@rmyndharis/aimhooman 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.agents/rules/aimhooman.md +53 -0
- package/.claude-plugin/marketplace.json +23 -0
- package/.claude-plugin/plugin.json +9 -0
- package/.clinerules/aimhooman.md +53 -0
- package/.codex-plugin/plugin.json +37 -0
- package/.cursor/rules/aimhooman.mdc +59 -0
- package/.gemini/settings.json +7 -0
- package/.github/copilot-instructions.md +53 -0
- package/.github/hooks/aimhooman.json +22 -0
- package/.kiro/steering/aimhooman.md +53 -0
- package/.windsurf/rules/aimhooman.md +57 -0
- package/AGENTS.md +53 -0
- package/CHANGELOG.md +153 -0
- package/CODE_OF_CONDUCT.md +128 -0
- package/CONTRIBUTING.md +144 -0
- package/GEMINI.md +53 -0
- package/LICENSE +21 -0
- package/README.md +472 -0
- package/SECURITY.md +74 -0
- package/bin/aimhooman.mjs +1589 -0
- package/docs/design/agent-portability.md +73 -0
- package/docs/design/frictionless-enforcement.md +135 -0
- package/docs/hosts.json +164 -0
- package/docs/logo/aimhooman-logo.png +0 -0
- package/docs/logo/aimhooman.png +0 -0
- package/hooks/hooks.json +29 -0
- package/package.json +77 -0
- package/rules/attribution.json +142 -0
- package/rules/markers.json +88 -0
- package/rules/paths.json +407 -0
- package/rules/secrets.json +90 -0
- package/schemas/overrides.schema.json +134 -0
- package/schemas/project-policy.schema.json +12 -0
- package/schemas/rule-pack.schema.json +126 -0
- package/schemas/scan-report.schema.json +165 -0
- package/skills/aimhooman/SKILL.md +65 -0
- package/src/args.mjs +72 -0
- package/src/atomic-write.mjs +285 -0
- package/src/codex-manifest.mjs +65 -0
- package/src/exclude.mjs +125 -0
- package/src/git-environment.mjs +5 -0
- package/src/git-path.mjs +5 -0
- package/src/githooks.mjs +813 -0
- package/src/gitx.mjs +721 -0
- package/src/history-scan.mjs +295 -0
- package/src/hook.mjs +2602 -0
- package/src/policy-resolver.mjs +200 -0
- package/src/report.mjs +63 -0
- package/src/rules.mjs +509 -0
- package/src/ruleset-text.mjs +29 -0
- package/src/scan-session.mjs +152 -0
- package/src/scan-target.mjs +697 -0
- package/src/scan.mjs +325 -0
- package/src/state.mjs +360 -0
|
@@ -0,0 +1,88 @@
|
|
|
1
|
+
[
|
|
2
|
+
{
|
|
3
|
+
"id": "marker.corner-cut",
|
|
4
|
+
"version": 2,
|
|
5
|
+
"provider": "generic",
|
|
6
|
+
"category": "ai-marker",
|
|
7
|
+
"confidence": "medium",
|
|
8
|
+
"kind": "code",
|
|
9
|
+
"match": {
|
|
10
|
+
"paths": [
|
|
11
|
+
"**/*"
|
|
12
|
+
],
|
|
13
|
+
"except": [
|
|
14
|
+
"**/docs/**",
|
|
15
|
+
"**/test/**",
|
|
16
|
+
"**/tests/**",
|
|
17
|
+
"**/fixtures/**",
|
|
18
|
+
"**/__fixtures__/**",
|
|
19
|
+
"**/vendor/**",
|
|
20
|
+
"**/third_party/**",
|
|
21
|
+
"**/node_modules/**",
|
|
22
|
+
"**/dist/**",
|
|
23
|
+
"**/build/**",
|
|
24
|
+
"**/coverage/**",
|
|
25
|
+
"**/generated/**",
|
|
26
|
+
"**/*.generated.*",
|
|
27
|
+
"**/*.min.js",
|
|
28
|
+
"**/*.map",
|
|
29
|
+
"**/*.md"
|
|
30
|
+
],
|
|
31
|
+
"content": [
|
|
32
|
+
"(?i)\\b(ponytail|caveman|yagni-oneliner):"
|
|
33
|
+
]
|
|
34
|
+
},
|
|
35
|
+
"actions": {
|
|
36
|
+
"clean": "review",
|
|
37
|
+
"strict": "block",
|
|
38
|
+
"compliance": "review"
|
|
39
|
+
},
|
|
40
|
+
"reason": "AI-tooling corner-cut marker left in committed code.",
|
|
41
|
+
"remediation": [
|
|
42
|
+
"Resolve the shortcut it names, or remove the marker before committing."
