@skaleagents/swarm 0.6.12 → 0.6.14

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm" | "gitlab" | "azure-pipelines" | "cloudbuild" | "tfvars";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm" | "gitlab" | "azure-pipelines" | "cloudbuild" | "tfvars" | "serverless" | "iam";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -33,3 +33,5 @@ export declare function looksLikeBicep(content: string): boolean;
 export declare function looksLikeArm(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;
+export declare function looksLikeServerless(content: string): boolean;
+export declare function looksLikeIamPolicy(content: string): boolean;

package/dist/iac/parse.js

@@ -30,6 +30,8 @@ export function looksLikeIac(content) {
             const value = object(JSON.parse(content));
             if (value.resource || value.Resources || (value.apiVersion && value.kind))
                 return true;
+            if (looksLikeIamPolicy(content))
+                return true;
         }
         catch {
             /* Other format detection still applies to incomplete input. */
@@ -48,7 +50,9 @@ export function looksLikeIac(content) {
         looksLikeBicep(content) ||
         looksLikeArm(content) ||
         looksLikePipeline(content) !== undefined ||
-        looksLikeTfvars(content));
+        looksLikeTfvars(content) ||
+        looksLikeServerless(content) ||
+        looksLikeIamPolicy(content));
 }
 export function looksLikePulumiProgram(content) {
     return /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content);
@@ -135,6 +139,7 @@ export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
+const terraformExpressionWarning = "Same-file variable and local literals are resolved. Functions and other expressions are not evaluated.";
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
@@ -156,6 +161,14 @@ export function parseIac(content, requested = "auto") {
         (requested === "auto" && looksLikeHelm(content))) {
         return parseHelm(content);
     }
+    if (requested === "serverless" ||
+        (requested === "auto" && looksLikeServerless(content))) {
+        return parseServerless(content);
+    }
+    if (requested === "iam" ||
+        (requested === "auto" && looksLikeIamPolicy(content))) {
+        return parseIamPolicy(content);
+    }
     const pipeline = requested === "gitlab" ||
         requested === "azure-pipelines" ||
         requested === "cloudbuild"
@@ -257,8 +270,29 @@ export function parseIac(content, requested = "auto") {
         }
         if (object(data).module)
             warnings.push("External modules are not expanded. The module body was not loaded, and the module source is not fetched or evaluated.");
+        const localBlocks = terraformLocalBlocks(data);
+        const localDeclarations = [
+            ...searchable.matchAll(/\blocals\s*(?:"[^"]+"\s*)?\{/g),
+        ];
+        localBlocks.forEach((block, index) => {
+            const offset = localDeclarations[index]?.index ?? 0;
+            const before = content.slice(0, offset);
+            resources.push({
+                id: `locals.${index + 1}`,
+                type: "terraform:local",
+                value: block,
+                locate: (path = []) => ({
+                    line: before.split("\n").length,
+                    column: offset - before.lastIndexOf("\n"),
+                    path: ["locals", index, ...path].join("."),
+                }),
+            });
+        });
         if (JSON.stringify(data).includes("${"))
-            warnings.push("Terraform expressions are not evaluated. Findings use literal values and declared settings.");
+            warnings.push(terraformExpressionWarning);
+        if (localBlocks.length > 0 &&
+            !warnings.some((warning) => warning.includes("expressions are not evaluated")))
+            warnings.push(terraformExpressionWarning);
         if (!resources.some((item) => item.type !== "terraform:module" && item.type !== "terraform:variable"))
             warnings.push("No resource declarations found. Data sources and outputs are not scanned as resources.");
         return { format: "terraform", resources, warnings };
@@ -378,11 +412,12 @@ export function parseIac(content, requested = "auto") {
                 Array.isArray(root.Resources) ||
                 typeof root.Resources !== "object")
                 throw new ScanInputError("CloudFormation requires a Resources mapping.");
+            const parameters = cloudFormationParameterLiterals(root);
             for (const [name, raw] of Object.entries(object(root.Resources))) {
                 const value = object(raw);
                 if (typeof value.Type !== "string")
                     throw new ScanInputError("Each CloudFormation resource requires a Type.");
-                add(name, value.Type, value, ["Resources", name]);
+                add(name, value.Type, resolveCloudFormationRefs(value, parameters), ["Resources", name]);
             }
         }
         else if (format === "terraform") {
@@ -430,10 +465,13 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, or an ARM template.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, an ARM template, Serverless Framework, or a standalone IAM policy.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
-    if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
+    if (format === "cloudformation" &&
+        /(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\bRef\s*:)/.test(content))
+        warnings.push("Same-file parameter defaults are resolved. Functions are not evaluated.");
+    else if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
@@ -693,7 +731,7 @@ function cloudBuildShape(content) {
     return /^\s*-\s*name\s*:/m.test(content);
 }
 function looksLikePipeline(content) {
-    if (stolenPipelineInput(content))
+    if (stolenPipelineInput(content) || looksLikeServerless(content))
         return undefined;
     const visible = maskIaCComments(content);
     if (azurePipelineShape(visible))
@@ -1369,3 +1407,338 @@ function parseAzure(content, format) {
         warnings: [azureExpressionWarning],
     };
 }
+function parameterNameIsSecret(name) {
+    const normalized = name.replace(/-/g, "_");
+    return (/(?:^|_)(?:password|passwd|secret|token)$/i.test(normalized) ||
+        /(?:^|_)(?:api_?key|auth_token|access_key|private_key)$/i.test(normalized) ||
+        /(?:password|passwd|secret|api[_-]?key|auth[_-]?token|access[_-]?key|private[_-]?key|token)$/i.test(name));
+}
+function cloudFormationParameterLiterals(root) {
+    const defaults = new Map();
+    const secretNames = new Set();
+    for (const [name, raw] of Object.entries(object(root.Parameters))) {
+        const body = object(raw);
+        if (!("Default" in body))
+            continue;
+        const value = body.Default;
+        if (typeof value !== "string" && typeof value !== "boolean" && typeof value !== "number")
+            continue;
+        defaults.set(name, value);
+        if (typeof value === "string" && value.trim() !== "" && parameterNameIsSecret(name))
+            secretNames.add(name);
+    }
+    return { defaults, secretNames };
+}
+function cloudFormationRefName(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([key]) => key !== "__referencedSecrets");
+    if (entries.length !== 1)
+        return undefined;
+    const [key, name] = entries[0];
+    if (key !== "Ref" || typeof name !== "string" || name.trim() === "")
+        return undefined;
+    return name;
+}
+function cloudFormationIntrinsic(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.keys(value).some((key) => key === "Fn::Sub" || key === "Fn::Join" || key === "Fn::FindInMap" || key.startsWith("Fn::"));
+}
+function resolveCloudFormationRefs(value, parameters) {
+    const secretPaths = [];
+    const resolved = resolveCloudFormationValue(value, parameters, [], secretPaths);
+    if (secretPaths.length > 0 &&
+        resolved &&
+        typeof resolved === "object" &&
+        !Array.isArray(resolved)) {
+        Object.defineProperty(resolved, "__referencedSecrets", {
+            enumerable: false,
+            configurable: true,
+            value: secretPaths,
+        });
+    }
+    return object(resolved);
+}
+function resolveCloudFormationValue(value, parameters, path, secretPaths) {
+    const ref = cloudFormationRefName(value);
+    if (ref) {
+        if (!parameters.defaults.has(ref))
+            return value;
+        const literal = parameters.defaults.get(ref);
+        if (parameters.secretNames.has(ref) &&
+            typeof literal === "string" &&
+            literal.trim() !== "")
+            secretPaths.push(path);
+        return literal;
+    }
+    if (cloudFormationIntrinsic(value))
+        return value;
+    if (Array.isArray(value))
+        return value.map((item, index) => resolveCloudFormationValue(item, parameters, [...path, index], secretPaths));
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, child] of Object.entries(value)) {
+            if (key === "__referencedSecrets")
+                continue;
+            out[key] = resolveCloudFormationValue(child, parameters, [...path, key], secretPaths);
+        }
+        return out;
+    }
+    return value;
+}
+function terraformLocalBlocks(data) {
+    const raw = object(data).locals;
+    if (Array.isArray(raw))
+        return raw.map((block) => object(block));
+    if (raw && typeof raw === "object") {
+        return Object.values(object(raw)).flatMap((blocks) => array(blocks).map((block) => object(block)));
+    }
+    return [];
+}
+export function looksLikeServerless(content) {
+    if (looksLikeGithubWorkflow(content) || looksLikeCompose(content))
+        return false;
+    if (topLevelKey(content, "apiVersion") && topLevelKey(content, "kind"))
+        return false;
+    if (!topLevelKey(content, "service") || !topLevelKey(content, "provider"))
+        return false;
+    return topLevelKey(content, "functions") || topLevelKey(content, "plugins");
+}
+export function looksLikeIamPolicy(content) {
+    const trimmed = content.trim();
+    if (!trimmed.startsWith("{"))
+        return false;
+    let value;
+    try {
+        value = JSON.parse(trimmed);
+    }
+    catch {
+        return false;
+    }
+    const root = object(value);
+    if (typeof root.AWSTemplateFormatVersion === "string")
+        return false;
+    if ("resource" in root)
+        return false;
+    const version = root.Version ?? root.version;
+    if (typeof version !== "string" || !version.includes("2012-10-17"))
+        return false;
+    const statement = root.Statement ?? root.statement;
+    return Array.isArray(statement);
+}
+const serverlessWarning = "The Serverless Framework config is not executed. Other condition operators are not evaluated.";
+const iamPolicyWarning = "The IAM policy is not executed. Other condition operators are not evaluated.";
+function serverlessShapeError() {
+    return "Serverless Framework config requires top-level service and provider, plus functions or plugins.";
+}
+function iamShapeError() {
+    return "An IAM policy requires Version 2012-10-17 and a Statement array.";
+}
+function effectAllows(body) {
+    const effect = body.Effect ?? body.effect;
+    if (effect == null || String(effect).trim() === "")
+        return true;
+    return String(effect).trim().toLowerCase() === "allow";
+}
+const openSourceAddresses = new Set(["0.0.0.0/0", "::/0", "*"]);
+function conditionValueIsOpen(value) {
+    if (typeof value === "string")
+        return openSourceAddresses.has(value.trim());
+    if (Array.isArray(value))
+        return value.some((item) => conditionValueIsOpen(item));
+    return false;
+}
+function sourceAddressAllowsEveryone(body) {
+    if (!effectAllows(body))
+        return false;
+    const condition = object(body.Condition ?? body.condition);
+    let ipAddress;
+    for (const [key, value] of Object.entries(condition)) {
+        if (key.toLowerCase() === "ipaddress") {
+            ipAddress = value;
+            break;
+        }
+    }
+    if (!ipAddress || typeof ipAddress !== "object" || Array.isArray(ipAddress))
+        return false;
+    return Object.values(object(ipAddress)).some((value) => conditionValueIsOpen(value));
+}
+function actionIsOnlyWildcard(body) {
+    const action = body.Action ?? body.action ?? body.actions ?? body.Actions;
+    if (typeof action === "string")
+        return action.trim() === "*";
+    return (Array.isArray(action) &&
+        action.length > 0 &&
+        action.every((item) => typeof item === "string" && item.trim() === "*"));
+}
+function serverlessReference(value) {
+    return /^\$\{[\s\S]+\}$/.test(value.trim());
+}
+function yamlLocation(doc, lines, path) {
+    const node = doc.getIn(path, true);
+    const position = lines.linePos(node?.range?.[0] ?? doc.range?.[0] ?? 0);
+    return {
+        line: position.line,
+        column: position.col,
+        path: path.join("."),
+    };
+}
+function statementGroups(root) {
+    const groups = [];
+    const seen = new Set();
+    const add = (statements, path) => {
+        if (!Array.isArray(statements) || seen.has(statements))
+            return;
+        seen.add(statements);
+        groups.push({ path, statements });
+    };
+    const provider = object(root.provider);
+    add(provider.iamRoleStatements, ["provider", "iamRoleStatements"]);
+    add(root.iamRoleStatements, ["iamRoleStatements"]);
+    add(object(object(provider.iam).role).statements, ["provider", "iam", "role", "statements"]);
+    add(object(object(root.iam).role).statements, ["iam", "role", "statements"]);
+    if (Array.isArray(provider.iam))
+        add(provider.iam, ["provider", "iam"]);
+    else
+        add(object(provider.iam).statements, ["provider", "iam", "statements"]);
+    return groups;
+}
+function parseServerless(content) {
+    if (!looksLikeServerless(content))
+        throw new ScanInputError(serverlessShapeError());
+    const lines = new LineCounter();
+    let documents;
+    try {
+        documents = parseAllDocuments(content, {
+            lineCounter: lines,
+            prettyErrors: false,
+        });
+    }
+    catch {
+        throw new ScanInputError(serverlessShapeError());
+    }
+    const doc = documents.find((item) => item.toJS() != null);
+    if (!doc || doc.errors.length)
+        throw new ScanInputError(serverlessShapeError());
+    let data;
+    try {
+        data = doc.toJS({ maxAliasCount: 0 });
+    }
+    catch {
+        throw new ScanInputError("YAML aliases are not supported. Expand anchors before scanning.");
+    }
+    const root = object(data);
+    if (root.service == null ||
+        root.provider == null ||
+        (root.functions == null && root.plugins == null))
+        throw new ScanInputError(serverlessShapeError());
+    const resources = [];
+    let iamCount = 0;
+    for (const group of statementGroups(root)) {
+        group.statements.forEach((statement, index) => {
+            const body = object(statement);
+            const wildcard = effectAllows(body) && actionIsOnlyWildcard(body);
+            const openSourceIp = sourceAddressAllowsEveryone(body);
+            if (!wildcard && !openSourceIp)
+                return;
+            iamCount += 1;
+            const path = [...group.path, index, openSourceIp && !wildcard ? "Condition" : "Action"];
+            resources.push({
+                id: `serverless.iam.${iamCount}`,
+                type: "serverless:iam",
+                value: { wildcard, openSourceIp },
+                locate: () => yamlLocation(doc, lines, path),
+            });
+        });
+    }
+    if (iamCount === 0) {
+        resources.push({
+            id: "serverless.iam",
+            type: "serverless:iam",
+            value: { wildcard: false },
+            locate: () => yamlLocation(doc, lines, ["provider", "iamRoleStatements"]),
+        });
+    }
+    const envHits = [];
+    for (const [key, value] of Object.entries(object(object(root.provider).environment))) {
+        if (secretVariableName(key))
+            envHits.push({ path: ["provider", "environment", key], key, value });
+    }
+    for (const [name, raw] of Object.entries(object(root.functions))) {
+        for (const [key, value] of Object.entries(object(object(raw).environment))) {
+            if (secretVariableName(key))
+                envHits.push({ path: ["functions", name, "environment", key], key, value });
+        }
+    }
+    if (envHits.length === 0) {
+        resources.push({
+            id: "serverless.environment",
+            type: "serverless:env",
+            value: { literal: false },
+            locate: () => yamlLocation(doc, lines, ["provider", "environment"]),
+        });
+    }
+    else {
+        envHits.forEach((hit, index) => {
+            const literal = typeof hit.value === "string" &&
+                hit.value.trim() !== "" &&
+                !serverlessReference(hit.value);
+            resources.push({
+                id: `serverless.env.${index + 1}`,
+                type: "serverless:env",
+                value: { literal },
