@quantakrypto/core 0.2.2 → 0.4.0

package/dist/detectors/go.js

@@ -0,0 +1,132 @@
+import { GO_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/* -------------------------------------------------------------------------- */
+/* Precompiled regexes (module scope)                                         */
+/* -------------------------------------------------------------------------- */
+const RE_GO_RSA_KEYGEN = /\brsa\.GenerateKey\s*\(|\brsa\.GenerateMultiPrimeKey\s*\(/g;
+const RE_GO_RSA_ENCRYPT = /\brsa\.EncryptOAEP\s*\(|\brsa\.EncryptPKCS1v15\s*\(/g;
+const RE_GO_RSA_SIGN = /\brsa\.SignPKCS1v15\s*\(|\brsa\.SignPSS\s*\(/g;
+const RE_GO_ECDSA = /\becdsa\.GenerateKey\s*\(|\becdsa\.SignASN1\s*\(|\becdsa\.Sign\s*\(/g;
+const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521|X25519)\s*\(/g;
+const RE_GO_ED25519 = /\bed25519\.GenerateKey\s*\(|\bed25519\.Sign\s*\(/g;
+const RE_GO_DSA = /\bdsa\.GenerateKey\s*\(|\bdsa\.GenerateParameters\s*\(/g;
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+const RULE_GO_RSA_KEYGEN = {
+    id: "go-rsa-keygen",
+    title: "Go RSA key generation",
+    description: "crypto/rsa GenerateKey / GenerateMultiPrimeKey",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical RSA key pair (Go), which is not quantum-safe.",
+};
+const RULE_GO_RSA_ENCRYPT = {
+    id: "go-rsa-encrypt",
+    title: "Go RSA public-key encryption",
+    description: "crypto/rsa EncryptOAEP / EncryptPKCS1v15",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption (Go) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.",
+};
+const RULE_GO_RSA_SIGN = {
+    id: "go-rsa-sign",
+    title: "Go RSA signature",
+    description: "crypto/rsa SignPKCS1v15 / SignPSS",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signing (Go) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDSA = {
+    id: "go-ecdsa",
+    title: "Go ECDSA key/signature",
+    description: "crypto/ecdsa GenerateKey / Sign / SignASN1",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA (Go) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDH = {
+    id: "go-ecdh",
+    title: "Go ECDH key exchange",
+    description: "crypto/ecdh P256/P384/P521/X25519 key agreement",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (Go crypto/ecdh) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_GO_ED25519 = {
+    id: "go-ed25519",
+    title: "Go Ed25519 signature",
+    description: "crypto/ed25519 GenerateKey / Sign",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519 (Go) is a modern but still classical signature scheme.",
+};
+const RULE_GO_DSA = {
+    id: "go-dsa",
+    title: "Go DSA key/usage",
+    description: "crypto/dsa GenerateKey / GenerateParameters",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical DSA (Go) is deprecated and forgeable by a quantum attacker.",
+    remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+/** Detects classical asymmetric crypto in Go source (crypto/* standard library). */
+export const goDetector = {
+    id: "go-crypto",
+    description: "Classical asymmetric crypto in Go (crypto/rsa, ecdsa, ecdh, ed25519, dsa)",
+    scope: "source",
+    language: "go",
+    rules: [
+        RULE_GO_RSA_KEYGEN,
+        RULE_GO_RSA_ENCRYPT,
+        RULE_GO_RSA_SIGN,
+        RULE_GO_ECDSA,
+        RULE_GO_ECDH,
+        RULE_GO_ED25519,
+        RULE_GO_DSA,
+    ],
+    appliesTo: (f) => hasExtension(f, GO_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_GO_RSA_KEYGEN, RULE_GO_RSA_KEYGEN);
+        add(RE_GO_RSA_ENCRYPT, RULE_GO_RSA_ENCRYPT);
+        add(RE_GO_RSA_SIGN, RULE_GO_RSA_SIGN);
+        add(RE_GO_ECDSA, RULE_GO_ECDSA);
+        add(RE_GO_ECDH, RULE_GO_ECDH);
+        add(RE_GO_ED25519, RULE_GO_ED25519);
+        add(RE_GO_DSA, RULE_GO_DSA);
+        return findings;
+    },
+};
+//# sourceMappingURL=go.js.map

