@quantakrypto/core 0.4.4 → 0.6.0

package/src/detect-utils.ts

@@ -14,7 +14,7 @@ import type {
 import { remediationText } from "./remediation.js";
 
 /** A 1-based line/column position derived from a character offset. */
-export interface LineCol {
+interface LineCol {
   line: number;
   column: number;
 }
@@ -62,14 +62,14 @@ function lineIndexFor(starts: readonly number[], offset: number): number {
  * line/column. Newlines are LF; CR is treated as an ordinary character, so on
  * CRLF files the column includes the trailing CR offset harmlessly.
  */
-export function offsetToLineCol(content: string, offset: number): LineCol {
+function offsetToLineCol(content: string, offset: number): LineCol {
   const starts = lineStartsFor(content);
   const idx = lineIndexFor(starts, offset);
   return { line: idx + 1, column: offset - starts[idx] + 1 };
 }
 
 /** Extract the (trimmed) single source line containing `offset`. */
-export function lineAt(content: string, offset: number): string {
+function lineAt(content: string, offset: number): string {
   const starts = lineStartsFor(content);
   const idx = lineIndexFor(starts, offset);
   const start = starts[idx];
@@ -80,7 +80,7 @@ export function lineAt(content: string, offset: number): string {
 }
 
 /** Inputs for {@link makeFinding}. */
-export interface FindingSpec {
+interface FindingSpec {
   ruleId: string;
   title: string;
   category: FindingCategory;
@@ -146,7 +146,7 @@ export function makeFinding(spec: FindingSpec): Finding {
 }
 
 /** Where a match occurred, plus optional per-finding field overrides. */
-export interface RuleMatch {
+interface RuleMatch {
   file: string;
   content: string;
   /** Match start offset within `content`. */
@@ -160,7 +160,7 @@ export interface RuleMatch {
  * rules (e.g. key generation across algorithm families) override these; fixed
  * rules pass none and inherit the catalog metadata verbatim.
  */
-export type RuleOverrides = Partial<
+type RuleOverrides = Partial<
   Pick<
     RuleMeta,
     "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe"
@@ -246,6 +246,18 @@ export const PHP_EXTENSIONS: readonly string[] = [".php", ".phtml", ".php3", ".p
 /** C / C++ source extensions handled by the OpenSSL detector. */
 export const C_EXTENSIONS: readonly string[] = [".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hh"];
 
+/** Swift source extensions handled by the CryptoKit / Security-framework detector. */
+export const SWIFT_EXTENSIONS: readonly string[] = [".swift"];
+
+/** Objective-C implementation extensions (`.h` is owned by the C pack). */
+export const OBJC_EXTENSIONS: readonly string[] = [".m", ".mm"];
+
+/** Dart / Flutter source extensions. */
+export const DART_EXTENSIONS: readonly string[] = [".dart"];
+
+/** Smart-contract source extensions (Solidity/EVM, Move, Cairo/Starknet). */
+export const SMART_CONTRACT_EXTENSIONS: readonly string[] = [".sol", ".move", ".cairo"];
+
 /**
  * Prose/documentation extensions. The language-agnostic *token* detectors (SSH
  * public keys, TLS cipher suites, certificate signature algorithms) must not run
@@ -282,6 +294,9 @@ export const JWT_HOST_EXTENSIONS: readonly string[] = [
   ...PYTHON_EXTENSIONS,
   ...GO_EXTENSIONS,
   ...RUBY_EXTENSIONS,
+  // PHP's firebase/php-jwt passes the alg as a quoted token (`'RS256'`, `'ES256'`),
+  // the same shape RE_JWT_ALG matches — so PHP files are in scope for it too.
+  ...PHP_EXTENSIONS,
 ];
 
 /**
@@ -303,6 +318,10 @@ export const ANALYZABLE_SOURCE_EXTENSIONS: readonly string[] = [
   ...PHP_EXTENSIONS,
   ...ELIXIR_EXTENSIONS,
   ...C_EXTENSIONS,
+  ...SWIFT_EXTENSIONS,
+  ...OBJC_EXTENSIONS,
+  ...DART_EXTENSIONS,
+  ...SMART_CONTRACT_EXTENSIONS,
 ];
 