+                locate: () => yamlLocation(doc, lines, hit.path),
+            });
+        });
+    }
+    return { format: "serverless", resources, warnings: [serverlessWarning] };
+}
+function parseIamPolicy(content) {
+    if (!looksLikeIamPolicy(content))
+        throw new ScanInputError(iamShapeError());
+    let root;
+    try {
+        root = object(JSON.parse(content));
+    }
+    catch {
+        throw new ScanInputError(iamShapeError());
+    }
+    const statements = array(root.Statement ?? root.statement);
+    const resources = [];
+    statements.forEach((statement, index) => {
+        const body = object(statement);
+        const wildcard = effectAllows(body) && actionIsOnlyWildcard(body);
+        const openSourceIp = sourceAddressAllowsEveryone(body);
+        if (!wildcard && !openSourceIp)
+            return;
+        const line = iamStatementLine(content, index, openSourceIp && !wildcard ? "Condition" : "Action");
+        resources.push({
+            id: `iam.statement.${index + 1}`,
+            type: "iam:statement",
+            value: { wildcard, openSourceIp },
+            locate: () => lineLocation(line, openSourceIp && !wildcard
+                ? `Statement.${index}.Condition`
+                : `Statement.${index}.Action`),
+        });
+    });
+    if (!resources.length) {
+        resources.push({
+            id: "iam.policy",
+            type: "iam:statement",
+            value: { wildcard: false },
+            locate: () => lineLocation(1, "Statement"),
+        });
+    }
+    return { format: "iam", resources, warnings: [iamPolicyWarning] };
+}
+function iamStatementLine(content, index, key = "Action") {
+    const matches = [...content.matchAll(/"Statement"\s*:/g)];
+    const start = matches[0]?.index ?? 0;
+    const region = content.slice(start);
+    const keys = [...region.matchAll(new RegExp(`"${key}"\\s*:`, "g"))];
+    const hit = key === "Action" ? keys[index] : keys.find((item) => item.index != null);
+    if (!hit || hit.index == null)
+        return lineAt(content, start);
+    return lineAt(content, start + hit.index);
+}

package/dist/iac/rules.js

@@ -351,10 +351,40 @@ export const rules = {
         detail: "A Terraform variable default or tfvars assignment gives a non-empty literal to a secret-like name.",
         remediation: "Pass the value from a secret store or leave the default empty. Do not commit a literal secret.",
     },
+    TF002: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in a Terraform local",
+        detail: "A Terraform local assigns a non-empty literal to a secret-like name.",
+        remediation: "Pass the value from a secret store or a variable reference. Do not commit a literal secret in locals.",
+    },
+    SLS001: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in serverless environment",
+        detail: "A Serverless Framework environment entry assigns a non-empty literal to a secret-like name.",
+        remediation: "Reference the value with a Serverless variable such as ${env:TOKEN}. Do not commit a literal secret.",
+    },
 };
 export function resourceFindings(resources, format) {
     const findings = [];
     const checked = new Set();
+    const sameFile = collectSameFileLiterals(resources);
+    const suppressedSecrets = new WeakMap();
+    const moduleSecrets = new WeakMap();
+    if (format === "terraform") {
+        for (const resource of resources) {
+            if (resource.type === "terraform:variable" ||
+                resource.type === "terraform:local" ||
+                resource.type === "tfvars:assignment")
+                continue;
+            const suppressed = new Set();
+            const referenced = new Set();
+            resolveSameFileRefs(resource.value, sameFile, [], suppressed, referenced);
+            suppressedSecrets.set(resource, suppressed);
+            moduleSecrets.set(resource, referenced);
+        }
+    }
     for (const resource of resources) {
         const check = (id, condition, path = []) => {
             checked.add(id);
@@ -392,8 +422,21 @@ export function resourceFindings(resources, format) {
             checkPipeline(resource, check);
             continue;
         }
+        if (format === "serverless") {
+            checkServerless(resource, check);