package/dist/detectors/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../src/detectors/go.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AACjF,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,WAAW,GAAG,sEAAsE,CAAC;AAC3F,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAC1E,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAE5E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,qEAAqE;CAC/E,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wGAAwG;CAC3G,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;IACzE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0DAA0D;IACnE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2GAA2G;CAC9G,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;CAC1E,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,uEAAuE;IAChF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,gBAAgB;QAChB,aAAa;QACb,YAAY;QACZ,eAAe;QACf,WAAW;KACZ;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAE5B,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/java.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source-code detector for classical, non-quantum-safe asymmetric cryptography
+ * in Java / Kotlin (the JCA — Java Cryptography Architecture). Same lexical
+ * strategy as the other language packs.
+ *
+ * The JCA funnels almost everything through a handful of factory methods keyed
+ * by an ALGORITHM STRING: `KeyPairGenerator.getInstance("RSA")`,
+ * `Signature.getInstance("SHA256withECDSA")`, `Cipher.getInstance("RSA/ECB/…")`,
+ * `KeyAgreement.getInstance("ECDH")`. So detection here is two steps: match the
+ * `<Factory>.getInstance("<alg>")` call, then classify the (factory, alg) pair
+ * into a rule. Symmetric / hashing algorithms ("AES", "HmacSHA256", …) classify
+ * to nothing and are ignored. A small set of BouncyCastle lightweight-API class
+ * names (`new ECDSASigner()`, `new X25519Agreement()`, …) is matched directly.
+ *
+ * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,
+ * (EC)DH, X25519/X448) is harvest-now-decrypt-later exposed (hndl:true);
+ * signatures (RSA/ECDSA/DSA/EdDSA) are hndl:false but forgeable by a quantum
+ * attacker. `KeyPairGenerator.getInstance("EC")` is ambiguous (an EC key feeds
+ * both ECDSA and ECDH), so it is classified conservatively as
+ * key-exchange-capable (hndl:true), exactly as the Node/Python EC keygen rules.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
+export declare const javaDetector: Detector;
+//# sourceMappingURL=java.d.ts.map

package/dist/detectors/java.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.d.ts","sourceRoot":"","sources":["../../src/detectors/java.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8K/D,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QAsC1B,CAAC"}