 /**
@@ -311,7 +330,7 @@ export const ANALYZABLE_SOURCE_EXTENSIONS: readonly string[] = [
  * ANALYZABLE_SOURCE_EXTENSIONS} so a new language pack updates one place.
  */
 export const ANALYZABLE_LANGUAGES_LABEL =
-  "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++";
+  "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo";
 
 /** True when a path is in a source language the scanner can analyze for crypto. */
 export function isAnalyzableSource(filePath: string): boolean {
@@ -319,10 +338,13 @@ export function isAnalyzableSource(filePath: string): boolean {
 }
 
 /**
- * Given a SORTED ascending array of call offsets, return true when `idx` is at
- * or after some call offset `c` with `idx - c < window`. Runs in O(log n) by
- * binary-searching the largest call offset ≤ `idx` and checking the gap. This
- * replaces the previous O(matches × calls) linear scan (`nearCall`).
+ * Given a SORTED ascending array of call offsets, return true when `idx` is at or
+ * after some call offset `c` with `idx - c < window`. Deliberately ONE-SIDED
+ * (forward only): the WebCrypto algorithm name follows the `subtle.*(` call it
+ * belongs to, and reaching backward would wrongly attribute an UNRELATED earlier
+ * call's argument (e.g. a Node `generateKeyPairSync('rsa-pss', …)` sitting a few
+ * lines above a subtle call) to the wrong API. Runs in O(log n) by binary-searching
+ * the largest call offset ≤ `idx` and checking the gap.
  */
 export function nearSortedCall(
   sortedCalls: readonly number[],
@@ -363,3 +385,103 @@ export function eachMatch(
     if (m.index === g.lastIndex) g.lastIndex++; // avoid infinite loop on empty match
   }
 }
+
+/**
+ * Return the innermost `{ … }` object that contains `index`, as a substring — so a
+ * per-match check (e.g. a JWK's own `use`/`alg`, or whether an `alg` sits inside a
+ * JWK) analyses ONLY that object and can't be contaminated by a neighbouring object
+ * in a packed array. The scan is STRING-AWARE (braces and quotes inside JSON string
+ * values, honouring `\"`, are ignored), so a value like `"a}b{c"` can't mis-scope the
+ * object. Bounded by `maxSpan` each way so a pathological input can't blow up; falls
+ * back to a bounded ±window when no enclosing object is found in range.
+ */
+export function enclosingObject(content: string, index: number, maxSpan = 4000): string {
+  const lo = Math.max(0, index - maxSpan);
+  const hi = Math.min(content.length, index + maxSpan);
+  const stack: number[] = []; // positions of currently-open `{`
+  let inStr = false;
+  let esc = false;
+  let enclosingOpen = -1; // innermost `{` open at `index`
+  for (let i = lo; i < hi; i++) {
+    const c = content[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (c === "\\") esc = true;
+      else if (c === '"') inStr = false;
+    } else if (c === '"') {
+      inStr = true;
+    } else if (c === "{") {
+      stack.push(i);
+    } else if (c === "}") {
+      const open = stack.pop();
+      if (open !== undefined && open === enclosingOpen) {
+        return content.slice(enclosingOpen, i + 1); // closed the enclosing object
+      }
+    }
+    if (i === index && enclosingOpen < 0 && stack.length > 0) {
+      enclosingOpen = stack[stack.length - 1];
+    }
+  }
+  // No complete enclosing object in range: if we found an (unclosed) enclosing open
+  // brace, return from it to hi. Otherwise the token is not inside any object (top-level
+  // token / brace-less config like YAML) — return a bounded ±250 window, NOT the full
+  // forward span, so a `"kty"` far AFTER the token can't pull an unrelated JWK into
+  // scope and over-suppress a legitimate standalone finding.
+  if (enclosingOpen >= 0) return content.slice(enclosingOpen, hi);
+  return content.slice(Math.max(0, index - 250), Math.min(content.length, index + 250));
+}
+
+/**
+ * Blank out FULL-LINE comments so a commented-out directive isn't reported as an
+ * active setting. A line counts as a comment when its first non-whitespace characters
+ * match one of `markers` (e.g. `#`, `//`, `;`, `!`). Each such line's characters are
+ * replaced with spaces of the SAME length (newlines preserved), so every byte offset
+ * is unchanged — the finding line/column/snippet for the non-comment lines that remain
+ * stay exactly correct. Inline trailing comments are intentionally left alone (the
+ * directive before them is still active, so it should still be flagged).
+ *
+ * Config detectors run their rules over the masked content; matches can then only land
+ * on live config, not on commented examples (mosquitto.conf, CI YAML, ipsec.conf, and
+ * HCL all conventionally ship large blocks of commented-out directives).
+ */
+export function maskCommentLines(content: string, markers: readonly string[]): string {
+  if (markers.length === 0) return content;
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lead = line.trimStart();
+    if (lead !== "" && markers.some((mk) => lead.startsWith(mk))) {
+      lines[i] = " ".repeat(line.length);
+    }
+  }
+  return lines.join("\n");
+}
+
+/**
+ * Blank out C-style block comments (the `slash-star … star-slash` form, multi-line
+ * included), replacing every
+ * character with a space and preserving newlines so byte offsets — and therefore
+ * finding line/column — stay exact. Complements {@link maskCommentLines}, which only
+ * masks whole single-line comments: an HCL/Bicep resource wrapped in a block comment
+ * has its inner lines mid-block (they don't START with `/*`), so a line-only masker
+ * leaves them live. Not string-aware — a literal `/*` inside a config string value is
+ * rare and, for these token detectors, a tolerable over-mask.
+ */
+export function maskBlockComments(content: string): string {
+  if (!content.includes("/*")) return content;
+  const out: string[] = [];
+  let i = 0;
+  const n = content.length;
+  while (i < n) {
+    if (content[i] === "/" && content[i + 1] === "*") {
+      const end = content.indexOf("*/", i + 2);
+      const stop = end === -1 ? n : end + 2;
+      for (let j = i; j < stop; j++) out.push(content[j] === "\n" ? "\n" : " ");
+      i = stop;
+    } else {
+      out.push(content[i]);
+      i++;
+    }
+  }
+  return out.join("");
+}

