@quantakrypto/core 0.4.2 → 0.4.3

package/dist/detectors/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwJ/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA4M/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}

package/dist/detectors/pem.js

@@ -66,7 +66,7 @@ const PEM_RULES = [
             cwe: CWE_HARDCODED_KEY,
             sensitive: true,
             message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
-            remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+            remediation: "Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).",
         },
     },
     {
@@ -135,6 +135,54 @@ const PEM_RULES = [
             remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
         },
     },
+    {
+        re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,
+        meta: {
+            id: "pem-public-key",
+            title: "Classical public key (PEM)",
+            description: "SubjectPublicKeyInfo / PKCS#1 RSA public key block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.",
+            remediation: "Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.",
+        },
+    },
+    {
+        re: /-----BEGIN DH PARAMETERS-----/g,
+        meta: {
+            id: "pem-dh-parameters",
+            title: "Diffie-Hellman parameters (PEM)",
+            description: "Finite-field DH group parameters block",
+            category: "key-exchange",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "DH",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.",
+            remediation: "Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).",
+        },
+    },
+    {
+        re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,
+        meta: {
+            id: "pem-cert-request",
+            title: "Certificate signing request (PEM)",
+            description: "PKCS#10 certificate request block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.",
+            remediation: "Re-generate with PQC keys as PQC-capable CAs mature.",
+        },
+    },
 ];
 /** Detects PEM key/certificate material in arbitrary files. */
 export const pemDetector = {

package/dist/detectors/pem.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,iFAAiF;SACpF;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EAAE,2EAA2E;SACzF;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,iFAAiF;SACpF;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EACT,gIAAgI;SACnI;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,oDAAoD;YACjE,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gIAAgI;YAClI,WAAW,EAAE,wEAAwE;SACtF;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,mBAAmB;YACvB,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,wCAAwC;YACrD,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,kHAAkH;YACpH,WAAW,EAAE,6DAA6D;SAC3E;KACF;IACD;QACE,EAAE,EAAE,+CAA+C;QACnD,IAAI,EAAE;YACJ,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,mCAAmC;YAChD,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gGAAgG;YAClG,WAAW,EAAE,sDAAsD;SACpE;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config / certificate detector: finds PEM-encoded cryptographic material in\n * any text file (source, config, .pem, .key, .crt, .env, …). This catches\n * embedded private keys and X.509 certificates regardless of language.\n *\n * Every rule's metadata lives in the {@link RuleMeta} declaration below (the\n * catalog entry); `detect()` builds findings straight from it via\n * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from \"../cwe.js\";\n\n/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */\ninterface PemRule {\n  /** Regex matching the PEM begin marker. */\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst PEM_RULES: PemRule[] = [\n  {\n    re: /-----BEGIN RSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-rsa-private-key\",\n      title: \"RSA private key (PEM)\",\n      description: \"PKCS#1 RSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.\",\n      remediation: \"Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN EC PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-ec-private-key\",\n      title: \"EC private key (PEM)\",\n      description: \"SEC1 EC private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"ECDSA\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.\",\n      remediation:\n        \"Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN DSA PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-dsa-private-key\",\n      title: \"DSA private key (PEM)\",\n      description: \"DSA private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"DSA\",\n      hndl: false,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.\",\n      remediation: \"Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-openssh-private-key\",\n      title: \"OpenSSH private key\",\n      description: \"OpenSSH private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.\",\n      remediation:\n        \"Rotate the key; plan migration to PQC-capable SSH (prefer the mlkem768x25519-sha256 KEX, OpenSSH 10's default since Apr 2025).\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,\n    meta: {\n      id: \"pem-pgp-private-key\",\n      title: \"PGP/GPG private key block\",\n      description: \"OpenPGP private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message:\n        \"Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.\",\n      remediation: \"Rotate the key; track OpenPGP PQC drafts for migration.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"pem-pgp-message\",\n      title: \"PGP/GPG encrypted message\",\n      description: \"OpenPGP encrypted message block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).\",\n      remediation: \"Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,\n    meta: {\n      id: \"pem-pkcs8-private-key\",\n      title: \"Private key (PKCS#8 PEM)\",\n      description: \"PKCS#8 private key block\",\n      category: \"certificate\",\n      severity: \"critical\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: true,\n      cwe: CWE_HARDCODED_KEY,\n      sensitive: true,\n      message: \"Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.\",\n      remediation: \"Migrate to PQC keys and remove embedded private keys from source.\",\n    },\n  },\n  {\n    re: /-----BEGIN CERTIFICATE-----/g,\n    meta: {\n      id: \"pem-certificate\",\n      title: \"X.509 certificate (PEM)\",\n      description: \"X.509 certificate block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.\",\n      remediation: \"Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:RSA )?PUBLIC KEY-----/g,\n    meta: {\n      id: \"pem-public-key\",\n      title: \"Classical public key (PEM)\",\n      description: \"SubjectPublicKeyInfo / PKCS#1 RSA public key block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded classical public key (RSA/EC/DSA); its key pair is not quantum-safe — forgeable signatures or classical key exchange.\",\n      remediation: \"Re-issue with PQC keys (ML-DSA / ML-KEM) as the ecosystem adopts them.\",\n    },\n  },\n  {\n    re: /-----BEGIN DH PARAMETERS-----/g,\n    meta: {\n      id: \"pem-dh-parameters\",\n      title: \"Diffie-Hellman parameters (PEM)\",\n      description: \"Finite-field DH group parameters block\",\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"DH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded finite-field Diffie-Hellman parameters; classical DH key exchange is harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key exchange to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n  {\n    re: /-----BEGIN (?:NEW )?CERTIFICATE REQUEST-----/g,\n    meta: {\n      id: \"pem-cert-request\",\n      title: \"Certificate signing request (PEM)\",\n      description: \"PKCS#10 certificate request block\",\n      category: \"certificate\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Embedded PKCS#10 CSR; carries a classical public key and will be signed with classical crypto.\",\n      remediation: \"Re-generate with PQC keys as PQC-capable CAs mature.\",\n    },\n  },\n];\n\n/** Detects PEM key/certificate material in arbitrary files. */\nexport const pemDetector: Detector = {\n  id: \"pem-material\",\n  description: \"PEM-encoded private keys and X.509 certificates in any file\",\n  scope: \"config\",\n  language: \"any\",\n  rules: PEM_RULES.map((r) => r.meta),\n  // Applies to every text file; the walker already filters out binaries.\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if a PEM header is present at all.\n    if (!content.includes(\"-----BEGIN \")) return [];\n\n    const findings: Finding[] = [];\n    for (const rule of PEM_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/python.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAsJ/D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAE,QAsC5B,CAAC"}
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA6N/D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAE,QA8C5B,CAAC"}

