aura-security 1.0.1 → 1.0.3

package/dist/integrations/local-scanner.js

@@ -66,7 +66,18 @@ const FALSE_POSITIVE_DIRS = [
     '/thirdparty/',
     '/external/',
     '/dummy/',
-    '/fake/'
+    '/fake/',
+    '/data/',
+    '/scripts/data/',
+    '/seeds/',
+    '/seed/',
+    '/migrations/',
+    '/migration/',
+    '/index_constituents/',
+    '/token-list/',
+    '/tokenlist/',
+    '/verified-tokens/',
+    '/validated-tokens/'
 ];
 // File name patterns that indicate test/example data (not real secrets)
 const TEST_FILE_PATTERNS = [
@@ -108,6 +119,8 @@ const SKIP_RULES_IN_FILE_TYPES = {
     '.md': ['generic-api-key', 'curl-auth-header'],
     '.rst': ['generic-api-key', 'curl-auth-header'],
     '.txt': ['generic-api-key'],
+    // JSON files often contain token lists, address registries, config data - not real secrets
+    '.json': ['generic-api-key', 'aws-access-token', 'private-key'],
 };
 // Run gitleaks for secrets detection
 function runGitleaks(targetPath) {
@@ -153,8 +166,17 @@ function runGitleaks(targetPath) {
                 const fileExt = extname(fileName).toLowerCase();
                 const skipRulesForExt = SKIP_RULES_IN_FILE_TYPES[fileExt] || [];
                 const isRuleSkippedForFileType = skipRulesForExt.includes(ruleId);
+                // Filter out JSON data files that contain token lists / address registries
+                // (Solana base58 addresses get flagged as API keys by gitleaks)
+                const isJsonDataFile = fileExt === '.json' && (/token[-_]?list/i.test(filePath) ||
+                    /address(es)?[-_]?(list|registry)/i.test(filePath) ||
+                    /constituents/i.test(filePath) ||
+                    /verified[-_]?tokens/i.test(filePath) ||
+                    /validated[-_]?tokens/i.test(filePath) ||
+                    /mint(s)?[-_]?(list|registry)/i.test(filePath) ||
+                    /registry\.json$/i.test(filePath));
                 // Skip if any false positive indicator matches
-                if (isExcludedFile || isInFalsePositiveDir || isTestFile || isFalsePositiveRule || isRuleSkippedForFileType) {
+                if (isExcludedFile || isInFalsePositiveDir || isTestFile || isFalsePositiveRule || isRuleSkippedForFileType || isJsonDataFile) {
                     filteredCount++;
                     continue;
                 }
@@ -166,13 +188,34 @@ function runGitleaks(targetPath) {
                     severity: finding.Entropy > 4.5 ? 'critical' : 'high'
                 });
             }
+            // Post-processing: if a single JSON file has 10+ findings, it's almost certainly
+            // a data/registry file (token lists, address mappings) not real leaked secrets
+            const fileCounts = new Map();
+            for (const f of findings) {
+                if (f.file.toLowerCase().endsWith('.json')) {
+                    fileCounts.set(f.file, (fileCounts.get(f.file) || 0) + 1);
+                }
+            }
+            const bulkJsonFiles = new Set();
+            for (const [file, count] of fileCounts) {
+                if (count >= 10) {
+                    bulkJsonFiles.add(file);
+                    filteredCount += count;
+                    console.log(`[SCANNER] Filtered ${count} findings from ${basename(file)} (bulk data file)`);
+                }
+            }
+            if (bulkJsonFiles.size > 0) {
+                const beforeCount = findings.length;
+                findings.splice(0, findings.length, ...findings.filter(f => !bulkJsonFiles.has(f.file)));
+                console.log(`[SCANNER] Removed ${beforeCount - findings.length} bulk JSON false positives`);
+            }
             // Cleanup
             try {
                 rmSync(reportPath);
             }
             catch { }
             if (filteredCount > 0) {
-                console.log(`[SCANNER] Filtered ${filteredCount} false positives (test files, examples, lock files)`);
+                console.log(`[SCANNER] Filtered ${filteredCount} false positives (test files, examples, lock files, data files)`);
             }
         }
         console.log(`[SCANNER] gitleaks found ${findings.length} secrets`);
@@ -777,10 +820,20 @@ const SECRET_PATTERNS = [
     // OpenAI API Key
     { name: 'OpenAI Key', regex: /sk-[A-Za-z0-9]{32,}/g, severity: 'high' },
 ];
-// Files/patterns to SKIP for secret scanning (test files, examples, etc.)