|
|
43
|
+
]
|
|
44
|
+
},
|
|
45
|
+
{
|
|
46
|
+
"id": "marker.ai-authored",
|
|
47
|
+
"version": 1,
|
|
48
|
+
"provider": "generic",
|
|
49
|
+
"category": "ai-marker",
|
|
50
|
+
"confidence": "low",
|
|
51
|
+
"kind": "code",
|
|
52
|
+
"match": {
|
|
53
|
+
"paths": [
|
|
54
|
+
"**/*"
|
|
55
|
+
],
|
|
56
|
+
"except": [
|
|
57
|
+
"**/docs/**",
|
|
58
|
+
"**/test/**",
|
|
59
|
+
"**/tests/**",
|
|
60
|
+
"**/fixtures/**",
|
|
61
|
+
"**/__fixtures__/**",
|
|
62
|
+
"**/vendor/**",
|
|
63
|
+
"**/third_party/**",
|
|
64
|
+
"**/node_modules/**",
|
|
65
|
+
"**/dist/**",
|
|
66
|
+
"**/build/**",
|
|
67
|
+
"**/coverage/**",
|
|
68
|
+
"**/generated/**",
|
|
69
|
+
"**/*.generated.*",
|
|
70
|
+
"**/*.min.js",
|
|
71
|
+
"**/*.map",
|
|
72
|
+
"**/*.md"
|
|
73
|
+
],
|
|
74
|
+
"content": [
|
|
75
|
+
"(?i)\\b(ai[- ]?generated|generated by (ai|copilot|claude|chatgpt|codex))\\b"
|
|
76
|
+
]
|
|
77
|
+
},
|
|
78
|
+
"actions": {
|
|
79
|
+
"clean": "review",
|
|
80
|
+
"strict": "block",
|
|
81
|
+
"compliance": "review"
|
|
82
|
+
},
|
|
83
|
+
"reason": "AI-authored code marker left in committed code.",
|
|
84
|
+
"remediation": [
|
|
85
|
+
"Remove the marker comment if the code is human-owned."
|
|
86
|
+
]
|
|
87
|
+
}
|
|
88
|
+
]
|
package/rules/paths.json
ADDED
|
@@ -0,0 +1,407 @@
|
|
|
1
|
+
[
|
|
2
|
+
{
|
|
3
|
+
"id": "claude.local-settings",
|
|
4
|
+
"version": 1,
|
|
5
|
+
"provider": "claude-code",
|
|
6
|
+
"category": "local-settings",
|
|
7
|
+
"confidence": "high",
|
|
8
|
+
"kind": "path",
|
|
9
|
+
"match": {
|
|
10
|
+
"paths": [
|
|
11
|
+
".claude/settings.local.json",
|
|
12
|
+
"**/.claude/settings.local.json"
|
|
13
|
+
]
|
|
14
|
+
},
|
|
15
|
+
"actions": {
|
|
16
|
+
"clean": "block",
|
|
17
|
+
"strict": "block",
|
|
18
|
+
"compliance": "block"
|
|
19
|
+
},
|
|
20
|
+
"reason": "Personal Claude Code settings are not intended for source control.",
|
|
21
|
+
"remediation": [
|
|
22
|
+
"git restore --staged .claude/settings.local.json"
|
|
23
|
+
]
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
"id": "claude.session-state",
|
|
27
|
+
"version": 1,
|
|
28
|
+
"provider": "claude-code",
|
|
29
|
+
"category": "ephemeral-state",
|
|
30
|
+
"confidence": "high",
|
|
31
|
+
"kind": "path",
|
|
32
|
+
"match": {
|
|
33
|
+
"paths": [
|
|
34
|
+
".claude.json",
|
|
35
|
+
"**/.claude.json",
|
|
36
|
+
".claude/.credentials.json",
|
|
37
|
+
"**/.claude/.credentials.json",
|
|
38
|
+
".claude/session*.json",
|
|
39
|
+
"**/.claude/session*.json",
|
|
40
|
+
".claude/history*",
|
|
41
|
+
"**/.claude/history*",
|
|
42
|
+
".claude/todos/**",
|
|
43
|
+
"**/.claude/todos/**",
|
|
44
|
+
".claude/shell-snapshots/**",
|
|
45
|
+
"**/.claude/shell-snapshots/**",
|
|
46
|
+
".claude/statsig/**",
|
|
47
|
+
"**/.claude/statsig/**",
|
|
48
|
+
".claude/projects/**",
|
|
49
|
+
"**/.claude/projects/**",
|
|
50
|
+
".claude/logs/**",
|
|
51
|
+
"**/.claude/logs/**"
|
|
52
|
+
]
|
|
53
|
+
},
|
|
54
|
+
"actions": {
|
|
55
|
+
"clean": "block",
|
|
56
|
+
"strict": "block",
|
|
57
|
+
"compliance": "block"
|
|
58
|
+
},
|
|
59
|
+
"reason": "Claude Code session and state artifacts are local, not repository content.",
|
|
60
|
+
"remediation": [
|
|
61
|
+
"git restore --staged <path>",
|
|
62
|
+
"add the path to your local git exclude"
|
|
63
|
+
]
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
"id": "codex.session-state",
|
|
67
|
+
"version": 1,
|
|
68
|
+
"provider": "codex",
|
|
69
|
+
"category": "ephemeral-state",
|
|
70
|
+
"confidence": "high",
|
|
71
|
+
"kind": "path",
|
|
72
|
+
"match": {
|
|
73
|
+
"paths": [
|
|
74
|
+
".codex/sessions/**",
|
|
75
|
+
"**/.codex/sessions/**",
|
|
76
|
+
".codex/history*",
|
|
77
|
+
"**/.codex/history*",
|
|
78
|
+
".codex/log/**",
|
|
79
|
+
"**/.codex/log/**",
|
|
80
|
+
".codex/logs/**",
|
|
81
|
+
"**/.codex/logs/**"
|
|
82
|
+
]
|
|
83
|
+
},
|
|
84
|
+
"actions": {
|
|
85
|
+
"clean": "block",
|
|
86
|
+
"strict": "block",
|
|
87
|
+
"compliance": "block"
|
|
88
|
+
},
|
|
89
|
+
"reason": "Codex session, history, and log artifacts are local, not repository content.",
|
|
90
|
+
"remediation": [
|
|
91
|
+
"git restore --staged <path>"
|
|
92
|
+
]
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "copilot.session-state",
|
|
96
|
+
"version": 2,
|
|
97
|
+
"provider": "copilot",
|
|
98
|
+
"category": "ephemeral-state",
|
|
99
|
+
"confidence": "high",
|
|
100
|
+
"kind": "path",
|
|
101
|
+
"match": {
|
|
102
|
+
"paths": [
|
|
103
|
+
".copilot/**",
|
|
104
|
+
"**/.copilot/**"
|
|
105
|
+
]
|
|
106
|
+
},
|
|
107
|
+
"actions": {
|
|
108
|
+
"clean": "block",
|
|
109
|
+
"strict": "block",
|
|
110
|
+
"compliance": "block"
|
|
111
|
+
},
|
|
112
|
+
"reason": "Copilot local state is not repository content.",
|
|
113
|
+
"remediation": [
|
|
114
|
+
"git restore --staged <path>"
|
|
115
|
+
]
|
|
116
|
+
},
|
|
117
|
+
{
|
|
118
|
+
"id": "cursor.session-state",
|
|
119
|
+
"version": 1,
|
|
120
|
+
"provider": "cursor",
|
|
121
|
+
"category": "ephemeral-state",
|
|
122
|
+
"confidence": "medium",
|
|
123
|
+
"kind": "path",
|
|
124
|
+
"match": {
|
|
125
|
+
"paths": [
|
|
126
|
+
".cursor/session*",
|
|
127
|
+
"**/.cursor/session*",
|
|
128
|
+
".cursor/chats/**",
|
|
129
|
+
"**/.cursor/chats/**",
|
|
130
|
+
".cursor/logs/**",
|
|
131
|
+
"**/.cursor/logs/**"
|
|
132
|
+
]
|
|
133
|
+
},
|
|
134
|
+
"actions": {
|
|
135
|
+
"clean": "block",
|
|
136
|
+
"strict": "block",
|
|
137
|
+
"compliance": "block"
|
|
138
|
+
},
|
|
139
|
+
"reason": "Cursor session artifacts are local, not repository content.",
|
|
140
|
+
"remediation": [
|
|
141
|
+
"git restore --staged <path>"
|
|
142
|
+
]
|
|
143
|
+
},
|
|
144
|
+
{
|
|
145
|
+
"id": "aider.history",
|
|
146
|
+
"version": 2,
|
|
147
|
+
"provider": "aider",
|
|
148
|
+
"category": "ephemeral-state",
|
|
149
|
+
"confidence": "high",
|
|
150
|
+
"kind": "path",
|
|
151
|
+
"match": {
|
|
152
|
+
"paths": [
|
|
153
|
+
".aider.*",
|
|
154
|
+
"**/.aider.*"
|
|
155
|
+
]
|
|
156
|
+
