agent-security-scanner-mcp 3.0.0 → 3.2.0

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "agent-security-scanner-mcp",
-  "version": "3.0.0",
+  "version": "3.2.0",
   "mcpName": "io.github.sinewaveai/agent-security-scanner-mcp",
-  "description": "Security scanner MCP server for AI coding agents. AST-based analysis, taint tracking, 1700+ Semgrep rules, package hallucination detection (4.3M+), SARIF output. For Claude Code, Cursor, Windsurf, Cline.",
+  "description": "Security scanner MCP server for AI coding agents. Prompt injection firewall, package hallucination detection (4.3M+ packages), 1000+ vulnerability rules with AST & taint analysis, auto-fix. For Claude Code, Cursor, Windsurf, Cline.",
   "main": "index.js",
   "type": "module",
   "bin": {
@@ -52,10 +52,7 @@
     "zed",
     "prompt-firewall",
     "auto-fix",
-    "hallucination",
-    "sarif",
-    "github-code-scanning",
-    "gitlab-sast"
+    "hallucination"
   ],
   "author": "Sinewave AI <divya@sinewave.ai>",
   "license": "MIT",
@@ -79,6 +76,10 @@
     "LICENSE",
     "server.json",
     "index.js",
+    "src/tools/*.js",
+    "src/cli/*.js",
+    "src/fix-patterns.js",
+    "src/utils.js",
     "analyzer.py",
     "ast_parser.py",
     "generic_ast.py",

package/regex_fallback.py

@@ -46,6 +46,10 @@ def apply_regex_fallback(source: str, language: str, file_path: str = "") -> Lis
         return _scan_kubernetes(lines)
     if language == "terraform":
         return _scan_terraform(lines)
+    if language == "rust":
+        return _scan_rust(lines)
+    if language == "csharp":
+        return _scan_csharp(lines)
     if language == "generic":
         return _scan_generic(lines)
 
@@ -442,6 +446,68 @@ def _scan_terraform(lines: List[str]) -> List[Dict]:
     return findings
 
 
+def _scan_rust(lines: List[str]) -> List[Dict]:
+    findings: List[Dict] = []
+    for i, line in enumerate(lines):
+        if re.search(r"\bunsafe\s*\{", line):
+            findings.append(_make_finding("unsafe-block", i, line))
+        if re.search(r"\.unwrap\s*\(", line):
+            findings.append(_make_finding("unwrap-usage", i, line))
+        if re.search(r"\bstd::process::Command\b", line):
+            findings.append(_make_finding("command-injection", i, line))
+        if re.search(r"\*const\s+\w|\*mut\s+\w", line):
+            findings.append(_make_finding("raw-pointer-deref", i, line))
+        if re.search(r"\bpassword\b\s*=\s*\"[^\"]+\"", line, re.IGNORECASE):
+            findings.append(_make_finding("hardcoded-password", i, line))
+        if re.search(r"\bapi_key\b\s*=\s*\"[^\"]+\"", line, re.IGNORECASE):
+            findings.append(_make_finding("hardcoded-api-key", i, line))
+        if re.search(r"\bmd5\b", line, re.IGNORECASE):
+            findings.append(_make_finding("weak-hash-md5", i, line))
+        if re.search(r"\bsha1\b", line, re.IGNORECASE) and not re.search(r"\bsha1(28|92|256)\b", line, re.IGNORECASE):
+            findings.append(_make_finding("weak-hash-sha1", i, line))
+        if re.search(r"\blibc::(system|popen)\b", line):
+            findings.append(_make_finding("libc-system-call", i, line))
+        if re.search(r"\bpanic!\s*\(", line):
+            findings.append(_make_finding("panic-usage", i, line))
+    return findings
+
+
+def _scan_csharp(lines: List[str]) -> List[Dict]:
+    findings: List[Dict] = []
+    for i, line in enumerate(lines):
+        if re.search(r"\bSqlCommand\b.*\+\s*\w", line):
+            findings.append(_make_finding("sql-injection-sqlcommand", i, line))
+        if re.search(r"\bSqlQuery\b.*\+\s*\w", line):
+            findings.append(_make_finding("sql-injection-sqlquery", i, line))
+        if re.search(r"\"SELECT\b.*\"\s*\+\s*\w", line, re.IGNORECASE):
+            findings.append(_make_finding("sql-injection-concat", i, line))
+        if re.search(r"\bProcess\.Start\s*\(", line):
+            findings.append(_make_finding("command-injection-process-start", i, line))
+        if re.search(r"\bBinaryFormatter\b", line):
+            findings.append(_make_finding("insecure-deserialization-binaryformatter", i, line))
+        if re.search(r"\bXmlSerializer\b.*\bDeserialize\b", line):
+            findings.append(_make_finding("insecure-deserialization-xmlserializer", i, line))
+        if re.search(r"\.innerHTML\s*=", line):
+            findings.append(_make_finding("xss-innerhtml", i, line))
+        if re.search(r"\bResponse\.Write\s*\(", line):
+            findings.append(_make_finding("xss-response-write", i, line))
+        if re.search(r"\bConnectionString\b\s*=\s*\"[^\"]+\"", line, re.IGNORECASE):
+            findings.append(_make_finding("hardcoded-connection-string", i, line))
+        if re.search(r"\bpassword\b\s*=\s*\"[^\"]+\"", line, re.IGNORECASE):
+            findings.append(_make_finding("hardcoded-password", i, line))
+        if re.search(r"\bMD5\.Create\s*\(", line):
+            findings.append(_make_finding("weak-hash-md5", i, line))
+        if re.search(r"\bSHA1\.Create\s*\(", line):
+            findings.append(_make_finding("weak-hash-sha1", i, line))
+        if re.search(r"\bDirectory\.Delete\s*\(", line):
+            findings.append(_make_finding("path-traversal-directory-delete", i, line))
+        if re.search(r"\bFile\.Delete\s*\(", line):
+            findings.append(_make_finding("path-traversal-file-delete", i, line))
+        if re.search(r"\bFile\.ReadAllText\s*\(.*\+\s*\w", line):
+            findings.append(_make_finding("path-traversal-file-read", i, line))
+    return findings
+
+
 def _scan_generic(lines: List[str]) -> List[Dict]:
     findings: List[Dict] = []
     for i, line in enumerate(lines):

package/rules/__init__.py

@@ -1,5 +1,6 @@
 # Rule loader for YAML-based security rules
 # Aligned with Semgrep registry format
+# Recursively loads rules from subdirectories (csharp/, rust/, c/, etc.)
 
 import os
 import re
@@ -12,38 +13,117 @@ except ImportError:
 
 RULES_DIR = os.path.dirname(os.path.abspath(__file__))
 
+
+def _is_semgrep_ast_pattern(s):
+    """Check if a string is a Semgrep AST pattern (not a regex)."""
+    semgrep_indicators = ['...', '$', 'pattern-not', 'pattern-inside', 'metavariable']
+    return any(ind in s for ind in semgrep_indicators)
+
+
+def _extract_patterns_from_semgrep_rule(rule_data):
+    """Extract regex patterns from Semgrep-format rule definitions.
+
+    Handles:
+    - patterns: [list of regex strings] -> use directly (skip Semgrep AST patterns)
+    - pattern: single string -> extract if no $metavariables or ...
+    - pattern-regex: string -> use as regex
+    - pattern-either with pattern-regex items -> extract regex patterns
+    - Complex metavariable/AST patterns -> skip
+    """
+    patterns = []
+
+    # Standard format: list of regex strings
+    if 'patterns' in rule_data:
+        raw = rule_data['patterns']
+        if isinstance(raw, list):
+            for item in raw:
+                if isinstance(item, str):
+                    # Skip Semgrep AST patterns (contain ... or $)
+                    if not _is_semgrep_ast_pattern(item):
+                        patterns.append(item)
+                elif isinstance(item, dict):
+                    # Semgrep-style pattern-either or pattern-regex inside patterns list
+                    patterns.extend(_extract_from_dict(item))
+
+    # Single pattern string (Semgrep format)
+    if 'pattern' in rule_data and isinstance(rule_data['pattern'], str):
+        p = rule_data['pattern']
+        if not _is_semgrep_ast_pattern(p):
+            patterns.append(re.escape(p) if not _looks_like_regex(p) else p)
+
+    # Explicit regex pattern
+    if 'pattern-regex' in rule_data and isinstance(rule_data['pattern-regex'], str):
+        patterns.append(rule_data['pattern-regex'])
+
+    return patterns
+
+
+def _extract_from_dict(d):
+    """Extract patterns from a Semgrep dict node (pattern-either, etc.)."""
+    patterns = []
+    if 'pattern-regex' in d and isinstance(d['pattern-regex'], str):
+        patterns.append(d['pattern-regex'])
+    if 'pattern' in d and isinstance(d['pattern'], str):
+        p = d['pattern']
+        if not _is_semgrep_ast_pattern(p):
+            patterns.append(re.escape(p) if not _looks_like_regex(p) else p)
+    if 'pattern-either' in d and isinstance(d['pattern-either'], list):
+        for item in d['pattern-either']:
+            if isinstance(item, dict):
+                patterns.extend(_extract_from_dict(item))
+            elif isinstance(item, str) and not _is_semgrep_ast_pattern(item):
+                patterns.append(item)
+    return patterns
+
+
+def _looks_like_regex(s):
+    """Heuristic: check if a string looks like it's already a regex."""
+    regex_chars = set(r'\.*+?[](){}|^$')
+    return any(c in regex_chars for c in s)
+
+
 def load_yaml_rules():
-    """Load all YAML rule files from the rules directory"""
+    """Load all YAML rule files from the rules directory, recursively."""
     rules = {}
-    
+
     if not HAS_YAML:
         print("Warning: PyYAML not installed. Using fallback rules.")
         return rules
-    
-    for filename in os.listdir(RULES_DIR):
-        if filename.endswith('.yaml') or filename.endswith('.yml'):
-            filepath = os.path.join(RULES_DIR, filename)
+
+    for dirpath, _dirnames, filenames in os.walk(RULES_DIR):
+        for filename in filenames:
+            if not (filename.endswith('.yaml') or filename.endswith('.yml')):
+                continue
+            filepath = os.path.join(dirpath, filename)
             try:
                 with open(filepath, 'r', encoding='utf-8') as f:
                     data = yaml.safe_load(f)
-                    if data and 'rules' in data:
-                        for rule in data['rules']:
-                            rule_id = rule.get('id', '')
-                            if rule_id:
-                                rules[rule_id] = {
-                                    'id': rule_id,
-                                    'name': rule_id.split('.')[-1].replace('-', ' ').title(),
-                                    'patterns': rule.get('patterns', []),
-                                    'message': rule.get('message', ''),
-                                    'severity': rule.get('severity', 'WARNING').lower(),
-                                    'languages': rule.get('languages', ['generic']),
-                                    'metadata': rule.get('metadata', {})
-                                }
+                    if not data or 'rules' not in data:
+                        continue
+                    for rule in data['rules']:
+                        rule_id = rule.get('id', '')
+                        if not rule_id:
+                            continue
+
+                        extracted = _extract_patterns_from_semgrep_rule(rule)
+                        if not extracted:
+                            continue
+
+                        rules[rule_id] = {
+                            'id': rule_id,
+                            'name': rule_id.split('.')[-1].replace('-', ' ').title(),
+                            'patterns': extracted,
+                            'message': rule.get('message', ''),
+                            'severity': rule.get('severity', 'WARNING').lower(),
+                            'languages': rule.get('languages', ['generic']),
+                            'metadata': rule.get('metadata', {})
+                        }
             except Exception as e:
-                print(f"Error loading {filename}: {e}")
-    
+                print(f"Error loading {filepath}: {e}")
+
     return rules
 
+
 # Fallback rules if YAML is not available
 FALLBACK_RULES = {
     'python.lang.security.audit.sql-injection': {
@@ -103,65 +183,73 @@ FALLBACK_RULES = {
     }
 }
 