+// Files/patterns to SKIP for secret scanning (test files, examples, lock files, data files)
 const SKIP_SECRET_SCAN_PATTERNS = [
+    // Test/example files
     /example/i, /sample/i, /test/i, /mock/i, /fixture/i, /\.test\./i, /\.spec\./i,
-    /\.d\.ts$/, /\.map$/, /\.min\./
+    // Build artifacts
+    /\.d\.ts$/, /\.map$/, /\.min\./,
+    // Lock files (contain hashes that trigger false positives, never contain real secrets)
+    /package-lock\.json$/i, /pnpm-lock\.yaml$/i, /yarn\.lock$/i, /Cargo\.lock$/i, /composer\.lock$/i, /Gemfile\.lock$/i,
+    // Template/example env files (placeholders, not real secrets)
+    /\.example$/i, /\.template$/i, /\.sample$/i,
+    // Data directories (contain public addresses, not secrets)
+    /\/data\//i, /\/fixtures?\//i, /\/seeds?\//i, /\/migrations?\//i,
+    // Index/constituent data files (stock symbols, token lists etc.)
+    /index_constituents/i, /token-?list/i, /verified-tokens/i, /validated-tokens/i,
 ];
 // Files to scan for secrets
 const FILES_TO_SCAN = [
@@ -1408,9 +1461,26 @@ export class LocalScanner {
             if (stats.size > 1024 * 1024)
                 return findings;
             const content = readFileSync(filePath, 'utf-8');
+            // Skip JSON files that are clearly data (token lists, address registries, etc.)
+            // These contain public blockchain addresses that regex misidentifies as secrets
+            if (fileName.endsWith('.json')) {
+                // If a JSON file has "tokens", "addresses", "mints", "symbols" keys, it's data
+                if (/["'](tokens|addresses|mints|symbols|constituents|verified|validated)["']\s*:/i.test(content)) {
+                    return findings;
+                }
+                // If JSON file has more than 100 similar-looking base58 values, it's a token/address list
+                const base58Matches = content.match(/["'][1-9A-HJ-NP-Za-km-z]{32,44}["']/g);
+                if (base58Matches && base58Matches.length > 50) {
+                    return findings;
+                }
+            }
             const lines = content.split('\n');
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
+                // Skip lines that are clearly placeholder/example values
+                if (/your[_-]?(?:api[_-]?key|token|secret)|REPLACE[_-]?ME|TODO|CHANGEME|xxxx|placeholder/i.test(line)) {
+                    continue;
+                }
                 for (const pattern of SECRET_PATTERNS) {
                     pattern.regex.lastIndex = 0;
                     const match = pattern.regex.exec(line);

package/dist/integrations/trust-scanner.js

@@ -545,8 +545,21 @@ function calculateScore(checks) {
     const isAbandoned = checks.some(c => c.id === 'activity' && c.status === 'bad');
     // Apply caps based on critical issues
     if (hasSecrets) {
-        // Leaked secrets = max score 50 (RISKY)
-        score = Math.min(score, 50);
+        const secretsCheck = checks.find(c => c.id === 'secrets');
+        const secretCount = secretsCheck ? Math.abs(secretsCheck.points) / 10 : 1;
+        if (secretCount >= 5) {
+            // Many secrets = definitely compromised, hard cap RISKY
+            score = Math.min(score, 40);
+        }
+        else if (secretCount >= 3) {
+            // Several secrets = serious concern
+            score = Math.min(score, 50);
+        }
+        else {
+            // 1-2 secrets = concerning but could be marginal detection
+            // Cap at DYOR, let other signals weigh in
+            score = Math.min(score, 65);
+        }
     }
     if (hasNoCode) {
         // No code = max score 40 (RISKY)
@@ -632,16 +645,24 @@ function generateSummary(checks, score, verdict) {