+            continue;
+        }
+        if (format === "iam") {
+            check("IAM001", resource.value.wildcard === true, ["Action"]);
+            check("NET001", resource.value.openSourceIp === true, ["Condition"]);
+            continue;
+        }
+        if (resource.type === "terraform:local") {
+            checkTerraformLiterals(resource.value, "local", check, []);
+            continue;
+        }
         if (resource.type === "terraform:module") {
-            checkTerraformLiterals(resource.value, "module", check, []);
+            checkTerraformLiterals(resource.value, "module", check, [], "", moduleSecrets.get(resource));
             continue;
         }
         if (resource.type === "terraform:variable") {
@@ -410,7 +453,8 @@ export function resourceFindings(resources, format) {
             const credentialName = /(?:password|passwd|secret|api[_-]?key|auth[_-]?token)$/i;
             check("SEC001", (credentialName.test(key) ||
                 (key === "value" && credentialName.test(String(parent.name)))) &&
-                literalCredential(value), path);
+                literalCredential(value) &&
+                !suppressedSecrets.get(resource)?.has(path.join(".")), path);
             check("SEC002", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/.test(value), path);
             check("SEC003", /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/.test(value), path);
             check("NET002", [...value.matchAll(/\bhttp:\/\/[^\s"'<>]+/gi)].some((m) => externalHttp(m[0])), path);
@@ -421,8 +465,15 @@ export function resourceFindings(resources, format) {
             checkCompose(resource, check);
         else
             checkCloud(resource, resources, format, check);
+        const referencedSecrets = Object.getOwnPropertyDescriptor(resource.value, "__referencedSecrets")?.value;
+        if (Array.isArray(referencedSecrets)) {
+            for (const secretPath of referencedSecrets) {
+                if (Array.isArray(secretPath))
+                    check("SEC001", true, secretPath);
+            }
+        }
     }
-    return { findings, checked };
+    return { findings: dedupeSecretFindings(findings), checked };
 }
 function checkDockerfile(resource, check) {
     if (resource.type === "dockerfile:user")
@@ -473,6 +524,14 @@ function checkPipeline(resource, check) {
     else if (resource.type === "pipeline:privileged")
         check("PIPE003", resource.value.present === true, ["privileged"]);
 }
+function checkServerless(resource, check) {
+    if (resource.type === "serverless:iam") {
+        check("IAM001", resource.value.wildcard === true, ["Action"]);
+        check("NET001", resource.value.openSourceIp === true, ["Condition"]);
+    }
+    else if (resource.type === "serverless:env")
+        check("SLS001", resource.value.literal === true, ["environment"]);
+}
 function terraformReference(value) {
     const trimmed = value.trim();
     return trimmed.includes("${") || /^var\./.test(trimmed);
@@ -488,27 +547,110 @@ function moduleCidrExempt(name) {
         normalized === "destination" ||
         normalized === "ipv6_egress");
 }
-function checkTerraformLiterals(value, mode, check, path, name = "") {
+function checkTerraformLiterals(value, mode, check, path, name = "", referencedSecrets) {
     if (typeof value === "string" || typeof value === "boolean") {
         const open = value === "0.0.0.0/0" || value === "::/0";
-        const exempt = mode === "module" ? moduleCidrExempt(name) : name.toLowerCase() === "egress";
+        const exempt = mode === "assignment" ? name.toLowerCase() === "egress" : moduleCidrExempt(name);
         if (typeof value === "string")
             check("NET001", open && name !== "" && !exempt, path);
         if (name === "publicly_accessible")
             check("DB001", value === true, path);
         if (mode === "assignment" && typeof value === "string" && secretAssignmentName(name))
             check("TF001", value.trim() !== "" && !terraformReference(value), path);
+        if (mode === "local" && typeof value === "string" && secretAssignmentName(name))
+            check("TF002", value.trim() !== "" && !terraformReference(value), path);
+        if (mode === "module" && referencedSecrets?.has(path.join(".")))
+            check("SEC001", true, path);
         return;
     }
     if (Array.isArray(value)) {
-        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name));
+        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name, referencedSecrets));
         return;
     }
     if (value && typeof value === "object") {
         for (const [key, child] of Object.entries(value))
-            checkTerraformLiterals(child, mode, check, [...path, key], key);
+            checkTerraformLiterals(child, mode, check, [...path, key], key, referencedSecrets);
     }
 }
+const exactSameFileRef = /^\$\{(var|local)\.([A-Za-z_][A-Za-z0-9_]*)\}$/;
+function sameFileLiteral(value) {
+    if (typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string" && !value.includes("${"))
+        return value;
+    return undefined;
+}
+function collectSameFileLiterals(resources) {
+    const vars = new Map();
+    const locals = new Map();
+    const declaredSecrets = new Set();
+    for (const resource of resources) {
+        if (resource.type === "terraform:variable") {
+            const name = String(resource.value.name ?? "");
+            const literal = sameFileLiteral(resource.value.default);
+            if (!name || literal === undefined)
+                continue;
+            vars.set(name, literal);
+            if (typeof literal === "string" && literal.trim() !== "" && secretAssignmentName(name))
+                declaredSecrets.add(literal);
+        }
+        if (resource.type === "terraform:local") {
+            for (const [name, raw] of Object.entries(resource.value)) {
+                const literal = sameFileLiteral(raw);
+                if (literal === undefined)
+                    continue;
+                locals.set(name, literal);
+                if (typeof literal === "string" && literal.trim() !== "" && secretAssignmentName(name))
+                    declaredSecrets.add(literal);
+            }
+        }
+    }
+    return { vars, locals, declaredSecrets };
+}
+function resolveSameFileRefs(value, sameFile, path, suppressed, referencedSecrets) {
+    if (typeof value === "string") {
+        const match = exactSameFileRef.exec(value.trim());
+        if (!match)
+            return value;
+        const literal = (match[1] === "var" ? sameFile.vars : sameFile.locals).get(match[2]);
+        if (literal === undefined)
+            return value;
+        if (typeof literal === "string" && literal.trim() !== "") {
+            const key = [...path].reverse().find((part) => typeof part === "string");
+            if (sameFile.declaredSecrets.has(literal))
+                suppressed.add(path.join("."));
+            else if (typeof key === "string" && secretAssignmentName(String(key)))
+                referencedSecrets.add(path.join("."));
+        }
+        return literal;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => {
+            value[index] = resolveSameFileRefs(item, sameFile, [...path, index], suppressed, referencedSecrets);
+        });
+        return value;
+    }
+    if (value && typeof value === "object") {
+        for (const [key, child] of Object.entries(value)) {
+            if (key === "__referencedSecrets")
+                continue;
+            value[key] = resolveSameFileRefs(child, sameFile, [...path, key], suppressed, referencedSecrets);
+        }
+    }
+    return value;
+}
+function dedupeSecretFindings(findings) {
+    const seen = new Set();
+    return findings.filter((finding) => {
+        if (finding.ruleId !== "SEC001")
+            return true;
+        const key = `${finding.ruleId}|${finding.resource}|${finding.location?.path ?? ""}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
 function checkAzure(resource, check) {
     if (resource.type === "azure:exposure")
         check("AZ001", resource.value.present === true, ["sourceAddressPrefix"]);

package/dist/iac/scan.js

@@ -55,6 +55,11 @@ export function scanIac(content, options = {}) {
                     "HCL locations point to resource declarations; property paths identify the affected setting.",
                 ]
                 : []),
+            ...(parsed.format === "terraform" || parsed.format === "cloudformation"
+                ? [
+                    "Same-file var, local, and CloudFormation parameter defaults are resolved. Functions, Fn::Sub, and module sources are not.",
+                ]
+                : []),
         ],
     };
 }

package/dist/server.js

@@ -83,12 +83,14 @@ export function createServer(remote = false) {
                 "azure-pipelines",
                 "cloudbuild",
                 "tfvars",
+                "serverless",
+                "iam",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, gitlab, azure-pipelines, cloudbuild, tfvars, application, auto."),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, gitlab, azure-pipelines, cloudbuild, tfvars, serverless, iam, application, auto."),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -136,7 +138,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, and tfvars. Helm templates, Ansible facts, Bicep modules, ARM expressions, and pipelines are not executed. Terraform module sources are not fetched. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, and a standalone IAM policy. Helm templates, Ansible facts, Bicep modules, ARM expressions, pipelines, Serverless Framework config, and IAM policies are not executed. Conditions are not evaluated. Terraform module sources are not fetched. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -144,7 +146,7 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, and tfvars."),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, and a standalone IAM policy."),
                 format: z
                     .enum([
                     "terraform",
@@ -162,6 +164,8 @@ export function createServer(remote = false) {
                     "azure-pipelines",
                     "cloudbuild",
                     "tfvars",
+                    "serverless",
+                    "iam",
                     "auto",
                 ])
                     .default("auto"),

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.12";
+export declare const VERSION = "0.6.14";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.12";
+export const VERSION = "0.6.14";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "private": false,
   "publishConfig": {
     "access": "public"