+
 def get_rules():
-    """Get all rules - from YAML if available, otherwise fallback"""
+    """Get all rules - merge YAML rules with fallback rules.
+    Fallback rules provide regex-based detection baseline.
+    YAML rules add additional patterns (prompt injection, subdirectory rules).
+    """
+    rules = dict(FALLBACK_RULES)
     yaml_rules = load_yaml_rules()
-    if yaml_rules:
-        return yaml_rules
-    return FALLBACK_RULES
+    rules.update(yaml_rules)
+    return rules
+
 
 def get_rules_for_language(language):
     """Get rules applicable to a specific language"""
     all_rules = get_rules()
     applicable_rules = {}
-    
+
     language = language.lower()
-    
+
     for rule_id, rule in all_rules.items():
         rule_languages = [lang.lower() for lang in rule.get('languages', ['generic'])]
         if language in rule_languages or 'generic' in rule_languages:
             applicable_rules[rule_id] = rule
-    
+
     return applicable_rules
 
+
 def get_rules_by_category(category):
     """Get rules by category (e.g., 'injection', 'crypto', 'secrets')"""
     all_rules = get_rules()
     category_rules = {}
-    
+
     category = category.lower()
-    
+
     for rule_id, rule in all_rules.items():
         if category in rule_id.lower():
             category_rules[rule_id] = rule
-    
+
     return category_rules
 
+
 def get_rule_stats():
     """Get statistics about loaded rules"""
     all_rules = get_rules()
-    
+
     stats = {
         'total': len(all_rules),
         'by_severity': {'error': 0, 'warning': 0, 'info': 0},
         'by_language': {},
         'by_category': {}
     }
-    
+
     for rule_id, rule in all_rules.items():
         severity = rule.get('severity', 'warning').lower()
         stats['by_severity'][severity] = stats['by_severity'].get(severity, 0) + 1
-        
+
         for lang in rule.get('languages', ['generic']):
             lang = lang.lower()
             stats['by_language'][lang] = stats['by_language'].get(lang, 0) + 1
-        
+
         parts = rule_id.split('.')
         if len(parts) >= 3:
             category = parts[2] if parts[2] != 'lang' else parts[3] if len(parts) > 3 else parts[2]
             stats['by_category'][category] = stats['by_category'].get(category, 0) + 1
-    
+
     return stats
 
+
 # Export for backward compatibility
 RULES = get_rules()

package/rules/generic/secrets/gitleaks/adafruit-api-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: adafruit-api-key
+  message: A gitleaks adafruit-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:adafruit)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/adobe-client-id.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: adobe-client-id
+  message: A gitleaks adobe-client-id was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:adobe)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/adobe-client-secret.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: adobe-client-secret
+  message: A gitleaks adobe-client-secret was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)\b((p8e-)(?i)[a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/age-secret-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: age-secret-key
+  message: A gitleaks age-secret-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}

package/rules/generic/secrets/gitleaks/airtable-api-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: airtable-api-key
+  message: A gitleaks airtable-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:airtable)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{17})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/algolia-api-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: algolia-api-key
+  message: A gitleaks algolia-api-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:algolia)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/alibaba-access-key-id.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: alibaba-access-key-id
+  message: A gitleaks alibaba-access-key-id was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)\b((LTAI)(?i)[a-z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/alibaba-secret-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: alibaba-secret-key
+  message: A gitleaks alibaba-secret-key was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:alibaba)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{30})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/asana-client-id.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: asana-client-id
+  message: A gitleaks asana-client-id was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:asana)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9]{16})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/asana-client-secret.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: asana-client-secret
+  message: A gitleaks asana-client-secret was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:asana)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)

package/rules/generic/secrets/gitleaks/atlassian-api-token.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: atlassian-api-token
+  message: A gitleaks atlassian-api-token was detected which attempts to identify hard-coded credentials. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+  languages:
+    - regex
+  severity: INFO
+  metadata:
+      likelihood: LOW
+      impact: MEDIUM
+      confidence: LOW
+      category: security
+      cwe:
+        - "CWE-798: Use of Hard-coded Credentials"
+      cwe2021-top25: true
+      cwe2022-top25: true
+      owasp:
+        - A07:2021 - Identification and Authentication Failures
+        - A07:2025 - Authentication Failures
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
+      source-rule-url: https://github.com/zricethezav/gitleaks/tree/master/cmd/generate/config/rules
+      subcategory:
+        - vuln
+      technology:
+        - gitleaks
+  patterns:
+    - pattern-regex: (?i)(?:atlassian|confluence|jira)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)