  */
 function scanForSecrets(content) {
     const secretPatterns = [
-        /AKIA[0-9A-Z]{16}/, // AWS Access Key
-        /[a-zA-Z0-9+\/]{40}/, // Generic 40-char key
-        /ghp_[A-Za-z0-9_]{36}/, // GitHub Token
-        /sk_live_[A-Za-z0-9]{24,}/, // Stripe Key
-        /-----BEGIN.*PRIVATE KEY-----/, // Private Key
-        /password\s*[:=]\s*['""][^'""]+['""]/, // Hardcoded password
+        /AKIA[0-9A-Z]{16}/, // AWS Access Key (always starts with AKIA)
+        /gh[pousr]_[A-Za-z0-9_]{36,}/, // GitHub tokens (prefixed)
+        /sk_live_[A-Za-z0-9]{24,}/, // Stripe live keys
+        /-----BEGIN\s*(?:RSA|EC|DSA|OPENSSH)?\s*PRIVATE KEY-----/, // Private keys (PEM format)
+        /password\s*[:=]\s*["'][^"']{8,}["']/i, // Hardcoded passwords with real values
+        /xox[bprs]-[0-9]{10,}-[A-Za-z0-9-]+/, // Slack tokens
+        /(?:api[_-]?key|secret[_-]?key|auth[_-]?token)\s*[:=]\s*["'][A-Za-z0-9+\/=]{20,}["']/i, // Secret assignments
     ];
+    // Skip data files (token lists, address registries)
+    if (/["'](tokens|addresses|mints|constituents|verified)["']\s*:/i.test(content)) {
+        return 0;
+    }
+    // Placeholder values are not real secrets
+    const placeholderPattern = /your[_-]?api[_-]?key|REPLACE[_-]?ME|TODO|CHANGEME|xxxx|placeholder|example/i;
     let count = 0;
     for (const pattern of secretPatterns) {
-        if (pattern.test(content)) {
+        const match = content.match(pattern);
+        if (match && !placeholderPattern.test(match[0])) {
             count++;
         }
     }
@@ -884,11 +905,28 @@ export async function performTrustScan(gitUrl) {
                 }
             }
             codeRedFlags = scanCodeForRedFlags(scannedFiles);
-            // Quick secret scan on key files (config files, env examples)
-            const sensitiveFiles = files.filter((f) => f.path.includes('config') ||
-                f.path.includes('.env') ||
-                f.path.endsWith('.json') ||
-                f.path.endsWith('.yml')).slice(0, 5);
+            // Quick secret scan on files that could plausibly contain secrets
+            const sensitiveFiles = files.filter((f) => {
+                const p = f.path.toLowerCase();
+                // Only scan files that could contain secrets
+                const isSensitive = p.includes('.env') ||
+                    p.includes('config') ||
+                    p.endsWith('.yml') ||
+                    p.endsWith('.yaml');
+                // Exclude known safe files that produce false positives
+                const isSafe = p === 'package.json' ||
+                    p === 'package-lock.json' ||
+                    p.includes('tsconfig') ||
+                    p.includes('eslint') ||
+                    p.includes('prettier') ||
+                    p.endsWith('.lock') ||
+                    p.includes('token-list') ||
+                    p.includes('tokenlist') ||
+                    p.includes('/test') ||
+                    p.includes('/example') ||
+                    p.includes('/fixture');
+                return isSensitive && !isSafe;
+            }).slice(0, 5);
             for (const file of sensitiveFiles) {
                 try {
                     const fileRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${file.path}`, { headers });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aura-security",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "AI-powered security scanner with 9-agent swarm. Detect secrets, vulnerabilities, attack paths. CLI, API, or cloud dashboard at app.aurasecurity.io",
   "type": "module",
   "main": "dist/index.js",