blitzstrike 2.4.63 → 2.4.64

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.64] — 2026-09-14
+
+### Added — 47-pattern secret format taxonomy (severity + category)
+
+- Expanded `SECRET_FORMATS` from ~12 to 47 known secret formats, each now carrying
+  a severity (critical/high/medium/low) + category (aws, gcp, github, stripe, slack,
+  email_svc, twilio, paas, firebase, jwt, bearer, basic_auth, private_key, generic,
+  ai_api, infra_api, package_registry, saas_api, observability, tunneling, bot_token).
+- New formats: AWS session tokens, GCP service accounts, GitHub OAuth/server-to-server,
+  Stripe live/test/publishable, Slack webhooks, Heroku, Firebase, bearer/basic-auth,
+  RSA/EC/OpenSSH private keys, Anthropic/OpenAI/HuggingFace, Cloudflare/DigitalOcean,
+  npm/PyPI/Docker, Atlassian/Linear, NewRelic/Datadog/Sentry, ngrok, Discord/Telegram.
+- `detectHardcodedSecret` Tier 2 now reports the format's own severity + category,
+  so a hardcoded secret hit is classified (e.g. Stripe live = critical, Stripe test
+  = low) instead of uniformly "high". Redaction patterns expanded to match.
+
 ## [2.4.63] — 2026-09-14
 
 ### Added — Variant corpus + detector coverage sweep (data-driven scaling)

package/dist/index.js

@@ -7409,18 +7409,53 @@ function redactSecrets(text) {
 var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token", SECRET_FORMATS, REDACTION_PATTERNS;
 var init_secrets = __esm(() => {
   SECRET_FORMATS = [
-    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
-    { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/g },
-    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g },
-    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
-    { name: "OpenAI/Stripe key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
-    { name: "Stripe live/test key", re: /\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g },
-    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
-    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g },
-    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
-    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g },
-    { name: "PEM private key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
+    { name: "AWS access key ID", re: /\bAKIA[0-9A-Z]{16}\b/g, severity: "critical", category: "aws" },
+    { name: "AWS session token (temporary)", re: /\bASIA[0-9A-Z]{16}\b/g, severity: "critical", category: "aws" },
+    { name: "AWS secret access key", re: /aws[_-]?secret[_-]?access[_-]?key['"\s:=]+([A-Za-z0-9/+=]{40})/gi, severity: "critical", category: "aws" },
+    { name: "GCP service account key", re: /"type"\s*:\s*"service_account"/g, severity: "critical", category: "gcp" },
+    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g, severity: "high", category: "gcp" },
+    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g, severity: "critical", category: "github" },
+    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, severity: "critical", category: "github" },
+    { name: "GitHub OAuth token", re: /\bgho_[A-Za-z0-9]{20,}\b/g, severity: "high", category: "github" },
+    { name: "GitHub server-to-server token", re: /\bgh[usr]_[A-Za-z0-9]{20,}\b/g, severity: "high", category: "github" },
+    { name: "Stripe live key", re: /\bsk_live_[0-9A-Za-z]{16,}\b/g, severity: "critical", category: "stripe" },
+    { name: "Stripe test key", re: /\bsk_test_[0-9A-Za-z]{16,}\b/g, severity: "low", category: "stripe" },
+    { name: "Stripe publishable key", re: /\bpk_(?:live|test)_[0-9A-Za-z]{16,}\b/g, severity: "low", category: "stripe" },
+    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, severity: "high", category: "slack" },
+    { name: "Slack webhook URL", re: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g, severity: "medium", category: "slack" },
+    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, severity: "high", category: "email_svc" },
+    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g, severity: "high", category: "email_svc" },
+    { name: "Twilio API key", re: /\bSK[0-9a-fA-F]{32}\b/g, severity: "high", category: "twilio" },
+    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g, severity: "medium", category: "twilio" },
+    { name: "Twilio auth token", re: /twilio(.{0,20})?(auth|token)['"=: ]+([a-f0-9]{32})/gi, severity: "high", category: "twilio" },
+    { name: "Heroku API key", re: /heroku(.{0,20})?api['"=: ]+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})/gi, severity: "medium", category: "paas" },
+    { name: "Firebase URL", re: /\bhttps?:\/\/[a-z0-9-]+\.firebaseio\.com\b/g, severity: "low", category: "firebase" },
+    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, severity: "medium", category: "jwt" },
+    { name: "Bearer token", re: /authorization['"=: ]+bearer\s+[A-Za-z0-9._-]{20,}/gi, severity: "medium", category: "bearer" },
+    { name: "Basic auth URL", re: /https?:\/\/[^/\s:@]+:[^/\s:@]+@[^/\s]+/g, severity: "medium", category: "basic_auth" },
+    { name: "RSA private key", re: /-----BEGIN RSA PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "EC private key", re: /-----BEGIN EC PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "OpenSSH private key", re: /-----BEGIN OPENSSH PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "Generic private key", re: /-----BEGIN (DSA |PGP |)PRIVATE KEY-----/g, severity: "critical", category: "private_key" },
+    { name: "Generic API key / token", re: /(?:api[_-]?key|apikey|api_secret|access_token|secret[_-]?token)['"\s:=]+["']([A-Za-z0-9+/=_-]{24,})["']/gi, severity: "medium", category: "generic" },
+    { name: "Anthropic API key", re: /\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI API key (legacy)", re: /\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI project key", re: /\bsk-proj-[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b/g, severity: "critical", category: "ai_api" },
+    { name: "OpenAI session token", re: /\bsess-[A-Za-z0-9]{40}\b/g, severity: "high", category: "ai_api" },
+    { name: "Hugging Face token", re: /\bhf_[A-Za-z0-9]{30,}\b/g, severity: "high", category: "ai_api" },
+    { name: "Cloudflare API key", re: /cf[_-]?api[_-]?key['"\s:=]+([a-f0-9]{37})/gi, severity: "critical", category: "infra_api" },
+    { name: "DigitalOcean token", re: /\bdop_v1_[a-f0-9]{64}\b/g, severity: "high", category: "infra_api" },
+    { name: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, severity: "high", category: "package_registry" },
+    { name: "PyPI token", re: /\bpypi-AgENdGV[A-Za-z0-9_-]+\b/g, severity: "high", category: "package_registry" },
+    { name: "Docker Hub PAT", re: /\bdckr_pat_[A-Za-z0-9_-]{27,}\b/g, severity: "high", category: "package_registry" },
+    { name: "Atlassian API token", re: /\bATATT3xFfGF0[A-Za-z0-9_-]{20,}\b/g, severity: "high", category: "saas_api" },
+    { name: "Linear API key", re: /\blin_api_[A-Za-z0-9]{40}\b/g, severity: "medium", category: "saas_api" },
+    { name: "New Relic license key", re: /\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, severity: "medium", category: "observability" },
+    { name: "Datadog API key", re: /dd[_-]?api[_-]?key['"\s:=]+([a-f0-9]{32})/gi, severity: "high", category: "observability" },
+    { name: "Sentry DSN", re: /https:\/\/[a-f0-9]+@o[0-9]+\.ingest\.sentry\.io\/[0-9]+/g, severity: "low", category: "observability" },
+    { name: "ngrok auth token", re: /\b[12][A-Za-z0-9]{26}_[A-Za-z0-9]{32,}\b/g, severity: "medium", category: "tunneling" },
+    { name: "Discord bot token", re: /\b[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27}\b/g, severity: "high", category: "bot_token" },
+    { name: "Telegram bot token", re: /\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, severity: "high", category: "bot_token" }
   ];
   REDACTION_PATTERNS = [
     [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
@@ -7433,17 +7468,34 @@ var init_secrets = __esm(() => {
     [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
     [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
     [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
-    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
-    [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
-    [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-    [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
-    [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-    [/\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g, "[REDACTED]"],
+    [/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
+    [/\bASIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
+    [/\bghp_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "[REDACTED]"],
+    [/\bgho_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bgh[usr]_[A-Za-z0-9]{20,}\b/g, "[REDACTED]"],
+    [/\bsk_live_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
+    [/\bsk_test_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
+    [/\bpk_(?:live|test)_[0-9A-Za-z]{16,}\b/g, "[REDACTED]"],
     [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED]"],
     [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED]"],
     [/\bAC[0-9a-f]{32}\b/g, "[REDACTED]"],
+    [/\bSK[0-9a-fA-F]{32}\b/g, "[REDACTED]"],
     [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
     [/\bkey-[0-9a-zA-Z]{32}\b/g, "[REDACTED]"],
+    [/\bsk-ant-(?:api03|admin01)-[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\bsk-proj-[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\bsess-[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
+    [/\bhf_[A-Za-z0-9]{30,}\b/g, "[REDACTED]"],
+    [/\bdop_v1_[a-f0-9]{64}\b/g, "[REDACTED]"],
+    [/\bnpm_[A-Za-z0-9]{36}\b/g, "[REDACTED]"],
+    [/\bpypi-AgENdGV[A-Za-z0-9_-]+\b/g, "[REDACTED]"],
+    [/\bdckr_pat_[A-Za-z0-9_-]{27,}\b/g, "[REDACTED]"],
+    [/\bATATT3xFfGF0[A-Za-z0-9_-]{20,}\b/g, "[REDACTED]"],
+    [/\blin_api_[A-Za-z0-9]{40}\b/g, "[REDACTED]"],
+    [/\b(?:NRAA|NRAK|NRBR)-[A-F0-9]{27}\b/g, "[REDACTED]"],
+    [/\b\d{8,10}:[A-Za-z0-9_-]{35}\b/g, "[REDACTED]"],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
   ];
 });
@@ -16487,10 +16539,10 @@ function detectHardcodedSecret(code, file, out) {
         file,
         line: ln,
         type: "hardcoded_secret",
-        category: "Hardcoded secret (known format)",
-        severity: "high",
+        category: `Hardcoded secret (${fmt.category}: ${fmt.name})`,
+        severity: fmt.severity,
         evidence: (ls[ln - 1] ?? "").trim(),
-        detail: `A ${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798). Rotate it and load from the environment instead.`
+        detail: `${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798, severity ${fmt.severity}). Rotate it and load from the environment instead.`
       });
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.63",
+  "version": "2.4.64",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {