@runsec/mcp 1.0.71 → 1.0.73

package/dist/data/trufflehog-config.yaml

@@ -12,7 +12,7 @@
 # Дополнительно в этом файле (расширения репозитория):
 #   - ITS-002 Keycloak Client Secret Policy Violation
 #   - ITS-002 Vault Token Policy Violation
-# Для assignment-детекторов (key:=value) — exclude_regexes_match отсекает ${VAR}, $VAR, getenv и т.п.
+# Env/placeholder filtering for assignment-style matches: cognitiveEngine.ts (not TruffleHog schema).
 # PCI-DSS / SOC2: криптография, object storage, telemetry — см. секцию COMPLIANCE в конце файла.
 # OAuth Client ID удалён (публичный идентификатор, не секрет).
 
@@ -47,14 +47,6 @@ detectors:
       - yandex-service-token
     regex:
       pattern: '(?i)(yandex[_-]?cloud[_-]?token|yc[_-]?iam[_-]?token|yandex[_-]?service[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{40,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Yandex 360 API Token
     keywords:
@@ -62,14 +54,6 @@ detectors:
       - y360-api-token
     regex:
       pattern: '(?i)(yandex[_-]?360[_-]?token|y360[_-]?api[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{32,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: VK Cloud API Token
     keywords:
@@ -77,14 +61,6 @@ detectors:
       - vcloud-api-token
     regex:
       pattern: '(?i)(vk[_-]?cloud[_-]?token|vcloud[_-]?api[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{40,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: VK OAuth Token
     keywords:
@@ -92,14 +68,6 @@ detectors:
       - vk-access-token
     regex:
       pattern: '(?i)(vk[_-]?oauth[_-]?token|vk[_-]?access[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{20,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: SberCloud API Token
     keywords:
@@ -107,14 +75,6 @@ detectors:
       - sber-cloud-api-token
     regex:
       pattern: '(?i)(sbercloud[_-]?token|sber[_-]?cloud[_-]?api[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{40,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: 1C HTTP API Token
     keywords:
@@ -123,14 +83,6 @@ detectors:
       - 1c-basic-auth
     regex:
       pattern: '(?i)(1c[_-]?api[_-]?token|1c[_-]?http[_-]?auth|1c[_-]?basic[_-]?auth)\s*[:=]\s*[''"]?[A-Za-z0-9_\-+/=]{20,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Bitrix24 REST Token
     keywords:
@@ -139,14 +91,6 @@ detectors:
       - bx24-token
     regex:
       pattern: '(?i)(bitrix24[_-]?token|bitrix[_-]?rest[_-]?token|bx24[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9]{32,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   # ============================================================================
   # CREDENTIALS IN URL (BASIC AUTH)
@@ -187,14 +131,6 @@ detectors:
       - client_secret
     regex:
       pattern: '(?i)(client_secret)\s*[:=]\s*[''"]?[0-9A-Za-z\-._~]{16,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   # OAuth Client ID — removed: public identifier, not a secret (PCI-DSS/SOC2 noise reduction).
 
@@ -205,14 +141,6 @@ detectors:
       - KEYCLOAK_CLIENT_SECRET
     regex:
       pattern: '(?i)(oidc|oauth2|keycloak).*client[_-]?secret.*[:=]\s*[''"]?[0-9A-Za-z\-._~]{16,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: ITS-002 Keycloak Client Secret Policy Violation
     keywords:
@@ -221,14 +149,6 @@ detectors:
       - keycloak_client_secret
     regex:
       pattern: '(?i)(keycloak[_\.-]?client[_-]?secret|KEYCLOAK_CLIENT_SECRET)\s*[:=]\s*[''"]?[0-9A-Za-z\-._~]{12,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Spring OAuth2 Client Secret
     keywords:
@@ -236,14 +156,6 @@ detectors:
       - client-secret
     regex:
       pattern: '(?i)spring\.security\.oauth2\.client\.registration\.[^.\s]+\.client-secret\s*=\s*[''"]?[0-9A-Za-z\-._~]{16,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   # ============================================================================
   # GITLAB / GITHUB TOKENS (Custom - keep for consistency)
@@ -285,14 +197,6 @@ detectors:
       - openvpn-key
     regex:
       pattern: '(?i)(vpn[_-]?user|vpn[_-]?login|vpn[_-]?password|vpn[_-]?cert|openvpn[_-]?key)\s*[:=]\s*[''"]?[A-Za-z0-9_\-+/=]{16,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Proxy Credentials
     keywords:
@@ -302,14 +206,6 @@ detectors:
       - proxy-auth
     regex:
       pattern: '(?i)(proxy[_-]?user|proxy[_-]?login|proxy[_-]?password|proxy[_-]?auth)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{8,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: GitLab Runner Token
     keywords:
@@ -318,14 +214,6 @@ detectors:
       - runner-registration-token
     regex:
       pattern: '(?i)(gitlab[_-]?runner[_-]?token|ci[_-]?cd[_-]?token|runner[_-]?registration[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{20,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Self-Hosted CI/CD Token
     keywords:
@@ -335,14 +223,6 @@ detectors:
       - self-hosted-ci-token
     regex:
       pattern: '(?i)(jenkins[_-]?token|teamcity[_-]?token|bamboo[_-]?token|self[_-]?hosted[_-]?ci[_-]?token)\s*[:=]\s*[''"]?[A-Za-z0-9_\-]{20,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   # ============================================================================
   # INFRASTRUCTURE (Vault, Atlassian, Grafana, Nexus/NPM, Elastic, 1C, Kafka)
@@ -363,14 +243,6 @@ detectors:
       - vault-token
     regex:
       pattern: '(?i)(vault[_-]?token|VAULT_TOKEN)\s*[:=]\s*[''"]?(hvs\.CAES[A-Za-z0-9_\-]+|hvc\.CAES[A-Za-z0-9_\-]+|s\.[A-Za-z0-9_\-]{8,})[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Atlassian API Token
     keywords:
@@ -397,14 +269,6 @@ detectors:
       - registry.npmjs.org_auth
     regex:
       pattern: '(?i)(_authToken|_auth|registry\.npmjs\.org[_-]?auth)\s*=\s*[A-Za-z0-9_\-=]{20,}'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Elasticsearch OpenSearch Auth
     keywords:
@@ -414,14 +278,6 @@ detectors:
       - elasticsearch.password
     regex:
       pattern: '(?i)(xpack\.security\.(user|password)|cloud\.auth|api_key|elasticsearch\.password)\s*[:=]\s*[''"]?[A-Za-z0-9_\-=]{16,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: 1C Base Connection String
     keywords:
@@ -438,14 +294,6 @@ detectors:
       - sasl.password
     regex:
       pattern: '(?i)(sasl\.(jaas\.config|username|password)|org\.apache\.kafka\.common\.security\.plain\.(username|password))\s*[:=]\s*[''"]?[^''"\s]{8,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Generic Header API Key
     keywords:
@@ -454,14 +302,6 @@ detectors:
       - x-api-token
     regex:
       pattern: '(?i)(x-api-key|x-auth-token|x-api-token)\s*[:=]\s*[''"]?[0-9A-Za-z\-._~]{24,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   # ============================================================================
   # GENERIC TOKENS / API KEYS
@@ -487,14 +327,6 @@ detectors:
       - apikey
     regex:
       pattern: '(?i)(password|passwd|pwd|secret|key|token|salt|api_key|apikey)\s*[:=]\s*[''"][^''"]{8,}[''"]'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Generic API Key
     keywords:
@@ -503,14 +335,6 @@ detectors:
       - apikey
     regex:
       pattern: '(?i)(api[_-]?key|apikey)\s*[:=]\s*[''"]?[0-9A-Za-z_\-]{32,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Generic Secret Token
     keywords:
@@ -519,14 +343,6 @@ detectors:
       - password
     regex:
       pattern: '(?i)(secret|token|password|passwd)\s*[:=]\s*[''"]?[0-9A-Za-z_\-]{40,}[''"]?'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   # ============================================================================
   # PII (PERSONAL IDENTIFIABLE INFORMATION) - GDPR/COMPLIANCE
@@ -538,18 +354,6 @@ detectors:
       - e-mail
     regex:
       pattern: '(?i)(?:email|e-mail)\s*[:=]\s*[\x27"]?(?!.*@(example\.(com|org|net)|test\.|mock\.|localhost|invalid|\.test|\.example|noreply\.|no-reply\.|fixture\.|sample\.|dummy\.|placeholder\.))[a-z0-9._%+-]+@[a-z0-9][a-z0-9.-]*\.[a-z]{2,}[\x27"]?'
-    exclude_regexes_match:
-      - '@example\.(com|org|net)'
-      - '@test\.'
-      - '@mock\.'
-      - '@localhost'
-      - 'noreply@'
-      - 'no-reply@'
-      - 'fixture@'
-      - 'sample@'
-      - 'test@'
-      - 'user@example'
-      - '\$\{[^}]+\}'
 
   - name: PII Phone RU
     keywords:
@@ -622,14 +426,6 @@ detectors:
       - secret_salt
     regex:
       pattern: '(?i)(aes[_-]?key|encryption[_-]?key|secret[_-]?salt)\s*[:=]\s*[''"][A-Za-z0-9+/=]{32,}[''"]'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: AWS S3 / MinIO Access Key ID
     keywords:
@@ -657,14 +453,6 @@ detectors:
       - redis_pass
     regex:
       pattern: '(?i)(redis[_-]?(password|pass|pwd))\s*[:=]\s*[\x27"][^\x27"\s]{8,}[\x27"]'
-    exclude_regexes_match:
-      - '\$\{[^}]+\}'
-      - '\$[A-Z_][A-Z0-9_]*'
-      - '%\([^)]+\)s'
-      - 'process\.env\.'
-      - 'os\.getenv\('
-      - 'getenv\('
-      - 'environ\['
 
   - name: Payment Gateway Secret Key (Yookassa/Stripe)
     keywords:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runsec/mcp",
-  "version": "1.0.71",
+  "version": "1.0.73",
   "main": "dist/index.js",
   "files": [
     "dist",