agent-security-scanner-mcp 3.0.0 → 3.2.0

package/rules/generic/secrets/gitleaks/twitter-bearer-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: twitter-bearer-token
+  message: A gitleaks twitter-bearer-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:twitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(A{22}[a-zA-Z0-9%]{80,100})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/typeform-api-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: typeform-api-token
+  message: A gitleaks typeform-api-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:typeform)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(tfp_[a-z0-9\-_\.=]{59})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/vault-batch-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: vault-batch-token
+  message: A gitleaks vault-batch-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)\b(hvb\.[a-z0-9_-]{138,212})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/vault-service-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: vault-service-token
+  message: A gitleaks vault-service-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)\b(hvs\.[a-z0-9_-]{90,100})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/yandex-access-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: yandex-access-token
+  message: A gitleaks yandex-access-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:yandex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(t1\.[A-Z0-9a-z_-]+[=]{0,2}\.[A-Z0-9a-z_-]{86}[=]{0,2})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/yandex-api-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: yandex-api-key
+  message: A gitleaks yandex-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:yandex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(AQVN[A-Za-z0-9_\-]{35,38})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/yandex-aws-access-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: yandex-aws-access-token
+  message: A gitleaks yandex-aws-access-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:yandex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(YC[a-zA-Z0-9_\-]{38})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/zendesk-secret-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: zendesk-secret-key
+  message: A gitleaks zendesk-secret-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:zendesk)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/security/detected-amazon-mws-auth-token.yaml

@@ -0,0 +1,26 @@
+rules:
+- id: detected-amazon-mws-auth-token
+  pattern-regex: amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
+  languages: [regex]
+  message: Amazon MWS Auth Token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH

package/rules/generic/secrets/security/detected-artifactory-password.yaml

@@ -0,0 +1,47 @@
+rules:
+  - id: detected-artifactory-password
+    patterns:
+      - pattern-regex: (?<ITEM>\bAP[\dABCDEF][a-zA-Z0-9]{8,})
+      - pattern-regex: .*(?i)arti[-_]?factory.*
+      - pattern-not-regex: .*(?i)sha(1|2|3|118|256|512).*
+      - pattern-not-regex: (?i)-----\s*?BEGIN[ A-Z0-9_-]*? KEY( BLOCK)?-----[\s\S]*?-----\s*?END[ A-Z0-9_-]*?\s*?-----
+      - metavariable-analysis:
+          analyzer: entropy
+          metavariable: $ITEM
+      - pattern-not-regex: (\w|\.|\*)\1{4}
+    languages:
+      - regex
+    paths:
+      exclude:
+        - "*.svg"
+        - "*go.sum"
+        - "*package.json"
+        - "*cargo.lock"
+        - "*package-lock.json"
+        - "*bundle.js"
+        - "*pnpm-lock*"
+        - "*Podfile.lock"
+        - "**/*/openssl/*.h"
+        - "*.xcscmblueprint"
+    message: Artifactory token detected
+    severity: ERROR
+    metadata:
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py
+      category: security
+      technology:
+        - secrets
+        - artifactory
+      confidence: LOW
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+      cwe2022-top25: true
+      cwe2021-top25: true
+      subcategory:
+        - audit
+      likelihood: LOW
+      impact: HIGH

package/rules/generic/secrets/security/detected-artifactory-token.yaml

@@ -0,0 +1,44 @@
+rules:
+- id: detected-artifactory-token
+  patterns:
+  - pattern-regex: |
+      \bAKC[a-zA-Z0-9]{10,}
+  - pattern-not-regex: |
+      sha(128|256|512).*
+  - pattern-not-regex: (?s)---BEGIN.*---\Z
+  languages: [regex]
+  paths:
+    exclude:
+      - "*.svg"
+      - "*go.sum"
+      - "*package.json"
+      - "*package-lock.json"
+      - "*bundle.js"
+      - "*pnpm-lock*"
+      - "*Podfile.lock"
+      - "**/*/openssl/*.h"
+      - "*.xcscmblueprint"
+      - "*cargo.lock"
+  message: Artifactory token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/artifactory.py
+    category: security
+    technology:
+    - secrets
+    - artifactory
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+

package/rules/generic/secrets/security/detected-aws-access-key-id-value.yaml

@@ -0,0 +1,29 @@
+rules:
+- id: detected-aws-access-key-id-value
+  patterns:
+  - pattern-regex: \b(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b
+  - pattern-not-regex: (?i)example|sample|test|fake
+  languages: [regex]
+  message: AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded
+    here. Instead, read this value from an environment variable or keep it in a separate, private file.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH

package/rules/generic/secrets/security/detected-aws-account-id.yaml

@@ -0,0 +1,58 @@
+rules:
+  - id: detected-aws-account-id
+    patterns:
+      - pattern-either:
+          - pattern: |
+              $ACCOUNT_ID = $SECRET
+          - pattern: |
+              $ACCOUNT_ID : $SECRET
+          - pattern: |
+              $ACCOUNT_ID => $SECRET
+          - pattern: |
+              $ACCOUNT_ID = "$SECRET"
+          - pattern: |
+              $ACCOUNT_ID : "$SECRET"
+          - pattern: |
+              $ACCOUNT_ID => "$SECRET"
+          - pattern: |
+              "$ACCOUNT_ID" = "$SECRET"
+          - pattern: |
+              "$ACCOUNT_ID" : "$SECRET"
+          - pattern: |
+              "$ACCOUNT_ID" => "$SECRET"
+      - metavariable-analysis:
+          metavariable: $SECRET
+          analyzer: entropy
+      - metavariable-regex:
+          metavariable: $SECRET
+          regex: ^((?!(12345|0000).*)[0-9]{12})$
+      - metavariable-regex:
+          metavariable: $ACCOUNT_ID
+          regex: (AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?
+    languages:
+      - generic
+    message: AWS Account ID detected. While not considered sensitive information, it is important
+      to use them and share them carefully. For that reason it would be preferrable avoiding to
+      hardcoded it here. Instead, read the value from an environment variable or
+      keep the value in a separate, private file.
+    severity: INFO
+    metadata:
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+      category: security
+      technology:
+        - secrets
+        - aws
+      confidence: LOW
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+      cwe2022-top25: true
+      cwe2021-top25: true
+      subcategory:
+        - audit
+      likelihood: LOW
+      impact: LOW

package/rules/generic/secrets/security/detected-aws-appsync-graphql-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-aws-appsync-graphql-key
+  pattern-regex: da2-[a-z0-9]{26}
+  languages: [regex]
+  message: AWS AppSync GraphQL Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - appsync
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+

package/rules/generic/secrets/security/detected-aws-secret-access-key.yaml

@@ -0,0 +1,30 @@
+rules:
+- id: detected-aws-secret-access-key
+  patterns:
+  - pattern-regex: |-
+      (("|'|`)?((?i)aws)_?\w*((?i)secret)_?\w*("|'|`)?\s{0,50}(:|=>|=)\s{0,50}("|'|`)?[A-Za-z0-9/+=]{40}("|'|`)?)
+  - pattern-not-regex: (?i)example|sample|test|fake|xxxxxx
+  languages: [regex]
+  message: AWS Secret Access Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH
+

package/rules/generic/secrets/security/detected-aws-session-token.yaml

@@ -0,0 +1,31 @@
+rules:
+- id: detected-aws-session-token
+  patterns:
+    - pattern-regex: ((?i)AWS_SESSION_TOKEN)\s*(:|=>|=)\s*(?P<TOKEN>[A-Za-z0-9/+=]{16,})
+    - pattern-not-regex: (?i)example|sample|test|fake
+    - metavariable-analysis:
+        analyzer: entropy
+        metavariable: $TOKEN
+  languages: [regex]
+  message: AWS Session Token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH

package/rules/generic/secrets/security/detected-bcrypt-hash.yaml

@@ -0,0 +1,25 @@
+rules:
+- id: detected-bcrypt-hash
+  pattern-regex: \$2[aby]?\$[\d]+\$[./A-Za-z0-9]{53}
+  languages: [regex]
+  message: bcrypt hash detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    category: security
+    technology:
+    - secrets
+    - bcrypt
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH

package/rules/generic/secrets/security/detected-codeclimate.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-codeclimate
+  pattern-regex: |-
+    (?i)codeclima.{0,50}["|'|`]?[0-9a-f]{64}["|'|`]?
+  languages: [regex]
+  message: CodeClimate detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - codeclimate
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: HIGH

package/rules/generic/secrets/security/detected-etc-shadow.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-etc-shadow
+  patterns:
+  - pattern-regex: ^(\s*)(?P<ROOT>root:[x!*]*:[0-9]*:[0-9]*)
+  - focus-metavariable: $ROOT
+  languages: [regex]
+  message: linux shadow file detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    category: security
+    technology:
+    - secrets
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM
+

package/rules/generic/secrets/security/detected-facebook-access-token.yaml

@@ -0,0 +1,29 @@
+rules:
+- id: detected-facebook-access-token
+  pattern-either:
+  - pattern-regex: EAACEdEose0cBA[0-9A-Za-z]+
+  - pattern-regex: EAAAACZAVC6ygB[0-9A-Za-z]+
+  - pattern-regex: EAAAAZAw4[0-9A-Za-z]+
+  languages: [regex]
+  message: Facebook Access Token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - facebook
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-facebook-oauth.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-facebook-oauth
+  pattern-regex: |-
+    [fF][aA][cC][eE][bB][oO][oO][kK].*[tT][oO][kK][eE][nN].*['|"]?[0-9a-f]{32}['|"]?
+  languages: [regex]
+  message: Facebook OAuth detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - facebook
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM