bastion-scan 0.1.2 → 0.1.3

package/README.md

@@ -48,7 +48,7 @@ npx bastion-scan scan --generate-configs
 | Check | What it does |
 |-------|-------------|
 | `.gitignore` coverage | Makes sure `.env`, `node_modules`, and keys are excluded |
-| Hardcoded secrets | Looks for API keys from OpenAI, Stripe, AWS, and others |
+| Hardcoded secrets | API keys from OpenAI, Anthropic, GitHub, Stripe, AWS, Google, Slack, and more |
 | Dependency audit | Wraps `npm audit` and maps findings to severity levels |
 | `.env.example` | Checks that a template exists with safe placeholder values |
 | `security.txt` | Validates RFC 9116 Contact + Expires fields |

package/dist/index.js

@@ -196,40 +196,145 @@ var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
 ]);
 var IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", ".git", "tests", "__tests__", "test", "fixtures"]);
 var SECRET_PATTERNS = [
+  // ── OpenAI ──────────────────────────────────────────────────────────────
   {
-    name: "OpenAI API key",
-    regex: /sk-[A-Za-z0-9]{20,}/,
-    description: "OpenAI API key detected"
+    name: "OpenAI API key (project)",
+    regex: /sk-proj-[a-zA-Z0-9_-]{20,}/,
+    description: "OpenAI project API key detected",
+    severity: "critical"
   },
+  {
+    name: "OpenAI API key (service account)",
+    regex: /sk-svcacct-[a-zA-Z0-9_-]{20,}/,
+    description: "OpenAI service account key detected",
+    severity: "critical"
+  },
+  {
+    name: "OpenAI API key (legacy)",
+    regex: /sk-[a-zA-Z0-9]{20,}/,
+    description: "OpenAI API key detected",
+    severity: "critical"
+  },
+  // ── Anthropic ───────────────────────────────────────────────────────────
+  {
+    name: "Anthropic API key",
+    regex: /sk-ant-api[0-9]{2}-[a-zA-Z0-9_-]{40,}/,
+    description: "Anthropic API key detected",
+    severity: "critical"
+  },
+  {
+    name: "Anthropic admin key",
+    regex: /sk-ant-admin[0-9]{2}-[a-zA-Z0-9_-]{40,}/,
+    description: "Anthropic admin API key detected",
+    severity: "critical"
+  },
+  // ── GitHub ──────────────────────────────────────────────────────────────
+  {
+    name: "GitHub PAT (classic)",
+    regex: /ghp_[a-zA-Z0-9]{36}/,
+    description: "GitHub personal access token (classic) detected",
+    severity: "critical"
+  },
+  {
+    name: "GitHub OAuth token",
+    regex: /gho_[a-zA-Z0-9]{36}/,
+    description: "GitHub OAuth access token detected",
+    severity: "critical"
+  },
+  {
+    name: "GitHub PAT (fine-grained)",
+    regex: /github_pat_[a-zA-Z0-9_]{82}/,
+    description: "GitHub fine-grained personal access token detected",
+    severity: "critical"
+  },
+  {
+    name: "GitHub app token",
+    regex: /ghs_[a-zA-Z0-9]{36}/,
+    description: "GitHub app installation token detected",
+    severity: "critical"
+  },
+  {
+    name: "GitHub refresh token",
+    regex: /ghr_[a-zA-Z0-9]{36}/,
+    description: "GitHub refresh token detected",
+    severity: "critical"
+  },
+  // ── Stripe ──────────────────────────────────────────────────────────────
   {
     name: "Stripe secret key",
-    regex: /sk_live_[A-Za-z0-9]{20,}/,
-    description: "Stripe secret key detected"
+    regex: /sk_live_[a-zA-Z0-9]{24,}/,
+    description: "Stripe secret key detected",
+    severity: "critical"
   },
   {
     name: "Stripe publishable key",
-    regex: /pk_live_[A-Za-z0-9]{20,}/,
-    description: "Stripe publishable live key detected"
+    regex: /pk_live_[a-zA-Z0-9]{20,}/,
+    description: "Stripe publishable live key detected",
+    severity: "critical"
+  },
+  {
+    name: "Stripe restricted key",
+    regex: /rk_live_[a-zA-Z0-9]{24,}/,
+    description: "Stripe restricted API key detected",
+    severity: "critical"
   },
+  {
+    name: "Stripe test key",
+    regex: /sk_test_[a-zA-Z0-9]{24,}/,
+    description: "Stripe test secret key detected",
+    severity: "high"
+  },
+  // ── AWS ─────────────────────────────────────────────────────────────────
   {
     name: "AWS access key",
     regex: /AKIA[0-9A-Z]{16}/,
-    description: "AWS access key ID detected"
+    description: "AWS access key ID detected",
+    severity: "critical"
+  },
+  // ── Google ──────────────────────────────────────────────────────────────
+  {
+    name: "Google API key",
+    regex: /AIza[a-zA-Z0-9_-]{35}/,
+    description: "Google API key detected",
+    severity: "critical"
   },
+  // ── Slack ───────────────────────────────────────────────────────────────
+  {
+    name: "Slack bot token",
+    regex: /xoxb-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}/,
+    description: "Slack bot token detected",
+    severity: "critical"
+  },
+  {
+    name: "Slack user token",
+    regex: /xoxp-[0-9]{10,13}-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{32}/,
+    description: "Slack user token detected",
+    severity: "critical"
+  },
+  {
+    name: "Slack webhook URL",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9]{8,12}\/B[a-zA-Z0-9]{8,12}\/[a-zA-Z0-9]{24}/,
+    description: "Slack incoming webhook URL detected",
+    severity: "high"
+  },
+  // ── Generic ─────────────────────────────────────────────────────────────
   {
     name: "Generic API key assignment",
     regex: /(?:api[_-]?key|apikey|api[_-]?secret)\s*[:=]\s*['"][A-Za-z0-9_\-/.]{8,}['"]/i,
-    description: "Hardcoded API key assignment detected"
+    description: "Hardcoded API key assignment detected",
+    severity: "critical"
   },
   {
     name: "Bearer token",
     regex: /['"]Bearer\s+[A-Za-z0-9_\-/.+]{20,}['"]/,
-    description: "Hardcoded Bearer token detected"
+    description: "Hardcoded Bearer token detected",
+    severity: "critical"
   },
   {
     name: "Database connection string",
     regex: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis):\/\/[^:]+:[^@\s]+@/i,
-    description: "Database connection string with embedded password detected"
+    description: "Database connection string with embedded password detected",
+    severity: "critical"
   }
 ];
 var AI_PROMPT = "I found a hardcoded secret in my source code. Help me move it to an environment variable. Show me: (1) how to add it to .env, (2) how to read it with process.env or the equivalent for my framework, (3) how to add the key name to .env.example with a placeholder value, and (4) how to validate at startup that the variable is set.";
@@ -265,7 +370,7 @@ function scanContent(content, relativePath) {
           id: "secrets",
           name: `Hardcoded secret: ${pattern.name}`,
           status: "fail",
-          severity: "critical",
+          severity: pattern.severity,
           category: "Secrets",
           location: `${relativePath}:${i + 1}`,
           description: pattern.description,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bastion-scan",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Privacy-first security checker for web projects. 15 checks, zero data uploaded, actionable fixes.",
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
     "dev": "tsup --watch"
   },
   "dependencies": {
-    "bastion-shared": "^0.1.2",
+    "bastion-shared": "^0.1.3",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
     "ora": "^9.3.0"