\w.-]{0,20})(?:token|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9=]{40,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'supabaseJwtKey',
+        description: 'Supabase anon or service_role key (JWT format)',
+        regex: /\b['"]?(?:SUPABASE|supabase)_?(?:ANON|SERVICE_ROLE|anon|service_role)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?(eyJ[a-zA-Z0-9_-]{100,})['"]?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'cockroachdbConnectionString',
+        description: 'CockroachDB connection string with credentials',
+        regex: /\bpostgresql:\/\/[^:]+:[^@]+@[^/\s]*cockroachlabs\.cloud[^?\s]*\b/gi,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/regexes/devTools.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const developerToolsPatterns: SensitiveDataPattern[];

package/dist/security/regexes/devTools.js

@@ -0,0 +1,236 @@
+export const developerToolsPatterns = [
+    {
+        name: 'npmAccessToken',
+        description: 'NPM access token',
+        regex: /\bnpm_[a-zA-Z0-9]{36}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'nugetApiKey',
+        description: 'NuGet API key',
+        regex: /\boy2[a-z0-9]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'artifactoryApiKey',
+        description: 'JFrog Artifactory API key',
+        regex: /\bAKCp[A-Za-z0-9]{69}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'herokuApiKey',
+        description: 'Heroku API key',
+        regex: /\bheroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'terraformCloudToken',
+        description: 'Terraform Cloud API token',
+        regex: /\b[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9]{16}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pulumiAccessToken',
+        description: 'Pulumi access token',
+        regex: /\bpul-[a-f0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'atlassianApiToken',
+        description: 'Atlassian API token (Jira/Confluence)',
+        regex: /\bATATT3[A-Za-z0-9_\-=]{186}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sourcegraphApiKey',
+        description: 'Sourcegraph API key',
+        regex: /\bsgp_[a-zA-Z0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'linearApiKey',
+        description: 'Linear API key',
+        regex: /\blin_api_[0-9A-Za-z]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'notionIntegrationToken',
+        description: 'Notion integration token (new ntn_ format, post Sept 2024)',
+        regex: /\bntn_[a-zA-Z0-9_-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'notionIntegrationTokenLegacy',
+        description: 'Notion integration token (legacy secret_ format, pre Sept 2024)',
+        regex: /\bsecret_[a-zA-Z0-9]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'stackhawkApiKey',
+        description: 'StackHawk API key',
+        regex: /\bhawk\.[0-9A-Za-z\-_]{20}\.[0-9A-Za-z\-_]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sentryAuthToken',
+        description: 'Sentry authentication token',
+        regex: /\bsentry[\s\w]*(?:auth|token)[\s:=]*["']?[a-f0-9]{64}["']?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'bugsnagApiKey',
+        description: 'Bugsnag API key',
+        regex: /\bbugsnag[\s\w]*(?:api|key)[\s:=]*["']?[a-f0-9]{32}["']?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'rollbarAccessToken',
+        description: 'Rollbar access token',
+        regex: /\brollbar[\s\w]*(?:access|token)[\s:=]*["']?[a-f0-9]{32}["']?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'postmanApiToken',
+        description: 'Postman API token',
+        regex: /\bPMAK-[a-f0-9]{24}-[a-f0-9]{34}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'prefectApiToken',
+        description: 'Prefect API token',
+        regex: /\bpnu_[a-zA-Z0-9]{36}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'readmeApiToken',
+        description: 'Readme API token',
+        regex: /\brdme_[a-z0-9]{70}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'rubygemsApiToken',
+        description: 'RubyGems API token',
+        regex: /\brubygems_[a-f0-9]{48}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'clojarsApiToken',
+        description: 'Clojars API token',
+        regex: /\bCLOJARS_[a-z0-9]{60}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'snykApiToken',
+        description: 'Snyk API token',
+        regex: /\b['"]?(?:snyk[_.-]?(?:(?:api|oauth)[_.-]?)?(?:key|token))['"]?\s*(?::|=>|=)\s*['"]?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sonarqubeToken',
+        description: 'SonarQube/SonarCloud token',
+        regex: /\b(?:squ_|sqp_|sqa_)[a-z0-9=_-]{40}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'travisciAccessToken',
+        description: 'Travis CI access token',
+        regex: /\b['"]?(?:travis)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{22}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'codecovAccessToken',
+        description: 'Codecov access token',
+        regex: /\b['"]?(?:codecov)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'droneCiAccessToken',
+        description: 'DroneCI access token',
+        regex: /\b['"]?(?:droneci|drone)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'octopusDeployApiKey',
+        description: 'Octopus Deploy API key',
+        regex: /\bAPI-[A-Z0-9]{26}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'circleciToken',
+        description: 'CircleCI personal API token',
+        regex: /\b['"]?(?:circleci|circle)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{40}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'buildkiteAgentToken',
+        description: 'Buildkite agent token',
+        regex: /\bbkagent_[a-f0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'launchdarklyAccessToken',
+        description: 'LaunchDarkly access token',
+        regex: /\b['"]?(?:launchdarkly)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9=_-]{40}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'algoliaApiKey',
+        description: 'Algolia API key',
+        regex: /\b['"]?(?:algolia)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'clerkSecretKey',
+        description: 'Clerk secret key',
+        regex: /\bsk_(?:live|test)_[a-zA-Z0-9]{24,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'clerkPublishableKey',
+        description: 'Clerk publishable key',
+        regex: /\bpk_(?:live|test)_[a-zA-Z0-9]{24,}\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'launchdarklySdkKey',
+        description: 'LaunchDarkly SDK key',
+        regex: /\bsdk-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'vercelOidcToken',
+        description: 'Vercel OIDC token',
+        regex: /\b['"]?(?:VERCEL_OIDC_TOKEN)['"]?\s*(?::|=>|=)\s*['"]?eyJ[a-zA-Z0-9_-]{100,}['"]?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'novuApiKey',
+        description: 'Novu API key',
+        regex: /\b['"]?(?:NOVU|novu)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{32,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'triggerDevApiKey',
+        description: 'Trigger.dev API key',
+        regex: /\btr_(?:dev|prod)_[a-zA-Z0-9]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'nxCloudAccessToken',
+        description: 'Nx Cloud access token',
+        regex: /\b['"]?(?:NX_CLOUD_ACCESS_TOKEN|nxCloudAccessToken)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{36,}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'depotToken',
+        description: 'Depot.dev build token',
+        regex: /\bdpt_[a-zA-Z0-9]{40,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'grafbaseApiKey',
+        description: 'Grafbase API key',
+        regex: /\b['"]?(?:GRAFBASE|grafbase)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?eyJ[a-zA-Z0-9_-]{50,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+];

package/dist/security/regexes/index.d.ts

@@ -0,0 +1,3 @@
+import type { SensitiveDataPattern } from './types.js';
+export type { SensitiveDataPattern };
+export declare const allRegexPatterns: SensitiveDataPattern[];

package/dist/security/regexes/index.js

@@ -0,0 +1,31 @@
+import { aiProviderPatterns } from './ai-providers.js';
+import { analyticsModernPatterns } from './analytics.js';
+import { authPatterns, codeConfigPatterns, cryptographicPatterns, privateKeyPatterns, genericSecretPatterns, } from './auth-crypto.js';
+import { awsPatterns } from './aws.js';
+import { cloudProviderPatterns } from './cloudProviders.js';
+import { slackPatterns, socialMediaPatterns, shippingLogisticsPatterns, } from './communications.js';
+import { databasePatterns } from './databases.js';
+import { developerToolsPatterns } from './devTools.js';
+import { mappingMonitoringPatterns } from './monitoring.js';
+import { paymentProviderPatterns, ecommerceContentPatterns, } from './payments-commerce.js';
+import { versionControlPatterns } from './vcs.js';
+export const allRegexPatterns = [
+    ...aiProviderPatterns,
+    ...analyticsModernPatterns,
+    ...authPatterns,
+    ...awsPatterns,
+    ...cloudProviderPatterns,
+    ...codeConfigPatterns,
+    ...cryptographicPatterns,
+    ...databasePatterns,
+    ...developerToolsPatterns,
+    ...ecommerceContentPatterns,
+    ...genericSecretPatterns,
+    ...mappingMonitoringPatterns,
+    ...paymentProviderPatterns,
+    ...privateKeyPatterns,
+    ...shippingLogisticsPatterns,
+    ...slackPatterns,
+    ...socialMediaPatterns,
+    ...versionControlPatterns,
+];

package/dist/security/regexes/monitoring.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const mappingMonitoringPatterns: SensitiveDataPattern[];

package/dist/security/regexes/monitoring.js

@@ -0,0 +1,92 @@
+export const mappingMonitoringPatterns = [
+    {
+        name: 'mapboxSecretToken',
+        description: 'Mapbox secret access token',
+        regex: /\bsk\.eyJ[a-zA-Z0-9._-]{87}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mapboxPublicToken',
+        description: 'Mapbox public access token',
+        regex: /\bpk\.eyJ[a-zA-Z0-9._-]{80,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'grafanaCloudApiKey',
+        description: 'Grafana Cloud API key',
+        regex: /\bglc_[a-zA-Z0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'newRelicApiKey',
+        description: 'New Relic API key',
+        regex: /\bNRAK-[A-Z0-9]{27}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'newRelicInsightKey',
+        description: 'New Relic Insights query key',
+        regex: /\bNRIK-[A-Z0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'newRelicBrowserApiToken',
+        description: 'New Relic browser API token',
+        regex: /\bNRJS-[a-f0-9]{19}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'newRelicInsertKey',
+        description: 'New Relic ingest insert key',
+        regex: /\bNRII-[a-z0-9-]{32}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'grafanaApiKey',
+        description: 'Grafana API key',
+        regex: /\beyJrIjoi[A-Za-z0-9]{70,400}={0,3}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'grafanaServiceAccountToken',
+        description: 'Grafana service account token',
+        regex: /\bglsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sentryOrgToken',
+        description: 'Sentry organization token',
+        regex: /\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sentryUserToken',
+        description: 'Sentry user token',
+        regex: /\bsntryu_[a-f0-9]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sumoLogicAccessId',
+        description: 'SumoLogic access ID',
+        regex: /\b['"]?(?:sumo)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?su[a-zA-Z0-9]{12}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'splunkApiToken',
+        description: 'Splunk HEC token',
+        regex: /\b['"]?(?:splunk)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'logdnaApiKey',
+        description: 'LogDNA/Mezmo API key',
+        regex: /\b['"]?(?:logdna|mezmo)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'logglyToken',
+        description: 'Loggly customer token',
+        regex: /\b['"]?(?:loggly)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+];

package/dist/security/regexes/payments-commerce.d.ts

@@ -0,0 +1,3 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const paymentProviderPatterns: SensitiveDataPattern[];
+export declare const ecommerceContentPatterns: SensitiveDataPattern[];