package/dist/detectors/python.js

@@ -1,5 +1,5 @@
 import { PYTHON_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
 /* -------------------------------------------------------------------------- */
 /* Precompiled regexes (module scope)                                         */
 /* -------------------------------------------------------------------------- */
@@ -12,8 +12,15 @@ const RE_PY_RSA_ENCRYPT = /\bpadding\.OAEP\s*\(|\bPKCS1_OAEP\.new\s*\(/g;
 const RE_PY_EC_KEYGEN = /\bec\.generate_private_key\s*\(|\bECC\.generate\s*\(/g;
 // ECDSA signatures: cryptography `ec.ECDSA(`, paramiko ECDSAKey.
 const RE_PY_ECDSA = /\bec\.ECDSA\s*\(|\bparamiko\.ECDSAKey\b|\bECDSAKey\.generate\s*\(/g;
+// ECDH key agreement: cryptography `ec.ECDH(` — the actual harvest-now event in
+// `private_key.exchange(ec.ECDH(), peer)`; previously missed entirely (audit F3).
+const RE_PY_ECDH = /\bec\.ECDH\s*\(/g;
 // DSA: PyCryptodome `DSA.generate(`, paramiko DSSKey.
 const RE_PY_DSA = /\bDSA\.generate\s*\(|\bparamiko\.DSSKey\b|\bDSSKey\.generate\s*\(/g;
+// hazmat DSA: cryptography `dsa.generate_private_key(` — the `cryptography` DSA
+// keygen path (lowercase module) that RE_PY_DSA's uppercase `DSA.generate` misses
+// (audit F9-python).
+const RE_PY_HAZMAT_DSA = /\bdsa\.generate_private_key\s*\(/g;
 // Finite-field Diffie-Hellman (cryptography `dh`).
 const RE_PY_DH = /\bdh\.generate_parameters\s*\(|\bdh\.DHParameterNumbers\s*\(/g;
 // Modern-but-classical curve primitives (cryptography). `.generate(` anchors so
@@ -21,6 +28,13 @@ const RE_PY_DH = /\bdh\.generate_parameters\s*\(|\bdh\.DHParameterNumbers\s*\(/g
 const RE_PY_X25519 = /\bX25519PrivateKey\.generate\s*\(/g;
 const RE_PY_X448 = /\bX448PrivateKey\.generate\s*\(/g;
 const RE_PY_EDDSA = /\b(?:Ed25519|Ed448)PrivateKey\.generate\s*\(|\bparamiko\.Ed25519Key\b/g;
+// Python TLS misconfiguration. Mirrors the JS `tlsDetector` split of source.ts:
+// certificate-verification bypass (requests `verify=False`, `ssl.CERT_NONE`,
+// `check_hostname=False`, `ssl._create_unverified_context(`) is the high-severity
+// MITM surface (CWE-295); a pinned legacy protocol (`ssl.PROTOCOL_TLSv1`) is the
+// medium-severity weak-strength surface (CWE-326).
+const RE_PY_TLS_REJECT = /\bverify\s*=\s*False\b|\bssl\.CERT_NONE\b|\bcheck_hostname\s*=\s*False\b|\bssl\._create_unverified_context\s*\(/g;
+const RE_PY_TLS_LEGACY = /\bPROTOCOL_TLSv1\b/g;
 /* -------------------------------------------------------------------------- */
 /* Rule catalog                                                               */
 /* -------------------------------------------------------------------------- */
@@ -74,6 +88,18 @@ const RULE_PY_ECDSA = {
     message: "Classical ECDSA signing (Python) is forgeable by a quantum attacker.",
     remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
 };
+const RULE_PY_ECDH = {
+    id: "python-ecdh",
+    title: "Python ECDH key agreement",
+    description: "cryptography ec.ECDH() exchange",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman key agreement (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
 const RULE_PY_DSA = {
     id: "python-dsa",
     title: "Python DSA key/usage",
@@ -87,6 +113,19 @@ const RULE_PY_DSA = {
     message: "Classical DSA (Python) is deprecated and forgeable by a quantum attacker.",
     remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
 };
+const RULE_PY_HAZMAT_DSA = {
+    id: "python-hazmat-dsa",
+    title: "Python DSA key generation (cryptography)",
+    description: "cryptography dsa.generate_private_key",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "cryptography dsa.generate_private_key (Python) creates a classical DSA key; DSA is deprecated and forgeable by a quantum attacker.",
+    remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
 const RULE_PY_DH = {
     id: "python-dh",
     title: "Python Diffie-Hellman key exchange",
@@ -104,7 +143,7 @@ const RULE_PY_X25519 = {
     title: "Python X25519 key exchange",
     description: "cryptography X25519PrivateKey.generate",
     category: "key-exchange",
-    severity: "low",
+    severity: "medium",
     confidence: "high",
     algorithm: "X25519",
     hndl: true,
@@ -116,7 +155,7 @@ const RULE_PY_X448 = {
     title: "Python X448 key exchange",
     description: "cryptography X448PrivateKey.generate",
     category: "key-exchange",
-    severity: "low",
+    severity: "medium",
     confidence: "high",
     algorithm: "X448",
     hndl: true,
@@ -135,6 +174,30 @@ const RULE_PY_EDDSA = {
     cwe: CWE_BROKEN_CRYPTO,
     message: "Ed25519/Ed448 (Python) is a modern but still classical signature scheme.",
 };
+const RULE_PY_TLS_REJECT = {
+    id: "python-tls-reject",
+    title: "Python TLS certificate verification disabled",
+    description: "requests verify=False / ssl.CERT_NONE / check_hostname=False / _create_unverified_context",
+    category: "tls",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_CERT_VALIDATION,
+    message: "TLS certificate verification is disabled (verify=False / CERT_NONE / check_hostname=False / _create_unverified_context), which allows man-in-the-middle attacks.",
+    remediation: "Enable certificate verification (verify=True, ssl.CERT_REQUIRED, check_hostname=True) and verify certificates properly.",
+};
+const RULE_PY_TLS_LEGACY = {
+    id: "python-tls-legacy-version",
+    title: "Python legacy TLS version pinned",
+    description: "ssl.PROTOCOL_TLSv1 (TLS 1.0)",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_WEAK_STRENGTH,
+    message: "TLS 1.0 (ssl.PROTOCOL_TLSv1) is deprecated and insecure; require TLS 1.3.",
+    remediation: "Use ssl.PROTOCOL_TLS_CLIENT with minimum_version = ssl.TLSVersion.TLSv1_3 and prefer PQC-hybrid key exchange.",
+};
 /** Detects classical asymmetric crypto in Python source. */
 export const pythonDetector = {
     id: "python-crypto",
@@ -146,11 +209,15 @@ export const pythonDetector = {
         RULE_PY_RSA_ENCRYPT,
         RULE_PY_EC_KEYGEN,
         RULE_PY_ECDSA,
+        RULE_PY_ECDH,
         RULE_PY_DSA,
+        RULE_PY_HAZMAT_DSA,
         RULE_PY_DH,
         RULE_PY_X25519,
         RULE_PY_X448,
         RULE_PY_EDDSA,
+        RULE_PY_TLS_REJECT,
+        RULE_PY_TLS_LEGACY,
     ],
     appliesTo: (f) => hasExtension(f, PYTHON_EXTENSIONS),
     detect({ file, content }) {
@@ -160,11 +227,15 @@ export const pythonDetector = {
         add(RE_PY_RSA_ENCRYPT, RULE_PY_RSA_ENCRYPT);
         add(RE_PY_EC_KEYGEN, RULE_PY_EC_KEYGEN);
         add(RE_PY_ECDSA, RULE_PY_ECDSA);
+        add(RE_PY_ECDH, RULE_PY_ECDH);
         add(RE_PY_DSA, RULE_PY_DSA);
+        add(RE_PY_HAZMAT_DSA, RULE_PY_HAZMAT_DSA);
         add(RE_PY_DH, RULE_PY_DH);
         add(RE_PY_X25519, RULE_PY_X25519);
         add(RE_PY_X448, RULE_PY_X448);
         add(RE_PY_EDDSA, RULE_PY_EDDSA);
+        add(RE_PY_TLS_REJECT, RULE_PY_TLS_REJECT);
+        add(RE_PY_TLS_LEGACY, RULE_PY_TLS_LEGACY);
         return findings;
     },
 };

package/dist/detectors/python.js.map

@@ -1 +1 @@
-{"version":3,"file":"python.js","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,gBAAgB,GACpB,qGAAqG,CAAC;AACxG,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,yEAAyE;AACzE,MAAM,eAAe,GAAG,uDAAuD,CAAC;AAChF,iEAAiE;AACjE,MAAM,WAAW,GAAG,oEAAoE,CAAC;AACzF,sDAAsD;AACtD,MAAM,SAAS,GAAG,oEAAoE,CAAC;AACvF,mDAAmD;AACnD,MAAM,QAAQ,GAAG,+DAA+D,CAAC;AACjF,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;CACnF,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0GAA0G;CAC7G,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,kEAAkE;IAC/E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4JAA4J;IAC9J,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;IAC/E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2EAA2E;IACpF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,0DAA0D;IACvE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wFAAwF;CAClG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0EAA0E;CACpF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,8EAA8E;IAC3F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,WAAW;QACX,UAAU;QACV,cAAc;QACd,YAAY;QACZ,aAAa;KACd;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEhC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,gBAAgB,GACpB,qGAAqG,CAAC;AACxG,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,yEAAyE;AACzE,MAAM,eAAe,GAAG,uDAAuD,CAAC;AAChF,iEAAiE;AACjE,MAAM,WAAW,GAAG,oEAAoE,CAAC;AACzF,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,sDAAsD;AACtD,MAAM,SAAS,GAAG,oEAAoE,CAAC;AACvF,gFAAgF;AAChF,kFAAkF;AAClF,qBAAqB;AACrB,MAAM,gBAAgB,GAAG,mCAAmC,CAAC;AAC7D,mDAAmD;AACnD,MAAM,QAAQ,GAAG,+DAA+D,CAAC;AACjF,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,gFAAgF;AAChF,6EAA6E;AAC7E,kFAAkF;AAClF,iFAAiF;AACjF,mDAAmD;AACnD,MAAM,gBAAgB,GACpB,kHAAkH,CAAC;AACrH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;CACnF,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0GAA0G;CAC7G,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,kEAAkE;IAC/E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4JAA4J;IAC9J,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;IAC/E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iHAAiH;CACpH,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2EAA2E;IACpF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,0CAA0C;IACjD,WAAW,EAAE,uCAAuC;IACpD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,oIAAoI;IACtI,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,0DAA0D;IACvE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wFAAwF;CAClG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0EAA0E;CACpF,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,8CAA8C;IACrD,WAAW,EACT,2FAA2F;IAC7F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EACL,kKAAkK;IACpK,WAAW,EACT,yHAAyH;CAC5H,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,8BAA8B;IAC3C,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2EAA2E;IACpF,WAAW,EACT,+GAA+G;CAClH,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,8EAA8E;IAC3F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,YAAY;QACZ,WAAW;QACX,kBAAkB;QAClB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,aAAa;QACb,kBAAkB;QAClB,kBAAkB;KACnB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAE1C,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical, non-quantum-safe asymmetric cryptography\n * in Python. Same lexical (regex-over-source) strategy as the JS/TS detectors:\n * robust to formatting, dependency-free, and confidence-tagged per pattern.\n *\n * Covers the three libraries that carry ~all real-world Python asymmetric\n * crypto:\n *   - `cryptography` (hazmat): rsa/ec/dh/x25519/x448/ed25519/ed448 + OAEP padding\n *   - PyCryptodome (`Crypto.PublicKey`): RSA/ECC/DSA generate + PKCS1_OAEP\n *   - paramiko (SSH): RSAKey / ECDSAKey / Ed25519Key / DSSKey\n *\n * JWT/JOSE algorithm strings (`algorithm=\"RS256\"`) are NOT handled here — the\n * language-agnostic `jwt-jose` detector now applies to Python too (a quoted\n * `\"RS256\"` is the same evidence in any language).\n *\n * HNDL policy mirrors the JS detectors: key agreement / KEM (RSA-OAEP, ECDH, DH,\n * X25519/X448) is harvest-now-decrypt-later exposed (hndl:true); signatures\n * (ECDSA, DSA, Ed25519/Ed448) are hndl:false but still high/low severity because\n * a quantum attacker can forge them. EC key generation is ambiguous (an EC key\n * feeds both ECDSA and ECDH), so it is classified conservatively as\n * key-exchange-capable (hndl:true), exactly as the Node `ec` keygen rule is.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { PYTHON_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\n/* -------------------------------------------------------------------------- */\n/* Precompiled regexes (module scope)                                         */\n/* -------------------------------------------------------------------------- */\n\n// RSA key generation: cryptography `rsa.generate_private_key(`, PyCryptodome\n// `RSA.generate(`, paramiko `paramiko.RSAKey` / `RSAKey.generate(`.\nconst RE_PY_RSA_KEYGEN =\n  /\\brsa\\.generate_private_key\\s*\\(|\\bRSA\\.generate\\s*\\(|\\bparamiko\\.RSAKey\\b|\\bRSAKey\\.generate\\s*\\(/g;\n// RSA public-key encryption padding (RSA-OAEP): confidentiality → HNDL.\nconst RE_PY_RSA_ENCRYPT = /\\bpadding\\.OAEP\\s*\\(|\\bPKCS1_OAEP\\.new\\s*\\(/g;\n// EC key generation (ambiguous ECDSA/ECDH): cryptography + PyCryptodome.\nconst RE_PY_EC_KEYGEN = /\\bec\\.generate_private_key\\s*\\(|\\bECC\\.generate\\s*\\(/g;\n// ECDSA signatures: cryptography `ec.ECDSA(`, paramiko ECDSAKey.\nconst RE_PY_ECDSA = /\\bec\\.ECDSA\\s*\\(|\\bparamiko\\.ECDSAKey\\b|\\bECDSAKey\\.generate\\s*\\(/g;\n// ECDH key agreement: cryptography `ec.ECDH(` — the actual harvest-now event in\n// `private_key.exchange(ec.ECDH(), peer)`; previously missed entirely (audit F3).\nconst RE_PY_ECDH = /\\bec\\.ECDH\\s*\\(/g;\n// DSA: PyCryptodome `DSA.generate(`, paramiko DSSKey.\nconst RE_PY_DSA = /\\bDSA\\.generate\\s*\\(|\\bparamiko\\.DSSKey\\b|\\bDSSKey\\.generate\\s*\\(/g;\n// hazmat DSA: cryptography `dsa.generate_private_key(` — the `cryptography` DSA\n// keygen path (lowercase module) that RE_PY_DSA's uppercase `DSA.generate` misses\n// (audit F9-python).\nconst RE_PY_HAZMAT_DSA = /\\bdsa\\.generate_private_key\\s*\\(/g;\n// Finite-field Diffie-Hellman (cryptography `dh`).\nconst RE_PY_DH = /\\bdh\\.generate_parameters\\s*\\(|\\bdh\\.DHParameterNumbers\\s*\\(/g;\n// Modern-but-classical curve primitives (cryptography). `.generate(` anchors so\n// a bare import of the class name does not fire.\nconst RE_PY_X25519 = /\\bX25519PrivateKey\\.generate\\s*\\(/g;\nconst RE_PY_X448 = /\\bX448PrivateKey\\.generate\\s*\\(/g;\nconst RE_PY_EDDSA = /\\b(?:Ed25519|Ed448)PrivateKey\\.generate\\s*\\(|\\bparamiko\\.Ed25519Key\\b/g;\n\n// Python TLS misconfiguration. Mirrors the JS `tlsDetector` split of source.ts:\n// certificate-verification bypass (requests `verify=False`, `ssl.CERT_NONE`,\n// `check_hostname=False`, `ssl._create_unverified_context(`) is the high-severity\n// MITM surface (CWE-295); a pinned legacy protocol (`ssl.PROTOCOL_TLSv1`) is the\n// medium-severity weak-strength surface (CWE-326).\nconst RE_PY_TLS_REJECT =\n  /\\bverify\\s*=\\s*False\\b|\\bssl\\.CERT_NONE\\b|\\bcheck_hostname\\s*=\\s*False\\b|\\bssl\\._create_unverified_context\\s*\\(/g;\nconst RE_PY_TLS_LEGACY = /\\bPROTOCOL_TLSv1\\b/g;\n\n/* -------------------------------------------------------------------------- */\n/* Rule catalog                                                               */\n/* -------------------------------------------------------------------------- */\n\nconst RULE_PY_RSA_KEYGEN: RuleMeta = {\n  id: \"python-rsa-keygen\",\n  title: \"Python RSA key generation\",\n  description:\n    \"cryptography rsa.generate_private_key / PyCryptodome RSA.generate / paramiko RSAKey\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Generates a classical RSA key pair (Python), which is not quantum-safe.\",\n};\nconst RULE_PY_RSA_ENCRYPT: RuleMeta = {\n  id: \"python-rsa-encrypt\",\n  title: \"Python RSA public-key encryption\",\n  description: \"RSA-OAEP / PKCS1_OAEP encryption padding\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption (OAEP) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.\",\n};\nconst RULE_PY_EC_KEYGEN: RuleMeta = {\n  id: \"python-ec-keygen\",\n  title: \"Python EC key generation\",\n  description: \"cryptography ec.generate_private_key / PyCryptodome ECC.generate\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates a classical EC key pair (Python). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_PY_ECDSA: RuleMeta = {\n  id: \"python-ecdsa\",\n  title: \"Python ECDSA signature\",\n  description: \"cryptography ec.ECDSA / paramiko ECDSAKey\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (Python) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_PY_ECDH: RuleMeta = {\n  id: \"python-ecdh\",\n  title: \"Python ECDH key agreement\",\n  description: \"cryptography ec.ECDH() exchange\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman key agreement (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_PY_DSA: RuleMeta = {\n  id: \"python-dsa\",\n  title: \"Python DSA key/usage\",\n  description: \"PyCryptodome DSA.generate / paramiko DSSKey\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (Python) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_PY_HAZMAT_DSA: RuleMeta = {\n  id: \"python-hazmat-dsa\",\n  title: \"Python DSA key generation (cryptography)\",\n  description: \"cryptography dsa.generate_private_key\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"cryptography dsa.generate_private_key (Python) creates a classical DSA key; DSA is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_PY_DH: RuleMeta = {\n  id: \"python-dh\",\n  title: \"Python Diffie-Hellman key exchange\",\n  description: \"cryptography dh.generate_parameters / DHParameterNumbers\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_PY_X25519: RuleMeta = {\n  id: \"python-x25519\",\n  title: \"Python X25519 key exchange\",\n  description: \"cryptography X25519PrivateKey.generate\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 (Python) is modern but still classical key agreement — harvest-now-decrypt-later.\",\n};\nconst RULE_PY_X448: RuleMeta = {\n  id: \"python-x448\",\n  title: \"Python X448 key exchange\",\n  description: \"cryptography X448PrivateKey.generate\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X448\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"X448 (Python) is modern but still classical key agreement — harvest-now-decrypt-later.\",\n};\nconst RULE_PY_EDDSA: RuleMeta = {\n  id: \"python-eddsa\",\n  title: \"Python Ed25519/Ed448 signature\",\n  description: \"cryptography Ed25519/Ed448 PrivateKey.generate / paramiko Ed25519Key\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Ed25519/Ed448 (Python) is a modern but still classical signature scheme.\",\n};\nconst RULE_PY_TLS_REJECT: RuleMeta = {\n  id: \"python-tls-reject\",\n  title: \"Python TLS certificate verification disabled\",\n  description:\n    \"requests verify=False / ssl.CERT_NONE / check_hostname=False / _create_unverified_context\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message:\n    \"TLS certificate verification is disabled (verify=False / CERT_NONE / check_hostname=False / _create_unverified_context), which allows man-in-the-middle attacks.\",\n  remediation:\n    \"Enable certificate verification (verify=True, ssl.CERT_REQUIRED, check_hostname=True) and verify certificates properly.\",\n};\nconst RULE_PY_TLS_LEGACY: RuleMeta = {\n  id: \"python-tls-legacy-version\",\n  title: \"Python legacy TLS version pinned\",\n  description: \"ssl.PROTOCOL_TLSv1 (TLS 1.0)\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message: \"TLS 1.0 (ssl.PROTOCOL_TLSv1) is deprecated and insecure; require TLS 1.3.\",\n  remediation:\n    \"Use ssl.PROTOCOL_TLS_CLIENT with minimum_version = ssl.TLSVersion.TLSv1_3 and prefer PQC-hybrid key exchange.\",\n};\n\n/** Detects classical asymmetric crypto in Python source. */\nexport const pythonDetector: Detector = {\n  id: \"python-crypto\",\n  description: \"Classical asymmetric crypto in Python (cryptography, PyCryptodome, paramiko)\",\n  scope: \"source\",\n  language: \"python\",\n  rules: [\n    RULE_PY_RSA_KEYGEN,\n    RULE_PY_RSA_ENCRYPT,\n    RULE_PY_EC_KEYGEN,\n    RULE_PY_ECDSA,\n    RULE_PY_ECDH,\n    RULE_PY_DSA,\n    RULE_PY_HAZMAT_DSA,\n    RULE_PY_DH,\n    RULE_PY_X25519,\n    RULE_PY_X448,\n    RULE_PY_EDDSA,\n    RULE_PY_TLS_REJECT,\n    RULE_PY_TLS_LEGACY,\n  ],\n  appliesTo: (f) => hasExtension(f, PYTHON_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n\n    add(RE_PY_RSA_KEYGEN, RULE_PY_RSA_KEYGEN);\n    add(RE_PY_RSA_ENCRYPT, RULE_PY_RSA_ENCRYPT);\n    add(RE_PY_EC_KEYGEN, RULE_PY_EC_KEYGEN);\n    add(RE_PY_ECDSA, RULE_PY_ECDSA);\n    add(RE_PY_ECDH, RULE_PY_ECDH);\n    add(RE_PY_DSA, RULE_PY_DSA);\n    add(RE_PY_HAZMAT_DSA, RULE_PY_HAZMAT_DSA);\n    add(RE_PY_DH, RULE_PY_DH);\n    add(RE_PY_X25519, RULE_PY_X25519);\n    add(RE_PY_X448, RULE_PY_X448);\n    add(RE_PY_EDDSA, RULE_PY_EDDSA);\n    add(RE_PY_TLS_REJECT, RULE_PY_TLS_REJECT);\n    add(RE_PY_TLS_LEGACY, RULE_PY_TLS_LEGACY);\n\n    return findings;\n  },\n};\n"]}

package/dist/detectors/ruby.d.ts

@@ -1,13 +1,17 @@
 /**
  * Source-code detector for classical asymmetric cryptography in Ruby. Ruby's
  * asymmetric crypto is almost entirely `OpenSSL::PKey::{RSA,EC,DSA,DH}`, which
- * makes the signals precise. Lexical, same strategy as the other packs.
+ * makes the signals precise. Lexical, same strategy as the other packs. Beyond
+ * keygen it also covers RSA public-key encryption on a loaded key, DH key
+ * agreement, the type-agnostic `OpenSSL::PKey.read` loader, Ed25519 key
+ * generation, and disabled TLS peer verification (`VERIFY_NONE`).
  *
  * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-
- * decrypt-later exposed (hndl:true); DSA signatures are hndl:false but forgeable.
- * `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is classified
- * conservatively as key-exchange-capable (hndl:true), like the other EC keygen
- * rules.
+ * decrypt-later exposed (hndl:true); DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is
+ * classified conservatively as key-exchange-capable (hndl:true), like the other
+ * EC keygen rules; `OpenSSL::PKey.read` loads a key of unknown type and is
+ * likewise treated conservatively.
  */
 import type { Detector } from "../types.js";
 /** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */

package/dist/detectors/ruby.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ruby.d.ts","sourceRoot":"","sources":["../../src/detectors/ruby.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA+D/D,mEAAmE;AACnE,eAAO,MAAM,YAAY,EAAE,QAqB1B,CAAC"}
+{"version":3,"file":"ruby.d.ts","sourceRoot":"","sources":["../../src/detectors/ruby.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA2K/D,mEAAmE;AACnE,eAAO,MAAM,YAAY,EAAE,QAwC1B,CAAC"}

package/dist/detectors/ruby.js

@@ -1,9 +1,23 @@
 import { RUBY_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
-import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from "../cwe.js";
 const RE_RB_RSA = /\bOpenSSL::PKey::RSA\.(?:new|generate)\s*\(/g;
 const RE_RB_EC = /\bOpenSSL::PKey::EC\.(?:new|generate)\s*\(/g;
 const RE_RB_DSA = /\bOpenSSL::PKey::DSA\.(?:new|generate)\s*\(/g;
 const RE_RB_DH = /\bOpenSSL::PKey::DH\.new\s*\(/g;
+// RSA public-key encryption on an already-loaded key (audit F4-ruby / F9).
+const RE_RB_RSA_CRYPT = /\.public_encrypt\b|\.private_decrypt\b/g;
+// Finite-field DH shared-secret agreement.
+const RE_RB_DH_AGREE = /\bdh_compute_key\s*\(/g;
+// Type-agnostic key loader — could be RSA/EC/DSA/DH (conservative).
+const RE_RB_PKEY_READ = /\bOpenSSL::PKey\.read\s*\(/g;
+// Ed25519 signing key via the generic generate_key factory.
+const RE_RB_ED25519 = /\bOpenSSL::PKey\.generate_key\s*\(\s*["']ED25519["']/g;
+// `ed25519` gem — Ed25519::SigningKey / VerifyKey (signature keys).
+const RE_RB_ED25519_GEM = /\bEd25519::(?:SigningKey|VerifyKey)\b/g;
+// `rbnacl` (libsodium) — Curve25519/X25519 key agreement: PrivateKey, Box, GroupElement.
+const RE_RB_RBNACL = /\bRbNaCl::(?:PrivateKey|Box|GroupElement)\b/g;
+// TLS peer verification disabled (mirrors the JS tlsDetector rejectUnauthorized rule).
+const RE_RB_TLS_VERIFY_NONE = /\bOpenSSL::SSL::VERIFY_NONE\b/g;
 const RULE_RB_RSA = {
     id: "ruby-rsa",
     title: "Ruby RSA key/usage",
@@ -54,13 +68,112 @@ const RULE_RB_DH = {
     cwe: CWE_BROKEN_CRYPTO,
     message: "Finite-field Diffie-Hellman (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
 };
+const RULE_RB_RSA_CRYPT = {
+    id: "ruby-rsa-crypt",
+    title: "Ruby RSA public-key encryption",
+    description: "OpenSSL::PKey::RSA#public_encrypt / #private_decrypt",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption/decryption (Ruby/OpenSSL) is harvest-now-decrypt-later exposed.",
+};
+const RULE_RB_DH_AGREE = {
+    id: "ruby-dh-agree",
+    title: "Ruby Diffie-Hellman key agreement",
+    description: "OpenSSL DH compute_key shared-secret agreement",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman key agreement (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_RB_PKEY_READ = {
+    id: "ruby-pkey-read",
+    title: "Ruby PKey loaded from serialized key",
+    description: "OpenSSL::PKey.read (type-agnostic key loader)",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "unknown",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Loads a classical asymmetric key of unknown type (RSA/EC/DSA/DH) via OpenSSL::PKey.read. Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_RB_ED25519 = {
+    id: "ruby-ed25519",
+    title: "Ruby Ed25519 key generation",
+    description: 'OpenSSL::PKey.generate_key("ED25519")',
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates an Ed25519 signing key (Ruby/OpenSSL) — modern but classical, and forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RB_ED25519_GEM = {
+    id: "ruby-ed25519-gem",
+    title: "Ruby Ed25519 signature (ed25519 gem)",
+    description: "ed25519 gem Ed25519::SigningKey / Ed25519::VerifyKey",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519 signing/verification via the `ed25519` gem — modern but classical, and forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_RB_RBNACL = {
+    id: "ruby-rbnacl",
+    title: "Ruby X25519 key agreement (rbnacl)",
+    description: "rbnacl (libsodium) RbNaCl::PrivateKey / Box / GroupElement",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Curve25519/X25519 key agreement via the `rbnacl` gem (libsodium) — modern but classical key agreement, harvest-now-decrypt-later exposed.",
+};
+const RULE_RB_TLS_VERIFY_NONE = {
+    id: "ruby-tls-verify-none",
+    title: "Ruby TLS certificate verification disabled",
+    description: "OpenSSL::SSL::VERIFY_NONE",
+    category: "tls",
+    severity: "high",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_CERT_VALIDATION,
+    message: "OpenSSL::SSL::VERIFY_NONE disables TLS peer certificate verification (MITM risk).",
+    remediation: "Use OpenSSL::SSL::VERIFY_PEER and verify the certificate chain.",
+};
 /** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */
 export const rubyDetector = {
     id: "ruby-crypto",
     description: "Classical asymmetric crypto in Ruby (OpenSSL::PKey::{RSA,EC,DSA,DH})",
     scope: "source",
     language: "ruby",
-    rules: [RULE_RB_RSA, RULE_RB_EC, RULE_RB_DSA, RULE_RB_DH],
+    rules: [
+        RULE_RB_RSA,
+        RULE_RB_EC,
+        RULE_RB_DSA,
+        RULE_RB_DH,
+        RULE_RB_RSA_CRYPT,
+        RULE_RB_DH_AGREE,
+        RULE_RB_PKEY_READ,
+        RULE_RB_ED25519,
+        RULE_RB_ED25519_GEM,
+        RULE_RB_RBNACL,
+        RULE_RB_TLS_VERIFY_NONE,
+    ],
     appliesTo: (f) => hasExtension(f, RUBY_EXTENSIONS),
     detect({ file, content }) {
         const findings = [];
@@ -69,6 +182,13 @@ export const rubyDetector = {
         add(RE_RB_EC, RULE_RB_EC);
         add(RE_RB_DSA, RULE_RB_DSA);
         add(RE_RB_DH, RULE_RB_DH);
+        add(RE_RB_RSA_CRYPT, RULE_RB_RSA_CRYPT);
+        add(RE_RB_DH_AGREE, RULE_RB_DH_AGREE);
+        add(RE_RB_PKEY_READ, RULE_RB_PKEY_READ);
+        add(RE_RB_ED25519, RULE_RB_ED25519);
+        add(RE_RB_ED25519_GEM, RULE_RB_ED25519_GEM);
+        add(RE_RB_RBNACL, RULE_RB_RBNACL);
+        add(RE_RB_TLS_VERIFY_NONE, RULE_RB_TLS_VERIFY_NONE);
         return findings;
     },
 };

package/dist/detectors/ruby.js.map

@@ -1 +1 @@
-{"version":3,"file":"ruby.js","sourceRoot":"","sources":["../../src/detectors/ruby.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAC/D,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAElD,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sFAAsF;CAChG,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kKAAkK;IACpK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iFAAiF;IAC1F,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,uBAAuB;IACpC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uGAAuG;CAC1G,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,sEAAsE;IACnF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"ruby.js","sourceRoot":"","sources":["../../src/detectors/ruby.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAC/D,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC;AAClD,2EAA2E;AAC3E,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAClE,2CAA2C;AAC3C,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,oEAAoE;AACpE,MAAM,eAAe,GAAG,6BAA6B,CAAC;AACtD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,uDAAuD,CAAC;AAC9E,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AACnE,yFAAyF;AACzF,MAAM,YAAY,GAAG,8CAA8C,CAAC;AACpE,uFAAuF;AACvF,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAE/D,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sFAAsF;CAChG,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kKAAkK;IACpK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,oCAAoC;IACjD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iFAAiF;IAC1F,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,uBAAuB;IACpC,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uGAAuG;CAC1G,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,sDAAsD;IACnE,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2FAA2F;CAC9F,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,mCAAmC;IAC1C,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qHAAqH;CACxH,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,+CAA+C;IAC5D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sKAAsK;IACxK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,uCAAuC;IACpD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8GAA8G;IAChH,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,sDAAsD;IACnE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iHAAiH;IACnH,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2IAA2I;CAC9I,CAAC;AACF,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,4CAA4C;IACnD,WAAW,EAAE,2BAA2B;IACxC,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,mFAAmF;IAC5F,WAAW,EAAE,iEAAiE;CAC/E,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,sEAAsE;IACnF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE;QACL,WAAW;QACX,UAAU;QACV,WAAW;QACX,UAAU;QACV,iBAAiB;QACjB,gBAAgB;QAChB,iBAAiB;QACjB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,uBAAuB;KACxB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in Ruby. Ruby's\n * asymmetric crypto is almost entirely `OpenSSL::PKey::{RSA,EC,DSA,DH}`, which\n * makes the signals precise. Lexical, same strategy as the other packs. Beyond\n * keygen it also covers RSA public-key encryption on a loaded key, DH key\n * agreement, the type-agnostic `OpenSSL::PKey.read` loader, Ed25519 key\n * generation, and disabled TLS peer verification (`VERIFY_NONE`).\n *\n * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-\n * decrypt-later exposed (hndl:true); DSA / Ed25519 signatures are hndl:false but\n * forgeable. `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is\n * classified conservatively as key-exchange-capable (hndl:true), like the other\n * EC keygen rules; `OpenSSL::PKey.read` loads a key of unknown type and is\n * likewise treated conservatively.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { RUBY_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION } from \"../cwe.js\";\n\nconst RE_RB_RSA = /\\bOpenSSL::PKey::RSA\\.(?:new|generate)\\s*\\(/g;\nconst RE_RB_EC = /\\bOpenSSL::PKey::EC\\.(?:new|generate)\\s*\\(/g;\nconst RE_RB_DSA = /\\bOpenSSL::PKey::DSA\\.(?:new|generate)\\s*\\(/g;\nconst RE_RB_DH = /\\bOpenSSL::PKey::DH\\.new\\s*\\(/g;\n// RSA public-key encryption on an already-loaded key (audit F4-ruby / F9).\nconst RE_RB_RSA_CRYPT = /\\.public_encrypt\\b|\\.private_decrypt\\b/g;\n// Finite-field DH shared-secret agreement.\nconst RE_RB_DH_AGREE = /\\bdh_compute_key\\s*\\(/g;\n// Type-agnostic key loader — could be RSA/EC/DSA/DH (conservative).\nconst RE_RB_PKEY_READ = /\\bOpenSSL::PKey\\.read\\s*\\(/g;\n// Ed25519 signing key via the generic generate_key factory.\nconst RE_RB_ED25519 = /\\bOpenSSL::PKey\\.generate_key\\s*\\(\\s*[\"']ED25519[\"']/g;\n// `ed25519` gem — Ed25519::SigningKey / VerifyKey (signature keys).\nconst RE_RB_ED25519_GEM = /\\bEd25519::(?:SigningKey|VerifyKey)\\b/g;\n// `rbnacl` (libsodium) — Curve25519/X25519 key agreement: PrivateKey, Box, GroupElement.