package/dist/detectors/java.js

@@ -0,0 +1,200 @@
+import { JAVA_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/* -------------------------------------------------------------------------- */
+/* Regexes                                                                    */
+/* -------------------------------------------------------------------------- */
+// <Factory>.getInstance("<alg>") — the JCA entry points that carry asymmetric
+// algorithms. KeyGenerator/MessageDigest/Mac are intentionally excluded (they
+// are symmetric / hashing only).
+const RE_JAVA_GETINSTANCE = /\b(KeyPairGenerator|Signature|Cipher|KeyAgreement|KeyFactory)\s*\.\s*getInstance\s*\(\s*"([^"]+)"/g;
+// BouncyCastle lightweight-API class instantiations.
+const RE_JAVA_BC = /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement)\s*\(/g;
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+const RULE_JAVA_RSA = {
+    id: "java-rsa",
+    title: "Java RSA key/encryption",
+    description: "JCA RSA KeyPairGenerator / Cipher / KeyFactory",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA (Java/JCA) is not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_JAVA_RSA_SIGN = {
+    id: "java-rsa-sign",
+    title: "Java RSA signature",
+    description: 'JCA Signature.getInstance("…withRSA")',
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signing (Java/JCA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_JAVA_EC_KEYGEN = {
+    id: "java-ec-keygen",
+    title: "Java EC key generation",
+    description: 'JCA KeyPairGenerator.getInstance("EC")',
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical EC key pair (Java/JCA). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_JAVA_ECDSA_SIGN = {
+    id: "java-ecdsa-sign",
+    title: "Java ECDSA signature",
+    description: 'JCA Signature.getInstance("…withECDSA")',
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA signing (Java/JCA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_JAVA_ECDH = {
+    id: "java-ecdh",
+    title: "Java ECDH key agreement",
+    description: 'JCA KeyAgreement.getInstance("ECDH")',
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (Java/JCA) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_JAVA_DSA = {
+    id: "java-dsa",
+    title: "Java DSA key/signature",
+    description: "JCA DSA KeyPairGenerator / Signature",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical DSA (Java/JCA) is deprecated and forgeable by a quantum attacker.",
+    remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_JAVA_DH = {
+    id: "java-dh",
+    title: "Java Diffie-Hellman key exchange",
+    description: "JCA DiffieHellman KeyPairGenerator / KeyAgreement",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman (Java/JCA) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_JAVA_XDH = {
+    id: "java-xdh",
+    title: "Java X25519/X448 key agreement",
+    description: "JCA XDH / X25519 / X448 (KeyPairGenerator / KeyAgreement)",
+    category: "key-exchange",
+    severity: "low",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519/X448 (Java/JCA) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_EDDSA = {
+    id: "java-eddsa",
+    title: "Java Ed25519/Ed448 signature",
+    description: "JCA EdDSA / Ed25519 / Ed448",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519/Ed448 (Java/JCA) is a modern but still classical signature scheme.",
+};
+/**
+ * Classify a `<factory>.getInstance("<alg>")` pair into a rule, or null when the
+ * algorithm is not classical asymmetric crypto (AES, HMAC, PBKDF2, hashes, …).
+ * `alg` is normalised to upper-case with any Cipher transformation suffix
+ * (`RSA/ECB/OAEPPadding` → `RSA`) stripped.
+ */
+function classifyGetInstance(factory, rawAlg) {
+    const alg = rawAlg.split("/")[0].trim().toUpperCase();
+    const isSignature = factory === "Signature";
+    if (alg.includes("ECDSA"))
+        return RULE_JAVA_ECDSA_SIGN;
+    if (alg.includes("ECDH"))
+        return RULE_JAVA_ECDH;
+    if (alg === "EC")
+        return isSignature ? RULE_JAVA_ECDSA_SIGN : RULE_JAVA_EC_KEYGEN;
+    if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
+        return RULE_JAVA_EDDSA;
+    if (alg.includes("X25519") || alg.includes("X448") || alg === "XDH")
+        return RULE_JAVA_XDH;
+    if (alg.includes("RSA"))
+        return isSignature ? RULE_JAVA_RSA_SIGN : RULE_JAVA_RSA;
+    if (alg.includes("DSA"))
+        return RULE_JAVA_DSA; // ECDSA already handled above
+    if (alg.includes("DH") || alg.includes("DIFFIEHELLMAN"))
+        return RULE_JAVA_DH;
+    return null;
+}
+/** BouncyCastle lightweight-API class name → rule. */
+const BC_CLASS_RULES = {
+    RSAKeyPairGenerator: RULE_JAVA_RSA,
+    DSAKeyPairGenerator: RULE_JAVA_DSA,
+    ECKeyPairGenerator: RULE_JAVA_EC_KEYGEN,
+    ECDSASigner: RULE_JAVA_ECDSA_SIGN,
+    Ed25519Signer: RULE_JAVA_EDDSA,
+    Ed448Signer: RULE_JAVA_EDDSA,
+    X25519Agreement: RULE_JAVA_XDH,
+    X448Agreement: RULE_JAVA_XDH,
+};
+/** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
+export const javaDetector = {
+    id: "java-crypto",
+    description: "Classical asymmetric crypto in Java/Kotlin (JCA getInstance + BouncyCastle)",
+    scope: "source",
+    language: "java",
+    rules: [
+        RULE_JAVA_RSA,
+        RULE_JAVA_RSA_SIGN,
+        RULE_JAVA_EC_KEYGEN,
+        RULE_JAVA_ECDSA_SIGN,
+        RULE_JAVA_ECDH,
+        RULE_JAVA_DSA,
+        RULE_JAVA_DH,
+        RULE_JAVA_XDH,
+        RULE_JAVA_EDDSA,
+    ],
+    appliesTo: (f) => hasExtension(f, JAVA_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        eachMatch(RE_JAVA_GETINSTANCE, content, (m) => {
+            const rule = classifyGetInstance(m[1], m[2]);
+            if (!rule)
+                return; // symmetric / hashing algorithm — not our concern.
+            findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }));
+        });
+        eachMatch(RE_JAVA_BC, content, (m) => {
+            const rule = BC_CLASS_RULES[m[1]];
+            if (!rule)
+                return;
+            findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }));
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=java.js.map

package/dist/detectors/java.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.js","sourceRoot":"","sources":["../../src/detectors/java.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,8EAA8E;AAC9E,8EAA8E;AAC9E,iCAAiC;AACjC,MAAM,mBAAmB,GACvB,oGAAoG,CAAC;AAEvG,qDAAqD;AACrD,MAAM,UAAU,GACd,gJAAgJ,CAAC;AAEnJ,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,kFAAkF;CAC5F,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,uCAAuC;IACpD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;IAC/E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8JAA8J;IAChK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wEAAwE;IACjF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qGAAqG;CACxG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,mDAAmD;IAChE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;CACtG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,2DAA2D;IACxE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,6BAA6B;IAC1C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,4EAA4E;CACtF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,MAAc;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,KAAK,WAAW,CAAC;IAE5C,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACvD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAClF,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3E,OAAO,eAAe,CAAC;IACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,CAAC,8BAA8B;IAC7E,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,cAAc,GAA6B;IAC/C,mBAAmB,EAAE,aAAa;IAClC,mBAAmB,EAAE,aAAa;IAClC,kBAAkB,EAAE,mBAAmB;IACvC,WAAW,EAAE,oBAAoB;IACjC,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,aAAa;IAC9B,aAAa,EAAE,aAAa;CAC7B,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE;QACL,aAAa;QACb,kBAAkB;QAClB,mBAAmB;QACnB,oBAAoB;QACpB,cAAc;QACd,aAAa;QACb,YAAY;QACZ,aAAa;QACb,eAAe;KAChB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,mDAAmD;YACtE,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/pem.d.ts

