aura-security 1.0.1 → 1.0.2

package/dist/integrations/local-scanner.js

@@ -66,7 +66,18 @@ const FALSE_POSITIVE_DIRS = [
     '/thirdparty/',
     '/external/',
     '/dummy/',
-    '/fake/'
+    '/fake/',
+    '/data/',
+    '/scripts/data/',
+    '/seeds/',
+    '/seed/',
+    '/migrations/',
+    '/migration/',
+    '/index_constituents/',
+    '/token-list/',
+    '/tokenlist/',
+    '/verified-tokens/',
+    '/validated-tokens/'
 ];
 // File name patterns that indicate test/example data (not real secrets)
 const TEST_FILE_PATTERNS = [
@@ -108,6 +119,8 @@ const SKIP_RULES_IN_FILE_TYPES = {
     '.md': ['generic-api-key', 'curl-auth-header'],
     '.rst': ['generic-api-key', 'curl-auth-header'],
     '.txt': ['generic-api-key'],
+    // JSON files often contain token lists, address registries, config data - not real secrets
+    '.json': ['generic-api-key', 'aws-access-token', 'private-key'],
 };
 // Run gitleaks for secrets detection
 function runGitleaks(targetPath) {
@@ -153,8 +166,17 @@ function runGitleaks(targetPath) {
                 const fileExt = extname(fileName).toLowerCase();
                 const skipRulesForExt = SKIP_RULES_IN_FILE_TYPES[fileExt] || [];
                 const isRuleSkippedForFileType = skipRulesForExt.includes(ruleId);
+                // Filter out JSON data files that contain token lists / address registries
+                // (Solana base58 addresses get flagged as API keys by gitleaks)
+                const isJsonDataFile = fileExt === '.json' && (/token[-_]?list/i.test(filePath) ||
+                    /address(es)?[-_]?(list|registry)/i.test(filePath) ||
+                    /constituents/i.test(filePath) ||
+                    /verified[-_]?tokens/i.test(filePath) ||
+                    /validated[-_]?tokens/i.test(filePath) ||
+                    /mint(s)?[-_]?(list|registry)/i.test(filePath) ||
+                    /registry\.json$/i.test(filePath));
                 // Skip if any false positive indicator matches
-                if (isExcludedFile || isInFalsePositiveDir || isTestFile || isFalsePositiveRule || isRuleSkippedForFileType) {
+                if (isExcludedFile || isInFalsePositiveDir || isTestFile || isFalsePositiveRule || isRuleSkippedForFileType || isJsonDataFile) {
                     filteredCount++;
                     continue;
                 }
@@ -166,13 +188,34 @@ function runGitleaks(targetPath) {
                     severity: finding.Entropy > 4.5 ? 'critical' : 'high'
                 });
             }
+            // Post-processing: if a single JSON file has 10+ findings, it's almost certainly
+            // a data/registry file (token lists, address mappings) not real leaked secrets
+            const fileCounts = new Map();
+            for (const f of findings) {
+                if (f.file.toLowerCase().endsWith('.json')) {
+                    fileCounts.set(f.file, (fileCounts.get(f.file) || 0) + 1);
+                }
+            }
+            const bulkJsonFiles = new Set();
+            for (const [file, count] of fileCounts) {
+                if (count >= 10) {
+                    bulkJsonFiles.add(file);
+                    filteredCount += count;
+                    console.log(`[SCANNER] Filtered ${count} findings from ${basename(file)} (bulk data file)`);
+                }
+            }
+            if (bulkJsonFiles.size > 0) {
+                const beforeCount = findings.length;
+                findings.splice(0, findings.length, ...findings.filter(f => !bulkJsonFiles.has(f.file)));
+                console.log(`[SCANNER] Removed ${beforeCount - findings.length} bulk JSON false positives`);
+            }
             // Cleanup
             try {
                 rmSync(reportPath);
             }
             catch { }
             if (filteredCount > 0) {
-                console.log(`[SCANNER] Filtered ${filteredCount} false positives (test files, examples, lock files)`);
+                console.log(`[SCANNER] Filtered ${filteredCount} false positives (test files, examples, lock files, data files)`);
             }
         }
         console.log(`[SCANNER] gitleaks found ${findings.length} secrets`);
@@ -777,10 +820,20 @@ const SECRET_PATTERNS = [
     // OpenAI API Key
     { name: 'OpenAI Key', regex: /sk-[A-Za-z0-9]{32,}/g, severity: 'high' },
 ];
-// Files/patterns to SKIP for secret scanning (test files, examples, etc.)
+// Files/patterns to SKIP for secret scanning (test files, examples, lock files, data files)
 const SKIP_SECRET_SCAN_PATTERNS = [
+    // Test/example files
     /example/i, /sample/i, /test/i, /mock/i, /fixture/i, /\.test\./i, /\.spec\./i,
-    /\.d\.ts$/, /\.map$/, /\.min\./
+    // Build artifacts
+    /\.d\.ts$/, /\.map$/, /\.min\./,
+    // Lock files (contain hashes that trigger false positives, never contain real secrets)
+    /package-lock\.json$/i, /pnpm-lock\.yaml$/i, /yarn\.lock$/i, /Cargo\.lock$/i, /composer\.lock$/i, /Gemfile\.lock$/i,
+    // Template/example env files (placeholders, not real secrets)
+    /\.example$/i, /\.template$/i, /\.sample$/i,
+    // Data directories (contain public addresses, not secrets)
+    /\/data\//i, /\/fixtures?\//i, /\/seeds?\//i, /\/migrations?\//i,
+    // Index/constituent data files (stock symbols, token lists etc.)
+    /index_constituents/i, /token-?list/i, /verified-tokens/i, /validated-tokens/i,
 ];
 // Files to scan for secrets
 const FILES_TO_SCAN = [
@@ -1408,9 +1461,26 @@ export class LocalScanner {
             if (stats.size > 1024 * 1024)
                 return findings;
             const content = readFileSync(filePath, 'utf-8');
+            // Skip JSON files that are clearly data (token lists, address registries, etc.)
+            // These contain public blockchain addresses that regex misidentifies as secrets
+            if (fileName.endsWith('.json')) {
+                // If a JSON file has "tokens", "addresses", "mints", "symbols" keys, it's data
+                if (/["'](tokens|addresses|mints|symbols|constituents|verified|validated)["']\s*:/i.test(content)) {
+                    return findings;
+                }
+                // If JSON file has more than 100 similar-looking base58 values, it's a token/address list
+                const base58Matches = content.match(/["'][1-9A-HJ-NP-Za-km-z]{32,44}["']/g);
+                if (base58Matches && base58Matches.length > 50) {
+                    return findings;
+                }
+            }
             const lines = content.split('\n');
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
+                // Skip lines that are clearly placeholder/example values
+                if (/your[_-]?(?:api[_-]?key|token|secret)|REPLACE[_-]?ME|TODO|CHANGEME|xxxx|placeholder/i.test(line)) {
+                    continue;
+                }
                 for (const pattern of SECRET_PATTERNS) {
                     pattern.regex.lastIndex = 0;
                     const match = pattern.regex.exec(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aura-security",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "AI-powered security scanner with 9-agent swarm. Detect secrets, vulnerabilities, attack paths. CLI, API, or cloud dashboard at app.aurasecurity.io",
   "type": "module",
   "main": "dist/index.js",