package/src/detectors/age.ts

@@ -0,0 +1,60 @@
+/**
+ * Config detector: age IDENTITY (private) keys committed to disk. The secrets
+ * detector flags age *recipients* (`age1…` public keys); this flags the far worse
+ * case — an `AGE-SECRET-KEY-1…` private identity checked into a repo or config.
+ * age identities are X25519 secret keys: a classical key-agreement secret that,
+ * once leaked or committed, lets an attacker decrypt every age-wrapped payload
+ * addressed to it (harvest-now-decrypt-later, and retroactively un-fixable if the
+ * ciphertext is already in git history).
+ *
+ * The matched value IS the private key, so it is marked sensitive and reporters
+ * drop the snippet.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_HARDCODED_KEY } from "../cwe.js";
+
+// age secret keys are Bech32 in uppercase: `AGE-SECRET-KEY-1` + data part.
+const RE_AGE_SECRET = /\bAGE-SECRET-KEY-1[0-9A-Z]{50,}\b/g;
+
+const RULE_AGE_SECRET: RuleMeta = {
+  id: "age-secret-key",
+  title: "age identity (X25519 private key)",
+  description: "An age AGE-SECRET-KEY-1 private identity key committed to disk",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_HARDCODED_KEY,
+  sensitive: true,
+  message:
+    "An age identity (X25519 private key) is committed to disk; every age-wrapped payload addressed to it is decryptable by anyone with this key, and the exposure is retroactive if the ciphertext is already in git history.",
+  remediation:
+    "Rotate the age identity and re-encrypt affected data; move the private key to a secret manager. Plan for a post-quantum KEM (ML-KEM) recipient when available.",
+};
+
+/** Detects committed age identity (private) keys. */
+export const ageDetector: Detector = {
+  id: "age-identity",
+  description: "Committed age identity (X25519 private) keys",
+  scope: "config",
+  language: "any",
+  rules: [RULE_AGE_SECRET],
+  appliesTo: () => true,
+  detect({ file, content }): Finding[] {
+    if (!content.includes("AGE-SECRET-KEY-1")) return [];
+    const findings: Finding[] = [];
+    eachMatch(RE_AGE_SECRET, content, (m) =>
+      findings.push(
+        findingFromRule(RULE_AGE_SECRET, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      ),
+    );
+    return findings;
+  },
+};