\nconst RE_RB_RBNACL = /\\bRbNaCl::(?:PrivateKey|Box|GroupElement)\\b/g;\n// TLS peer verification disabled (mirrors the JS tlsDetector rejectUnauthorized rule).\nconst RE_RB_TLS_VERIFY_NONE = /\\bOpenSSL::SSL::VERIFY_NONE\\b/g;\n\nconst RULE_RB_RSA: RuleMeta = {\n  id: \"ruby-rsa\",\n  title: \"Ruby RSA key/usage\",\n  description: \"OpenSSL::PKey::RSA.new / .generate\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA (Ruby/OpenSSL) is not quantum-safe and RSA encryption is HNDL-exposed.\",\n};\nconst RULE_RB_EC: RuleMeta = {\n  id: \"ruby-ec\",\n  title: \"Ruby EC key generation\",\n  description: \"OpenSSL::PKey::EC.new / .generate\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates a classical EC key pair (Ruby/OpenSSL). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_RB_DSA: RuleMeta = {\n  id: \"ruby-dsa\",\n  title: \"Ruby DSA key/signature\",\n  description: \"OpenSSL::PKey::DSA.new / .generate\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (Ruby/OpenSSL) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_RB_DH: RuleMeta = {\n  id: \"ruby-dh\",\n  title: \"Ruby Diffie-Hellman key exchange\",\n  description: \"OpenSSL::PKey::DH.new\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_RB_RSA_CRYPT: RuleMeta = {\n  id: \"ruby-rsa-crypt\",\n  title: \"Ruby RSA public-key encryption\",\n  description: \"OpenSSL::PKey::RSA#public_encrypt / #private_decrypt\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"RSA public-key encryption/decryption (Ruby/OpenSSL) is harvest-now-decrypt-later exposed.\",\n};\nconst RULE_RB_DH_AGREE: RuleMeta = {\n  id: \"ruby-dh-agree\",\n  title: \"Ruby Diffie-Hellman key agreement\",\n  description: \"OpenSSL DH compute_key shared-secret agreement\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman key agreement (Ruby/OpenSSL) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_RB_PKEY_READ: RuleMeta = {\n  id: \"ruby-pkey-read\",\n  title: \"Ruby PKey loaded from serialized key\",\n  description: \"OpenSSL::PKey.read (type-agnostic key loader)\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"medium\",\n  algorithm: \"unknown\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Loads a classical asymmetric key of unknown type (RSA/EC/DSA/DH) via OpenSSL::PKey.read. Treated conservatively as key-exchange-capable (harvest-now-decrypt-later).\",\n  remediation:\n    \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_RB_ED25519: RuleMeta = {\n  id: \"ruby-ed25519\",\n  title: \"Ruby Ed25519 key generation\",\n  description: 'OpenSSL::PKey.generate_key(\"ED25519\")',\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Generates an Ed25519 signing key (Ruby/OpenSSL) — modern but classical, and forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_RB_ED25519_GEM: RuleMeta = {\n  id: \"ruby-ed25519-gem\",\n  title: \"Ruby Ed25519 signature (ed25519 gem)\",\n  description: \"ed25519 gem Ed25519::SigningKey / Ed25519::VerifyKey\",\n  category: \"signature\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Ed25519 signing/verification via the `ed25519` gem — modern but classical, and forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_RB_RBNACL: RuleMeta = {\n  id: \"ruby-rbnacl\",\n  title: \"Ruby X25519 key agreement (rbnacl)\",\n  description: \"rbnacl (libsodium) RbNaCl::PrivateKey / Box / GroupElement\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Curve25519/X25519 key agreement via the `rbnacl` gem (libsodium) — modern but classical key agreement, harvest-now-decrypt-later exposed.\",\n};\nconst RULE_RB_TLS_VERIFY_NONE: RuleMeta = {\n  id: \"ruby-tls-verify-none\",\n  title: \"Ruby TLS certificate verification disabled\",\n  description: \"OpenSSL::SSL::VERIFY_NONE\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"OpenSSL::SSL::VERIFY_NONE disables TLS peer certificate verification (MITM risk).\",\n  remediation: \"Use OpenSSL::SSL::VERIFY_PEER and verify the certificate chain.\",\n};\n\n/** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */\nexport const rubyDetector: Detector = {\n  id: \"ruby-crypto\",\n  description: \"Classical asymmetric crypto in Ruby (OpenSSL::PKey::{RSA,EC,DSA,DH})\",\n  scope: \"source\",\n  language: \"ruby\",\n  rules: [\n    RULE_RB_RSA,\n    RULE_RB_EC,\n    RULE_RB_DSA,\n    RULE_RB_DH,\n    RULE_RB_RSA_CRYPT,\n    RULE_RB_DH_AGREE,\n    RULE_RB_PKEY_READ,\n    RULE_RB_ED25519,\n    RULE_RB_ED25519_GEM,\n    RULE_RB_RBNACL,\n    RULE_RB_TLS_VERIFY_NONE,\n  ],\n  appliesTo: (f) => hasExtension(f, RUBY_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_RB_RSA, RULE_RB_RSA);\n    add(RE_RB_EC, RULE_RB_EC);\n    add(RE_RB_DSA, RULE_RB_DSA);\n    add(RE_RB_DH, RULE_RB_DH);\n    add(RE_RB_RSA_CRYPT, RULE_RB_RSA_CRYPT);\n    add(RE_RB_DH_AGREE, RULE_RB_DH_AGREE);\n    add(RE_RB_PKEY_READ, RULE_RB_PKEY_READ);\n    add(RE_RB_ED25519, RULE_RB_ED25519);\n    add(RE_RB_ED25519_GEM, RULE_RB_ED25519_GEM);\n    add(RE_RB_RBNACL, RULE_RB_RBNACL);\n    add(RE_RB_TLS_VERIFY_NONE, RULE_RB_TLS_VERIFY_NONE);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/rust.d.ts

@@ -1,11 +1,16 @@
 /**
  * Source-code detector for classical asymmetric cryptography in Rust. Covers the
  * common crypto crates: `rsa`, `ring`, the `*-dalek` family (ed25519/x25519),
- * and the RustCrypto elliptic-curve crates (`p256`/`p384`/`k256`). Lexical, same
- * strategy as the other packs; the `::` path syntax makes the signals precise.
+ * the RustCrypto elliptic-curve crates (`p256`/`p384`/`k256`), and the `openssl`
+ * crate bindings. Lexical, same strategy as the other packs; the `::` path
+ * syntax makes the signals precise.
  *
  * HNDL: RSA encryption and (EC/X)DH key agreement are harvest-now-decrypt-later
- * exposed (hndl:true); ECDSA / Ed25519 signatures are hndl:false but forgeable.
+ * exposed (hndl:true); ECDSA / DSA / Ed25519 signatures are hndl:false but
+ * forgeable. `openssl::EcKey` keygen is ambiguous (feeds ECDSA + ECDH),
+ * classified conservatively as key-exchange-capable (hndl:true). Also flags
+ * Rust TLS certificate-validation bypasses (reqwest / rustls) — not quantum but
+ * mirrors the JS tlsDetector's cert-validation category.
  */
 import type { Detector } from "../types.js";
 /** Detects classical asymmetric crypto in Rust (rsa, ring, dalek, p256/k256). */

package/dist/detectors/rust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../src/detectors/rust.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA+E/D,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QAsB1B,CAAC"}
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../src/detectors/rust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAmB,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA+OhF,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QA6D1B,CAAC"}