},
|
|
157
|
+
"actions": {
|
|
158
|
+
"clean": "block",
|
|
159
|
+
"strict": "block",
|
|
160
|
+
"compliance": "block"
|
|
161
|
+
},
|
|
162
|
+
"reason": "Aider dotfiles are local, not repository content.",
|
|
163
|
+
"remediation": [
|
|
164
|
+
"git restore --staged <path>"
|
|
165
|
+
]
|
|
166
|
+
},
|
|
167
|
+
{
|
|
168
|
+
"id": "specstory.history",
|
|
169
|
+
"version": 1,
|
|
170
|
+
"provider": "specstory",
|
|
171
|
+
"category": "ephemeral-state",
|
|
172
|
+
"confidence": "medium",
|
|
173
|
+
"kind": "path",
|
|
174
|
+
"match": {
|
|
175
|
+
"paths": [
|
|
176
|
+
".specstory/**",
|
|
177
|
+
"**/.specstory/**"
|
|
178
|
+
]
|
|
179
|
+
},
|
|
180
|
+
"actions": {
|
|
181
|
+
"clean": "block",
|
|
182
|
+
"strict": "block",
|
|
183
|
+
"compliance": "block"
|
|
184
|
+
},
|
|
185
|
+
"reason": "SpecStory session history is local, not repository content.",
|
|
186
|
+
"remediation": [
|
|
187
|
+
"git restore --staged <path>"
|
|
188
|
+
]
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
"id": "continue.sessions",
|
|
192
|
+
"version": 1,
|
|
193
|
+
"provider": "continue",
|
|
194
|
+
"category": "ephemeral-state",
|
|
195
|
+
"confidence": "medium",
|
|
196
|
+
"kind": "path",
|
|
197
|
+
"match": {
|
|
198
|
+
"paths": [
|
|
199
|
+
".continue/sessions/**",
|
|
200
|
+
"**/.continue/sessions/**"
|
|
201
|
+
]
|
|
202
|
+
},
|
|
203
|
+
"actions": {
|
|
204
|
+
"clean": "block",
|
|
205
|
+
"strict": "block",
|
|
206
|
+
"compliance": "block"
|
|
207
|
+
},
|
|
208
|
+
"reason": "Continue session artifacts are local, not repository content.",
|
|
209
|
+
"remediation": [
|
|
210
|
+
"git restore --staged <path>"
|
|
211
|
+
]
|
|
212
|
+
},
|
|
213
|
+
{
|
|
214
|
+
"id": "secret.dotenv",
|
|
215
|
+
"version": 2,
|
|
216
|
+
"provider": "generic",
|
|
217
|
+
"category": "secret",
|
|
218
|
+
"confidence": "high",
|
|
219
|
+
"kind": "path",
|
|
220
|
+
"match": {
|
|
221
|
+
"path_case": "insensitive",
|
|
222
|
+
"paths": [
|
|
223
|
+
".env",
|
|
224
|
+
"**/.env",
|
|
225
|
+
".env.*",
|
|
226
|
+
"**/.env.*"
|
|
227
|
+
],
|
|
228
|
+
"except": [
|
|
229
|
+
".env.example",
|
|
230
|
+
"**/.env.example",
|
|
231
|
+
".env.sample",
|
|
232
|
+
"**/.env.sample",
|
|
233
|
+
".env.template",
|
|
234
|
+
"**/.env.template",
|
|
235
|
+
".env.dist",
|
|
236
|
+
"**/.env.dist",
|
|
237
|
+
".env.defaults",
|
|
238
|
+
"**/.env.defaults"
|
|
239
|
+
]
|
|
240
|
+
},
|
|
241
|
+
"actions": {
|
|
242
|
+
"clean": "block",
|
|
243
|
+
"strict": "block",
|
|
244
|
+
"compliance": "block"
|
|
245
|
+
},
|
|
246
|
+
"reason": "Environment files often carry secrets and should not be committed.",
|
|
247
|
+
"remediation": [
|
|
248
|
+
"git restore --staged <path>",
|
|
249
|
+
"commit a .env.example with placeholders instead"
|
|
250
|
+
]
|
|
251
|
+
},
|
|
252
|
+
{
|
|
253
|
+
"id": "secret.private-key",
|
|
254
|
+
"version": 2,
|
|
255
|
+
"provider": "generic",
|
|
256
|
+
"category": "secret",
|
|
257
|
+
"confidence": "high",
|
|
258
|
+
"kind": "path",
|
|
259
|
+
"match": {
|
|
260
|
+
"path_case": "insensitive",
|
|
261
|
+
"paths": [
|
|
262
|
+
"**/id_rsa",
|
|
263
|
+
"**/id_dsa",
|
|
264
|
+
"**/id_ecdsa",
|
|
265
|
+
"**/id_ed25519",
|
|
266
|
+
"**/*.p12",
|
|
267
|
+
"**/*.pfx"
|
|
268
|
+
]
|
|
269
|
+
},
|
|
270
|
+
"actions": {
|
|
271
|
+
"clean": "block",
|
|
272
|
+
"strict": "block",
|
|
273
|
+
"compliance": "block"
|
|
274
|
+
},
|
|
275
|
+
"reason": "Private key material must never be committed.",
|
|
276
|
+
"remediation": [
|
|
277
|
+
"git restore --staged <path>",
|
|
278
|
+
"rotate the key if it was ever exposed"
|
|
279
|
+
]
|
|
280
|
+
},
|
|
281
|
+
{
|
|
282
|
+
"id": "secret.aws-credentials",
|
|
283
|
+
"version": 2,
|
|
284
|
+
"provider": "generic",
|
|
285
|
+
"category": "secret",
|
|
286
|
+
"confidence": "high",
|
|
287
|
+
"kind": "path",
|
|
288
|
+
"match": {
|
|
289
|
+
"path_case": "insensitive",
|
|
290
|
+
"paths": [
|
|
291
|
+
".aws/credentials",
|
|
292
|
+
"**/.aws/credentials"
|
|
293
|
+
]
|
|
294
|
+
},
|
|
295
|
+
"actions": {
|
|
296
|
+
"clean": "block",
|
|
297
|
+
"strict": "block",
|
|
298
|
+
"compliance": "block"
|
|
299
|
+
},
|
|
300
|
+
"reason": "AWS credentials must never be committed.",
|
|
301
|
+
"remediation": [
|
|
302
|
+
"git restore --staged <path>"
|
|
303
|
+
]
|
|
304
|
+
},
|
|
305
|
+
{
|
|
306
|
+
"id": "generic.agent-instructions",
|
|
307
|
+
"version": 1,
|
|
308
|
+
"provider": "generic",
|
|
309
|
+
"category": "ambiguous-instructions",
|
|
310
|
+
"confidence": "medium",
|
|
311
|
+
"kind": "path",
|
|
312
|
+
"match": {
|
|
313
|
+
"paths": [
|
|
314
|
+
"AGENTS.md",
|
|
315
|
+
"**/AGENTS.md",
|
|
316
|
+
"CLAUDE.md",
|
|
317
|
+
"**/CLAUDE.md",
|
|
318
|
+
"GEMINI.md",
|
|
319
|
+
"**/GEMINI.md",
|
|
320
|
+
".github/copilot-instructions.md",
|
|
321
|
+
"**/.github/copilot-instructions.md"
|
|
322
|
+
]
|
|
323
|
+
},
|
|
324
|
+
"actions": {
|
|
325
|
+
"clean": "review",
|
|
326
|
+
"strict": "block",
|
|
327
|
+
"compliance": "review"
|
|
328
|
+
},
|
|
329
|
+
"reason": "Agent instruction files may be intentional team config. Review before committing.",
|
|
330
|
+
"remediation": [
|
|
331
|
+
"aimhooman allow <path> --reason \"shared team config\"",
|
|
332
|
+
"or unstage if it is personal"
|
|
333
|
+
]
|
|
334
|
+
},
|
|
335
|
+
{
|
|
336
|
+
"id": "generic.project-policy",
|
|
337
|
+
"version": 1,
|
|
338
|
+
"provider": "aimhooman",
|
|
339
|
+
"category": "policy-config",
|
|
340
|
+
"confidence": "high",
|
|
341
|
+
"kind": "path",
|
|
342
|
+
"match": {
|
|
343
|
+
"paths": [
|
|
344
|
+
".aimhooman.json",
|
|
345
|
+
"**/.aimhooman.json"
|
|
346
|
+
]
|
|
347
|
+
},
|
|
348
|
+
"actions": {
|
|
349
|
+
"clean": "review",
|
|
350
|
+
"strict": "block",
|
|
351
|
+
"compliance": "review"
|
|
352
|
+
},
|
|
353
|
+
"reason": "Versioned enforcement policy changes require explicit human review.",
|
|
354
|
+
"remediation": [
|
|
355
|
+
"aimhooman allow .aimhooman.json --reason \"reviewed team policy change\"",
|
|
356
|
+
"or unstage the policy change"
|
|
357
|
+
]
|
|
358
|
+
},
|
|
359
|
+
{
|
|
360
|
+
"id": "playwright-mcp.state",
|
|
361
|
+
"version": 1,
|
|
362
|
+
"provider": "playwright-mcp",
|
|
363
|
+
"category": "ephemeral-state",
|
|
364
|
+
"confidence": "high",
|
|
365
|
+
"kind": "path",
|
|
366
|
+
"match": { "paths": [".playwright-mcp/**", "**/.playwright-mcp/**"] },
|
|
367
|
+
"actions": { "clean": "block", "strict": "block", "compliance": "block" },
|
|
368
|
+
"reason": "Playwright MCP session artifacts are local, not repository content.",
|
|
369
|
+
"remediation": ["git restore --staged <path>"]
|
|
370
|
+
},
|
|
371
|
+
{
|
|
372
|
+
"id": "remember.state",
|
|
373
|
+
"version": 1,
|
|
374
|
+
"provider": "remember",
|
|
375
|
+
"category": "ephemeral-state",
|
|
376
|
+
"confidence": "high",
|
|
377
|
+
"kind": "path",
|
|
378
|
+
"match": { "paths": [".remember/**", "**/.remember/**"] },
|
|
379
|
+
"actions": { "clean": "block", "strict": "block", "compliance": "block" },
|
|
380
|
+
"reason": "Remember second-brain data is local, not repository content.",
|
|
381
|
+
"remediation": ["git restore --staged <path>"]
|
|
382
|
+
},
|
|
383
|
+
{
|
|
384
|
+
"id": "superpowers.state",
|
|
385
|
+
"version": 1,
|
|
386
|
+
"provider": "superpowers",
|
|
387
|
+
"category": "ephemeral-state",
|
|
388
|
+
"confidence": "high",
|
|
389
|
+
"kind": "path",
|
|
390
|
+
"match": { "paths": [".superpowers/**", "**/.superpowers/**"] },
|
|
391
|
+
"actions": { "clean": "block", "strict": "block", "compliance": "block" },
|
|
392
|
+
"reason": "Superpowers plugin state is local, not repository content.",
|
|
393
|
+
"remediation": ["git restore --staged <path>"]
|
|
394
|
+
},
|
|
395
|
+
{
|
|
396
|
+
"id": "agent.state",
|
|
397
|
+
"version": 2,
|
|
398
|
+
"provider": "generic",
|
|
399
|
+
"category": "ephemeral-state",
|
|
400
|
+
"confidence": "high",
|
|
401
|
+
"kind": "path",
|
|
402
|
+
"match": { "paths": [".agent/**", "**/.agent/**"] },
|
|
403
|
+
"actions": { "clean": "block", "strict": "block", "compliance": "block" },
|
|
404
|
+
"reason": "Generic agent state is local, not repository content.",
|
|
405
|
+
"remediation": ["git restore --staged <path>"]
|
|
406
|
+
}
|
|
407
|
+
]
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
[
|
|
2
|
+
{
|
|
3
|
+
"id": "secret.private-key-content",
|
|
4
|
+
"version": 1,
|
|
5
|
+
"provider": "generic",
|
|
6
|
+
"category": "secret",
|
|
7
|
+
"confidence": "high",
|
|
8
|
+
"kind": "code",
|
|
9
|
+
"match": {
|
|
10
|
+
"content": [
|
|
11
|
+
"-----BEGIN (?:ENCRYPTED |RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----"
|
|
12
|
+
]
|
|
13
|
+
},
|
|
14
|
+
"actions": {
|
|
15
|
+
"clean": "block",
|
|
16
|
+
"strict": "block",
|
|
17
|
+
"compliance": "block"
|
|
18
|
+
},
|
|
19
|
+
"reason": "Private-key material must not enter Git history.",
|
|
20
|
+
"remediation": [
|
|
21
|
+
"Remove the key from the index, rotate it if exposed, and store it outside the repository."