package/src/detectors/ansible.ts

@@ -0,0 +1,140 @@
+/**
+ * Config detector: classical asymmetric keys provisioned by Ansible's
+ * `community.crypto` collection. Playbooks that mint TLS/SSH key material with
+ * `openssl_privatekey` / `openssl_csr` / `x509_certificate` provision real
+ * classical keys the language packs never see — the IaC surface, in YAML.
+ *
+ * Gated to a `community.crypto` / `openssl_privatekey` marker so a bare
+ * `type: RSA` in unrelated YAML does not fire.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+const YAML_EXTENSIONS: readonly string[] = [".yml", ".yaml"];
+
+const RE_ANSIBLE_RSA = /\btype:\s*["']?RSA\b/g;
+const RE_ANSIBLE_ECC = /\btype:\s*["']?ECC\b/g;
+// community.crypto also supports these `type:` values, all classical.
+const RE_ANSIBLE_EDDSA = /\btype:\s*["']?Ed(?:25519|448)\b/g;
+const RE_ANSIBLE_XDH = /\btype:\s*["']?X(?:25519|448)\b/g;
+const RE_ANSIBLE_DSA = /\btype:\s*["']?DSA\b/g;
+
+const RULE_ANSIBLE_RSA: RuleMeta = {
+  id: "ansible-openssl-rsa",
+  title: "Ansible community.crypto RSA key",
+  description: "Ansible community.crypto openssl_privatekey/csr with type: RSA",
+  category: "kem",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Ansible provisions a classical RSA key (community.crypto), which is not quantum-safe.",
+  remediation:
+    "Plan migration to PQC keys (ML-KEM-768 / ML-DSA-65) as the collection adds support.",
+};
+const RULE_ANSIBLE_ECC: RuleMeta = {
+  id: "ansible-openssl-ecc",
+  title: "Ansible community.crypto EC key",
+  description: "Ansible community.crypto openssl_privatekey/csr with type: ECC",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ansible provisions a classical EC key (community.crypto); EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+
+const RULE_ANSIBLE_EDDSA: RuleMeta = {
+  id: "ansible-openssl-eddsa",
+  title: "Ansible community.crypto Ed25519/Ed448 key",
+  description: "Ansible community.crypto openssl_privatekey with type: Ed25519/Ed448",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "EdDSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ansible provisions a classical Ed25519/Ed448 key (community.crypto), forgeable by a quantum attacker.",
+  remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+};
+const RULE_ANSIBLE_XDH: RuleMeta = {
+  id: "ansible-openssl-xdh",
+  title: "Ansible community.crypto X25519/X448 key",
+  description: "Ansible community.crypto openssl_privatekey with type: X25519/X448",
+  category: "key-exchange",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "X25519",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ansible provisions a classical X25519/X448 key-agreement key (community.crypto), which is harvest-now-decrypt-later exposed.",
+  remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+};
+const RULE_ANSIBLE_DSA: RuleMeta = {
+  id: "ansible-openssl-dsa",
+  title: "Ansible community.crypto DSA key (deprecated)",
+  description: "Ansible community.crypto openssl_privatekey with type: DSA",
+  category: "signature",
+  severity: "medium",
+  confidence: "high",
+  algorithm: "DSA",
+  hndl: false,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Ansible provisions a classical DSA key (community.crypto); deprecated and forgeable by a quantum attacker.",
+  remediation: "Rotate off DSA today; migrate to ML-DSA-65 (FIPS 204).",
+};
+
+/** Detects classical asymmetric keys provisioned by Ansible community.crypto. */
+export const ansibleDetector: Detector = {
+  id: "ansible-crypto",
+  description: "Classical asymmetric keys provisioned by Ansible community.crypto",
+  scope: "config",
+  language: "any",
+  rules: [
+    RULE_ANSIBLE_RSA,
+    RULE_ANSIBLE_ECC,
+    RULE_ANSIBLE_EDDSA,
+    RULE_ANSIBLE_XDH,
+    RULE_ANSIBLE_DSA,
+  ],
+  appliesTo: (f) => hasExtension(f, YAML_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Gate: only inside a community.crypto / openssl_privatekey context.
+    if (!content.includes("community.crypto") && !content.includes("openssl_privatekey")) return [];
+    // YAML `#` comments are not active settings; match over comment-masked content
+    // (offsets preserved) so a `# type: RSA` note does not fire.
+    const scan = maskCommentLines(content, ["#"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    add(RE_ANSIBLE_RSA, RULE_ANSIBLE_RSA);
+    add(RE_ANSIBLE_ECC, RULE_ANSIBLE_ECC);
+    add(RE_ANSIBLE_EDDSA, RULE_ANSIBLE_EDDSA);
+    // Report the matched curve's own algorithm (X448 vs X25519) instead of the rule's
+    // default label.
+    eachMatch(RE_ANSIBLE_XDH, scan, (m) =>
+      findings.push(
+        findingFromRule(
+          RULE_ANSIBLE_XDH,
+          { file, content, index: m.index, matchLength: m[0].length },
+          m[0].includes("448") ? { algorithm: "X448" } : undefined,
+        ),
+      ),
+    );
+    add(RE_ANSIBLE_DSA, RULE_ANSIBLE_DSA);
+    return findings;
+  },
+};

package/src/detectors/bicep.ts

@@ -0,0 +1,107 @@
+/**
+ * IaC detector: classical asymmetric cryptography and legacy TLS declared in Azure
+ * Bicep (`.bicep`) — Azure's native IaC DSL, distinct from the ARM/CloudFormation
+ * JSON the cloudformation detector already covers (Bicep is the *source*; ARM JSON is
+ * its compiled output). Bicep provisions the same Key Vault keys and TLS floors, but
+ * in its own single-quoted-string syntax that the JSON detector never sees.
+ *
+ * Covered (gated to `.bicep` files):
+ *  - `Microsoft.KeyVault/vaults/keys` `kty: 'RSA' | 'RSA-HSM' | 'EC' | 'EC-HSM'` — a
+ *    classical Key Vault key. RSA is KEM (HNDL); EC feeds ECDSA + ECDH (the ECDH path
+ *    is HNDL). Gated to a `Microsoft.KeyVault` marker so a stray `kty` elsewhere in a
+ *    template does not fire.
+ *  - `minimumTlsVersion: 'TLS1_0' | 'TLS1_1'` — a deprecated TLS floor on storage /
+ *    app-service / other resources (RFC 8996). Not HNDL (a config weakness), category
+ *    "tls".
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH } from "../cwe.js";
+
+const BICEP_EXTENSIONS: readonly string[] = [".bicep"];
+
+// Bicep string values are single-quoted. `kty: 'RSA'` / `'RSA-HSM'` (KEM) and
+// `kty: 'EC'` / `'EC-HSM'` (EC). The `(?<![\w-])` lookbehind stops a longer key name
+// from matching on a `kty` suffix; the value bound keeps `'EC'` from matching `'ECX'`.
+const RE_BICEP_KTY_RSA = /(?<![\w-])kty\s*:\s*'RSA(?:-HSM)?'/g;
+const RE_BICEP_KTY_EC = /(?<![\w-])kty\s*:\s*'EC(?:-HSM)?'/g;
+// Legacy TLS floor. `TLS1_0` / `TLS1_1` are deprecated; `TLS1_2` / `TLS1_3` are fine,
+// and the closing quote keeps this from matching them.
+const RE_BICEP_MIN_TLS = /(?<![\w])minimumTlsVersion\s*:\s*'TLS1_[01]'/g;
+
+const RULE_BICEP_KTY_RSA: RuleMeta = {
+  id: "bicep-keyvault-rsa",
+  title: "Bicep Azure Key Vault RSA key",
+  description: "Azure Bicep Microsoft.KeyVault key with kty: 'RSA'",
+  category: "kem",
+  severity: "high",
+  confidence: "high",
+  algorithm: "RSA",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message: "Bicep provisions a classical RSA Azure Key Vault key, which is not quantum-safe.",
+  remediation: "Plan migration to PQC (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+};
+const RULE_BICEP_KTY_EC: RuleMeta = {
+  id: "bicep-keyvault-ec",
+  title: "Bicep Azure Key Vault EC key",
+  description: "Azure Bicep Microsoft.KeyVault key with kty: 'EC'",
+  category: "key-exchange",
+  severity: "high",
+  confidence: "high",
+  algorithm: "ECDH",
+  hndl: true,
+  cwe: CWE_BROKEN_CRYPTO,
+  message:
+    "Bicep provisions a classical EC Azure Key Vault key; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+  remediation:
+    "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_BICEP_MIN_TLS: RuleMeta = {
+  id: "bicep-min-tls-legacy",
+  title: "Bicep legacy minimum TLS version",
+  description: "Azure Bicep resource pins minimumTlsVersion to TLS 1.0/1.1",
+  category: "tls",
+  severity: "medium",
+  confidence: "high",
+  hndl: false,
+  cwe: CWE_WEAK_STRENGTH,
+  message: "Bicep resource pins a deprecated TLS floor (TLS 1.0/1.1); require TLS 1.2+ (1.3).",
+  remediation: "Set minimumTlsVersion: 'TLS1_2' and prefer PQC-hybrid key exchange as it lands.",
+};
+
+/** Detects classical asymmetric crypto and legacy TLS declared in Azure Bicep. */
+export const bicepDetector: Detector = {
+  id: "bicep-crypto",
+  description: "Classical asymmetric crypto and legacy TLS declared in Azure Bicep (IaC)",
+  scope: "config",
+  language: "any",
+  rules: [RULE_BICEP_KTY_RSA, RULE_BICEP_KTY_EC, RULE_BICEP_MIN_TLS],
+  appliesTo: (f) => hasExtension(f, BICEP_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Bicep comments are `//` and `/* … */`; mask block comments (multi-line) then
+    // whole `//` comment lines so a commented-out resource can't fire. Offsets preserved.
+    const scan = maskCommentLines(maskBlockComments(content), ["//"]);
+    const findings: Finding[] = [];
+    const add = (re: RegExp, rule: RuleMeta) =>
+      eachMatch(re, scan, (m) =>
+        findings.push(
+          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
+        ),
+      );
+    // The bare `kty` field is generic; only treat it as a Key Vault key when the
+    // resource type is actually present, mirroring the cloudformation ARM gate.
+    if (content.includes("Microsoft.KeyVault")) {
+      add(RE_BICEP_KTY_RSA, RULE_BICEP_KTY_RSA);
+      add(RE_BICEP_KTY_EC, RULE_BICEP_KTY_EC);
+    }
+    add(RE_BICEP_MIN_TLS, RULE_BICEP_MIN_TLS);
+    return findings;
+  },
+};

package/src/detectors/c.ts

@@ -48,7 +48,9 @@ const RE_C_RSA_VERIFY = /\bRSA_verify\s*\(/g;
 const RE_C_RSA_CRYPT = /\bRSA_public_encrypt\s*\(|\bRSA_private_decrypt\s*\(/g;
 // C/OpenSSL legacy TLS configuration (mirrors source.ts tlsDetector): forcing a
 // deprecated protocol version or disabling certificate verification.
-const RE_C_TLS_VERSION = /\bTLSv1_method\b|\bSSLv3_method\b/g;
+// TLSv1_method / TLSv1_1_method (+ the client/server-specific variants) and the
+// SSLv2/SSLv3 method constructors — all pin a deprecated protocol (RFC 8996).
+const RE_C_TLS_VERSION = /\b(?:TLSv1(?:_1)?|SSLv2|SSLv3)(?:_client|_server)?_method\b/g;
 const RE_C_TLS_VERIFY_NONE = /\bSSL_VERIFY_NONE\b/g;
 // Embedded C crypto libraries (the "embedded" niche): Mbed TLS and wolfSSL /
 // wolfCrypt. Both use highly-distinctive `mbedtls_*` / `wc_*` prefixes, so the
@@ -511,9 +513,35 @@ export const cDetector: Detector = {
     add(RE_C_DSA, RULE_C_DSA);
     add(RE_C_DH, RULE_C_DH);
     add(RE_C_EVP_KEYGEN, RULE_C_EVP_KEYGEN);
-    add(RE_C_EVP_DERIVE, RULE_C_EVP_DERIVE);
+    // `EVP_PKEY_derive` is OpenSSL's entry point for BOTH (EC)DH key agreement and the
+    // symmetric KDFs (HKDF/scrypt/TLS1-PRF). Real (EC)DH always sets a peer key via
+    // `EVP_PKEY_derive_set_peer`; a KDF never does. So only treat it as classical key
+    // agreement when a peer is set, or when no KDF context marker is present.
+    const hasKdfCtx = /\bEVP_PKEY_(?:HKDF|SCRYPT|TLS1_PRF)\b/.test(content);
+    if (content.includes("EVP_PKEY_derive_set_peer") || !hasKdfCtx) {
+      add(RE_C_EVP_DERIVE, RULE_C_EVP_DERIVE);
+    }
     add(RE_C_EVP_CRYPT, RULE_C_EVP_CRYPT);
-    add(RE_C_EVP_SIGN, RULE_C_EVP_SIGN);
+    // `EVP_DigestSign*` also drives HMAC/CMAC (a symmetric MAC keyed by
+    // `EVP_PKEY_new_mac_key(EVP_PKEY_HMAC/CMAC, …)`), which is NOT a classical
+    // asymmetric signature. Suppress a `DigestSign*` match ONLY when a MAC key setup
+    // sits just before it — per-match, so a real RSA/ECDSA sign elsewhere in the same
+    // file is still reported. `DigestVerify*` (no MAC form here) is never suppressed.
+    eachMatch(RE_C_EVP_SIGN, content, (m) => {
+      const isSign = m[0].includes("DigestSign");
+      if (isSign) {
+        const back = content.slice(Math.max(0, m.index - 300), m.index);
+        if (/EVP_PKEY_new_mac_key|EVP_PKEY_(?:HMAC|CMAC)\b/.test(back)) return;
+      }
+      findings.push(
+        findingFromRule(RULE_C_EVP_SIGN, {
+          file,
+          content,
+          index: m.index,
+          matchLength: m[0].length,
+        }),
+      );
+    });
     add(RE_C_SODIUM_BOX, RULE_C_SODIUM_BOX);
     add(RE_C_SODIUM_SIGN, RULE_C_SODIUM_SIGN);
     add(RE_C_ECDSA_VERIFY, RULE_C_ECDSA_VERIFY);