@@ -2,6 +2,10 @@
  * Config / certificate detector: finds PEM-encoded cryptographic material in
  * any text file (source, config, .pem, .key, .crt, .env, …). This catches
  * embedded private keys and X.509 certificates regardless of language.
+ *
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below (the
+ * catalog entry); `detect()` builds findings straight from it via
+ * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.
  */
 import type { Detector } from "../types.js";
 /** Detects PEM key/certificate material in arbitrary files. */

package/dist/detectors/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,aAAa,CAAC;AA+HrD,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QAqCzB,CAAC"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwJ/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}

package/dist/detectors/pem.js

@@ -1,107 +1,139 @@
-import { eachMatch, makeFinding } from "../detect-utils.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from "../cwe.js";
 const PEM_RULES = [
     {
         re: /-----BEGIN RSA PRIVATE KEY-----/g,
-        ruleId: "pem-rsa-private-key",
-        title: "RSA private key (PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "RSA",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
-        remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+        meta: {
+            id: "pem-rsa-private-key",
+            title: "RSA private key (PEM)",
+            description: "PKCS#1 RSA private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
+            remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+        },
     },
     {
         re: /-----BEGIN EC PRIVATE KEY-----/g,
-        ruleId: "pem-ec-private-key",
-        title: "EC private key (PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "ECDSA",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
-        remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+        meta: {
+            id: "pem-ec-private-key",
+            title: "EC private key (PEM)",
+            description: "SEC1 EC private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "ECDSA",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
+            remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+        },
     },
     {
         re: /-----BEGIN DSA PRIVATE KEY-----/g,
-        ruleId: "pem-dsa-private-key",
-        title: "DSA private key (PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "DSA",
-        hndl: false,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
-        remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+        meta: {
+            id: "pem-dsa-private-key",
+            title: "DSA private key (PEM)",
+            description: "DSA private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "DSA",
+            hndl: false,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
+            remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+        },
     },
     {
         re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
-        ruleId: "pem-openssh-private-key",
-        title: "OpenSSH private key",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
-        remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+        meta: {
+            id: "pem-openssh-private-key",
+            title: "OpenSSH private key",
+            description: "OpenSSH private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
+            remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+        },
     },
     {
         re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
-        ruleId: "pem-pgp-private-key",
-        title: "PGP/GPG private key block",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
-        remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+        meta: {
+            id: "pem-pgp-private-key",
+            title: "PGP/GPG private key block",
+            description: "OpenPGP private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
+            remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+        },
     },
     {
         re: /-----BEGIN PGP MESSAGE-----/g,
-        ruleId: "pem-pgp-message",
-        title: "PGP/GPG encrypted message",
-        category: "certificate",
-        severity: "low",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_BROKEN_CRYPTO,
-        message: "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
-        remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+        meta: {
+            id: "pem-pgp-message",
+            title: "PGP/GPG encrypted message",
+            description: "OpenPGP encrypted message block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
+            remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+        },
     },
     {
         re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,
-        ruleId: "pem-pkcs8-private-key",
-        title: "Private key (PKCS#8 PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
-        remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+        meta: {
+            id: "pem-pkcs8-private-key",
+            title: "Private key (PKCS#8 PEM)",
+            description: "PKCS#8 private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
+            remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+        },
     },
     {
         re: /-----BEGIN CERTIFICATE-----/g,
-        ruleId: "pem-certificate",
-        title: "X.509 certificate (PEM)",
-        category: "certificate",
-        severity: "low",
-        algorithm: "unknown",
-        hndl: false,
-        cwe: CWE_BROKEN_CRYPTO,
-        message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
-        remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+        meta: {
+            id: "pem-certificate",
+            title: "X.509 certificate (PEM)",
+            description: "X.509 certificate block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
+            remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+        },
     },
 ];
 /** Detects PEM key/certificate material in arbitrary files. */
@@ -110,6 +142,7 @@ export const pemDetector = {
     description: "PEM-encoded private keys and X.509 certificates in any file",
     scope: "config",
     language: "any",
+    rules: PEM_RULES.map((r) => r.meta),
     // Applies to every text file; the walker already filters out binaries.
     appliesTo: () => true,
     detect({ file, content }) {
@@ -119,18 +152,7 @@ export const pemDetector = {
         const findings = [];
         for (const rule of PEM_RULES) {
             eachMatch(rule.re, content, (m) => {
-                findings.push(makeFinding({
-                    ruleId: rule.ruleId,
-                    title: rule.title,
-                    category: rule.category,
-                    severity: rule.severity,
-                    confidence: "high",
-                    algorithm: rule.algorithm,
-                    hndl: rule.hndl,
-                    cwe: rule.cwe,
-                    sensitive: rule.sensitive,
-                    message: rule.message,
-                    remediation: rule.remediation,
+                findings.push(findingFromRule(rule.meta, {
                     file,
                     content,
                     index: m.index,