|
|
22
|
+
]
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"id": "secret.service-account-key",
|
|
26
|
+
"version": 1,
|
|
27
|
+
"provider": "generic",
|
|
28
|
+
"category": "secret",
|
|
29
|
+
"confidence": "high",
|
|
30
|
+
"kind": "code",
|
|
31
|
+
"match": {
|
|
32
|
+
"content": [
|
|
33
|
+
"(?i)\\\"private_key\\\"\\s*:\\s*\\\"-----BEGIN (?:RSA )?PRIVATE KEY-----"
|
|
34
|
+
]
|
|
35
|
+
},
|
|
36
|
+
"actions": {
|
|
37
|
+
"clean": "block",
|
|
38
|
+
"strict": "block",
|
|
39
|
+
"compliance": "block"
|
|
40
|
+
},
|
|
41
|
+
"reason": "A service-account credential must not enter Git history.",
|
|
42
|
+
"remediation": [
|
|
43
|
+
"Remove the credential from the index, rotate it if exposed, and use the service's secret store."
|
|
44
|
+
]
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "secret.aws-key-content",
|
|
48
|
+
"version": 1,
|
|
49
|
+
"provider": "aws",
|
|
50
|
+
"category": "secret",
|
|
51
|
+
"confidence": "high",
|
|
52
|
+
"kind": "code",
|
|
53
|
+
"match": {
|
|
54
|
+
"content": [
|
|
55
|
+
"(?i)\\baws_(?:secret_access_key|session_token)\\b\\s*[:=]\\s*[\\\"']?[A-Za-z0-9/+=]{32,}(?![A-Za-z0-9/+=])"
|
|
56
|
+
]
|
|
57
|
+
},
|
|
58
|
+
"actions": {
|
|
59
|
+
"clean": "block",
|
|
60
|
+
"strict": "block",
|
|
61
|
+
"compliance": "block"
|
|
62
|
+
},
|
|
63
|
+
"reason": "AWS credential material must not enter Git history.",
|
|
64
|
+
"remediation": [
|
|
65
|
+
"Remove the credential from the index, rotate it if exposed, and use an AWS credential provider."
|
|
66
|
+
]
|
|
67
|
+
},
|
|
68
|
+
{
|
|
69
|
+
"id": "secret.provider-token",
|
|
70
|
+
"version": 1,
|
|
71
|
+
"provider": "generic",
|
|
72
|
+
"category": "secret",
|
|
73
|
+
"confidence": "high",
|
|
74
|
+
"kind": "code",
|
|
75
|
+
"match": {
|
|
76
|
+
"content": [
|
|
77
|
+
"\\b(?:gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{60,255}|glpat-[A-Za-z0-9_-]{20,255}|npm_[A-Za-z0-9]{36,255}|xox[baprs]-[A-Za-z0-9-]{20,255})\\b"
|
|
78
|
+
]
|
|
79
|
+
},
|
|
80
|
+
"actions": {
|
|
81
|
+
"clean": "block",
|
|
82
|
+
"strict": "block",
|
|
83
|
+
"compliance": "block"
|
|
84
|
+
},
|
|
85
|
+
"reason": "A provider access token must not enter Git history.",
|
|
86
|
+
"remediation": [
|
|
87
|
+
"Remove the token from the index, revoke or rotate it, and use the provider's secret store."
|
|
88
|
+
]
|
|
89
|
+
}
|
|
90
|
+
]
|