package/src/detectors/cicd.ts

@@ -22,7 +22,7 @@
  * doc does not fire; the surface here is specifically the release pipeline.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { eachMatch, findingFromRule, maskCommentLines } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
 /** True for the CI/CD pipeline definition files this detector inspects. */
@@ -48,7 +48,9 @@ interface CiRule {
 
 const CI_RULES: CiRule[] = [
   {
-    re: /\bcosign\s+(?:sign|attest|sign-blob|generate-key-pair)\b/g,
+    // `sign-blob` precedes `sign` so the longer subcommand wins — otherwise `sign`
+    // matches first and the trailing `\b` succeeds at the `-`, never reaching `sign-blob`.
+    re: /\bcosign\s+(?:sign-blob|sign|attest|generate-key-pair)\b/g,
     meta: {
       id: "ci-cosign-ecdsa",
       title: "cosign artifact signing (ECDSA)",
@@ -66,7 +68,11 @@ const CI_RULES: CiRule[] = [
     },
   },
   {
-    re: /\bgpg\b[^\n]*?\s--(?:detach-sign|clearsign|sign)\b/g,
+    // Bound the span to the gpg invocation ([^\n&|;] stops it crossing `&&`/`|`/`;`
+    // into another command's flag), and `(?![\w-])` stops `--sign` matching the
+    // `--sign` prefix of an unrelated flag like `--sign-artifacts`. The short forms
+    // `-s` (sign) / `-b` (detach-sign) are safe inside the bounded gpg span.
+    re: /\bgpg\b[^\n&|;]{0,120}?\s(?:-[sb]\b|--(?:detach-sign|clearsign|sign)(?![\w-]))/g,
     meta: {
       id: "ci-gpg-sign",
       title: "GPG signing (RSA)",
@@ -101,7 +107,10 @@ const CI_RULES: CiRule[] = [
     },
   },
   {
-    re: /\bcodesign\s+(?:-s\b|--sign\b)/g,
+    // Allow intervening flags (the common `codesign --force --options runtime --sign`
+    // form), bounded to the codesign invocation so it can't latch onto a later
+    // command's `--sign` across `&&`/`|`/`;`.
+    re: /\bcodesign\b[^\n&|;]{0,120}?\s(?:-s\b|--sign\b)/g,
     meta: {
       id: "ci-codesign",
       title: "Apple codesign (RSA)",
@@ -146,8 +155,12 @@ export const cicdDetector: Detector = {
   appliesTo: isCiPipelineFile,
   detect({ file, content }): Finding[] {
     const findings: Finding[] = [];
+    // A commented-out CI step (`# - run: cosign sign …`, or a `//` line in a
+    // Jenkinsfile) is not an active signing step. Mask comment lines first; offsets
+    // are preserved so the snippet from the original `content` stays correct.
+    const scan = maskCommentLines(content, ["#", "//"]);
     for (const rule of CI_RULES) {
-      eachMatch(rule.re, content, (m) => {
+      eachMatch(rule.re, scan, (m) => {
         findings.push(
           findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
         );