chainwall 0.1.0

package/patterns/credentials.yaml

@@ -0,0 +1,317 @@
+# ChainWall — Credential Detection Patterns
+#
+# 50+ patterns for API keys, tokens, and secrets from major providers.
+# Reference database. Consumed by security-audit.sh for project scanning.
+# Critical patterns are hardcoded in hooks for real-time enforcement.
+#
+# Fields:
+#   name:        Human-readable pattern name
+#   regex:       POSIX ERE with `(?i)` prefix convention (stripped by scanner, replaced with -i flag)
+#   severity:    critical | high | medium
+#   description: What this pattern detects and why it matters
+#
+# Severity guide:
+#   critical — Live production credentials, immediate exploitation risk
+#   high     — API keys/tokens with significant access scope
+#   medium   — Keys with limited scope or test-mode indicators
+
+patterns:
+
+  # ── AWS ──────────────────────────────────────────────────────────────
+  - name: AWS Access Key ID
+    regex: "AKIA[0-9A-Z]{16}"
+    severity: critical
+    description: AWS IAM access key — grants programmatic access to AWS services
+
+  - name: AWS Secret Access Key
+    regex: "(?i)aws_secret_access_key[\"'\\s=:]+[A-Za-z0-9/+=]{40}"
+    severity: critical
+    description: AWS secret key paired with access key ID
+
+  - name: AWS Session Token
+    regex: "(?i)aws_session_token[\"'\\s=:]+[A-Za-z0-9/+=]{100,}"
+    severity: critical
+    description: Temporary AWS session token from STS
+
+  # ── GCP / Google ─────────────────────────────────────────────────────
+  - name: Google API Key
+    regex: "AIza[0-9A-Za-z_-]{35}"
+    severity: high
+    description: Google Cloud / Maps / Firebase API key
+
+  - name: GCP Service Account Key
+    regex: "\"type\":\\s*\"service_account\""
+    severity: critical
+    description: GCP service account JSON key file marker
+
+  - name: Google OAuth Client Secret
+    regex: "(?i)client_secret[\"'\\s=:]+[A-Za-z0-9_-]{24,}"
+    severity: high
+    description: Google OAuth2 client secret
+
+  # ── Azure ────────────────────────────────────────────────────────────
+  - name: Azure Storage Account Key
+    regex: "(?i)(AccountKey|azure_storage_key)[\"'\\s=:]+[A-Za-z0-9/+=]{86,88}=="
+    severity: critical
+    description: Azure Storage account access key
+
+  - name: Azure AD Client Secret
+    regex: "(?i)(client_secret|azure_client_secret)[\"'\\s=:]+[A-Za-z0-9_.~-]{34,}"
+    severity: high
+    description: Azure Active Directory application secret
+
+  - name: Azure Connection String
+    regex: "DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9/+=]{86,88}=="
+    severity: critical
+    description: Azure Storage connection string with embedded key
+
+  # ── GitHub ───────────────────────────────────────────────────────────
+  - name: GitHub Personal Access Token
+    regex: "ghp_[a-zA-Z0-9]{36,}"
+    severity: critical
+    description: GitHub classic personal access token
+
+  - name: GitHub Fine-Grained Token
+    regex: "github_pat_[a-zA-Z0-9]{22,}_[a-zA-Z0-9]{59,}"
+    severity: critical
+    description: GitHub fine-grained personal access token
+
+  - name: GitHub OAuth Access Token
+    regex: "gho_[a-zA-Z0-9]{36}"
+    severity: high
+    description: GitHub OAuth access token
+
+  - name: GitHub App Token
+    regex: "(ghu|ghs)_[a-zA-Z0-9]{36}"
+    severity: high
+    description: GitHub App user-to-server or server-to-server token
+
+  - name: GitHub App Refresh Token
+    regex: "ghr_[a-zA-Z0-9]{36}"
+    severity: high
+    description: GitHub App refresh token
+
+  # ── GitLab ───────────────────────────────────────────────────────────
+  - name: GitLab Personal Access Token
+    regex: "glpat-[a-zA-Z0-9_-]{20,}"
+    severity: critical
+    description: GitLab personal access token
+
+  - name: GitLab Pipeline Token
+    regex: "glptt-[a-zA-Z0-9_-]{20,}"
+    severity: high
+    description: GitLab pipeline trigger token
+
+  - name: GitLab Runner Token
+    regex: "glrt-[a-zA-Z0-9_-]{20,}"
+    severity: high
+    description: GitLab runner registration token
+
+  # ── Slack ────────────────────────────────────────────────────────────
+  - name: Slack Bot/User Token
+    regex: "xox[pboa]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}"
+    severity: critical
+    description: Slack API token (bot, user, app, or OAuth)
+
+  - name: Slack Webhook URL
+    regex: "https://hooks\\.slack\\.com/services/T[A-Z0-9]{8,}/B[A-Z0-9]{8,}/[a-zA-Z0-9]{24,}"
+    severity: high
+    description: Slack incoming webhook URL
+
+  # ── Stripe ───────────────────────────────────────────────────────────
+  - name: Stripe Secret Key
+    regex: "sk_(live|test)_[a-zA-Z0-9]{24,}"
+    severity: critical
+    description: Stripe API secret key (live or test mode)
+
+  - name: Stripe Restricted Key
+    regex: "rk_(live|test)_[a-zA-Z0-9]{24,}"
+    severity: high
+    description: Stripe restricted API key
+
+  - name: Stripe Webhook Secret
+    regex: "whsec_[a-zA-Z0-9]{32,}"
+    severity: high
+    description: Stripe webhook signing secret
+
+  # ── OpenAI / Anthropic ──────────────────────────────────────────────
+  - name: OpenAI API Key
+    regex: "sk-[a-zA-Z0-9]{48}"
+    severity: critical
+    description: OpenAI API key for GPT/DALL-E/Whisper access
+
+  - name: OpenAI Project Key
+    regex: "sk-proj-[a-zA-Z0-9_-]{48,}"
+    severity: critical
+    description: OpenAI project-scoped API key
+
+  - name: Anthropic API Key
+    regex: "sk-ant-[a-zA-Z0-9_-]{40,}"
+    severity: critical
+    description: Anthropic API key for Claude access
+
+  # ── Twilio ───────────────────────────────────────────────────────────
+  - name: Twilio API Key
+    regex: "SK[a-f0-9]{32}"
+    severity: high
+    description: Twilio API key (SK prefix + 32 hex chars)
+
+  - name: Twilio Account SID
+    regex: "AC[a-f0-9]{32}"
+    severity: medium
+    description: Twilio Account SID (not secret but sensitive identifier)
+
+  # ── SendGrid ─────────────────────────────────────────────────────────
+  - name: SendGrid API Key
+    regex: "SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}"
+    severity: critical
+    description: SendGrid API key for email sending
+
+  # ── Supabase ─────────────────────────────────────────────────────────
+  - name: Supabase Service Role Key
+    regex: "(?i)(supabase_service_role_key|SUPABASE_SERVICE_KEY)[\"'\\s=:]+eyJ[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+"
+    severity: critical
+    description: Supabase service role JWT — bypasses Row Level Security
+
+  - name: Supabase Anon Key (exposed)
+    regex: "(?i)supabase_anon_key[\"'\\s=:]+eyJ[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+"
+    severity: medium
+    description: Supabase anonymous key — public but sensitive in server context
+
+  # ── Firebase ─────────────────────────────────────────────────────────
+  - name: Firebase Server Key
+    regex: "AAAA[a-zA-Z0-9_-]{7,}:[a-zA-Z0-9_-]{140,}"
+    severity: critical
+    description: Firebase Cloud Messaging server key
+
+  # ── Databricks ───────────────────────────────────────────────────────
+  - name: Databricks Access Token
+    regex: "dapi[a-f0-9]{32}"
+    severity: high
+    description: Databricks personal access token
+
+  # ── npm / PyPI / Docker ──────────────────────────────────────────────
+  - name: npm Access Token
+    regex: "npm_[a-zA-Z0-9]{36}"
+    severity: critical
+    description: npm registry authentication token
+
+  - name: PyPI API Token
+    regex: "pypi-[a-zA-Z0-9_-]{50,}"
+    severity: critical
+    description: PyPI package repository API token
+
+  - name: Docker Hub Access Token
+    regex: "dckr_pat_[a-zA-Z0-9_-]{20,}"
+    severity: high
+    description: Docker Hub personal access token
+
+  # ── JWT / Bearer ─────────────────────────────────────────────────────
+  - name: JSON Web Token
+    regex: "eyJ[a-zA-Z0-9_-]{10,}\\.[a-zA-Z0-9_-]{10,}\\.[a-zA-Z0-9_-]{10,}"
+    severity: medium
+    description: JWT token (may contain sensitive claims)
+
+  - name: Bearer Token
+    regex: "Bearer\\s+[a-zA-Z0-9_-]{20,}"
+    severity: medium
+    description: Authorization Bearer token in header format (entropy-validated in TypeScript layer)
+
+  # ── SSH / PGP ────────────────────────────────────────────────────────
+  - name: RSA Private Key
+    regex: "-----BEGIN RSA PRIVATE KEY-----"
+    severity: critical
+    description: PEM-encoded RSA private key header
+
+  - name: DSA Private Key
+    regex: "-----BEGIN DSA PRIVATE KEY-----"
+    severity: critical
+    description: PEM-encoded DSA private key header
+
+  - name: EC Private Key
+    regex: "-----BEGIN EC PRIVATE KEY-----"
+    severity: critical
+    description: PEM-encoded Elliptic Curve private key header
+
+  - name: OpenSSH Private Key
+    regex: "-----BEGIN OPENSSH PRIVATE KEY-----"
+    severity: critical
+    description: OpenSSH format private key header
+
+  - name: PGP Private Key Block
+    regex: "-----BEGIN PGP PRIVATE KEY BLOCK-----"
+    severity: critical
+    description: PGP/GPG private key block header
+
+  # ── Hashicorp Vault ──────────────────────────────────────────────────
+  - name: Vault Token
+    regex: "hvs\\.[a-zA-Z0-9_-]{24,}"
+    severity: critical
+    description: HashiCorp Vault service token
+
+  - name: Vault Batch Token
+    regex: "hvb\\.[a-zA-Z0-9_-]{24,}"
+    severity: high
+    description: HashiCorp Vault batch token
+
+  # ── Datadog ──────────────────────────────────────────────────────────
+  - name: Datadog API Key
+    regex: "(?i)(dd_api_key|datadog_api_key)[\"'\\s=:]+[a-f0-9]{32}"
+    severity: high
+    description: Datadog API key for monitoring data access
+
+  # ── Mailgun ──────────────────────────────────────────────────────────
+  - name: Mailgun API Key
+    regex: "key-[a-f0-9]{32}"
+    severity: high
+    description: Mailgun API key for email service
+
+  # ── Heroku ───────────────────────────────────────────────────────────
+  - name: Heroku API Key
+    regex: "(?i)(heroku_api_key|HEROKU_API_KEY)[\"'\\s=:]+[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}"
+    severity: high
+    description: Heroku platform API key (UUID format)
+
+  # ── Shopify ──────────────────────────────────────────────────────────
+  - name: Shopify Access Token
+    regex: "shpat_[a-f0-9]{32}"
+    severity: high
+    description: Shopify Admin API access token
+
+  - name: Shopify Custom App Token
+    regex: "shpca_[a-f0-9]{32}"
+    severity: high
+    description: Shopify custom app access token
+
+  - name: Shopify Private App Password
+    regex: "shppa_[a-f0-9]{32}"
+    severity: high
+    description: Shopify private app password
+
+  # ── Linear ───────────────────────────────────────────────────────────
+  - name: Linear API Key
+    regex: "lin_api_[a-zA-Z0-9]{40,}"
+    severity: high
+    description: Linear project management API key
+
+  # ── Vercel ───────────────────────────────────────────────────────────
+  - name: Vercel Access Token
+    regex: "(?i)(vercel_token|VERCEL_TOKEN)[\"'\\s=:]+[a-zA-Z0-9]{24,}"
+    severity: high
+    description: Vercel platform access token
+
+  # ── Generic High-Entropy Secrets ─────────────────────────────────────
+  - name: Generic API Key Assignment
+    regex: "(?i)(api_key|apikey|api_secret|secret_key)[\"'\\s=:]+[a-zA-Z0-9_-]{20,}"
+    severity: medium
+    description: Generic API key or secret in assignment context
+
+  - name: Password in Config
+    regex: "(?i)(password|passwd|pwd)[\"'\\s=:]+[^\\s\"']{8,}"
+    severity: medium
+    description: Password value in configuration or code
+
+  - name: Private Key Variable
+    regex: "(?i)(private_key|privatekey)[\"'\\s=:]+[a-zA-Z0-9/+=_-]{20,}"
+    severity: high
+    description: Private key value in variable assignment

package/patterns/dangerous-commands.yaml

@@ -0,0 +1,167 @@
+# ChainWall — Dangerous Command Detection Patterns
+#
+# Shell commands that could cause system damage, data loss, or compromise.
+# Reference database. Consumed by security-audit.sh for project scanning.
+# Critical patterns are hardcoded in hooks for real-time enforcement.
+#
+# Fields:
+#   name:        Human-readable pattern name
+#   regex:       POSIX ERE with `(?i)` prefix convention (stripped by scanner, replaced with -i flag)
+#   severity:    critical | high | medium
+#   description: What this command does and why it's dangerous
+#   scope:       command  (only checked against tool_input.command)
+
+patterns:
+
+  # ── Destructive File Operations ──────────────────────────────────────
+  - name: Recursive Force Delete
+    regex: "rm\\s+-[^\\s]*r[^\\s]*f|rm\\s+-[^\\s]*f[^\\s]*r"
+    severity: critical
+    description: "rm with both -r and -f flags — recursive force deletion, data loss risk"
+    scope: command
+
+  - name: Shred File
+    regex: "shred\\s+"
+    severity: high
+    description: "Securely overwrites file content — irreversible data destruction"
+    scope: command
+
+  # ── Remote Code Execution ────────────────────────────────────────────
+  - name: Curl Pipe to Shell
+    regex: "(curl|wget)\\s.+\\|\\s*(bash|sh|zsh|ksh|dash|fish|python|perl|ruby|node)"
+    severity: critical
+    description: "Downloads and executes remote code — classic malware delivery vector"
+    scope: command
+
+  - name: Eval from Variable
+    regex: "eval\\s+\\$"
+    severity: high
+    description: "Evaluates shell variable as code — command injection risk"
+    scope: command
+
+  - name: Base64 Decode Execute
+    regex: "base64\\s+(-d|--decode).*\\|\\s*(bash|sh|eval)"
+    severity: critical
+    description: "Decodes and executes base64 content — obfuscated code execution"
+    scope: command
+
+  # ── Dangerous Permissions ────────────────────────────────────────────
+  - name: World-Writable Permissions
+    regex: "chmod\\s+777"
+    severity: high
+    description: "Sets world-readable/writable/executable — security misconfiguration"
+    scope: command
+
+  - name: SetUID Bit
+    regex: "chmod\\s+[u+]*s|chmod\\s+[0-7]*4[0-7]{3}"
+    severity: critical
+    description: "Sets SUID/SGID bit — privilege escalation vector"
+    scope: command
+
+  # ── Disk/Device Operations ───────────────────────────────────────────
+  - name: DD to Device
+    regex: "dd\\s.+of=/dev/"
+    severity: critical
+    description: "Writes directly to block device — potential disk destruction"
+    scope: command
+
+  - name: Filesystem Format
+    regex: "mkfs"
+    severity: critical
+    description: "Formats a filesystem — complete data loss on target device"
+    scope: command
+
+  - name: Direct Device Write
+    regex: ">/dev/(sd|hd|nvme|vd|xvd)"
+    severity: critical
+    description: "Redirects output to block device — disk corruption risk"
+    scope: command
+
+  # ── Network Exfiltration ─────────────────────────────────────────────
+  - name: Netcat Listener
+    regex: "nc\\s+(-l|-p|--listen)"
+    severity: high
+    description: "Opens network listener — potential reverse shell or data exfiltration"
+    scope: command
+
+  - name: Reverse Shell
+    regex: "/dev/tcp/|bash\\s+-i\\s+>&|/dev/udp/"
+    severity: critical
+    description: "Bash reverse shell pattern — remote access backdoor"
+    scope: command
+
+  - name: SSH Tunnel
+    regex: "ssh\\s+.*-[RLD]\\s+[0-9]+:"
+    severity: medium
+    description: "SSH port forwarding — potential data exfiltration tunnel"
+    scope: command
+
+  # ── System Modification ──────────────────────────────────────────────
+  - name: Crontab Modification
+    regex: "crontab\\s+(-e|-r|-l)|echo.*>>\\s*/etc/cron"
+    severity: high
+    description: "Modifies scheduled tasks — persistence mechanism"
+    scope: command
+
+  - name: Hosts File Modification
+    regex: ">/etc/hosts|>>\\s*/etc/hosts"
+    severity: high
+    description: "Modifies DNS resolution — potential traffic hijacking"
+    scope: command
+
+  - name: Sudoers Modification
+    regex: "visudo|>/etc/sudoers|>>\\s*/etc/sudoers"
+    severity: critical
+    description: "Modifies sudo permissions — privilege escalation"
+    scope: command
+
+  - name: Systemd Service Install
+    regex: "systemctl\\s+(enable|start).*\\.service|cp.*\\.service.*/etc/systemd/"
+    severity: high
+    description: "Installs or enables systemd service — persistence mechanism"
+    scope: command
+
+  # ── Container Escape ─────────────────────────────────────────────────
+  - name: Docker Socket Mount
+    regex: "docker.*-v.*/var/run/docker\\.sock"
+    severity: critical
+    description: "Mounts Docker socket — container escape / host access"
+    scope: command
+
+  - name: Privileged Container
+    regex: "docker\\s+run.*--privileged"
+    severity: critical
+    description: "Runs container in privileged mode — full host access"
+    scope: command
+
+  # ── Environment Manipulation ─────────────────────────────────────────
+  - name: LD_PRELOAD Injection
+    regex: "LD_PRELOAD="
+    severity: critical
+    description: "Sets LD_PRELOAD — shared library injection for code hijacking"
+    scope: command
+
+  - name: PATH Manipulation
+    regex: "export\\s+PATH=.*:\\."
+    severity: high
+    description: "Adds current directory to PATH — binary hijacking risk"
+    scope: command
+
+  # ── History/Log Tampering ────────────────────────────────────────────
+  - name: History Deletion
+    regex: "history\\s+(-c|-d)|>.*\\.bash_history|>.*\\.zsh_history|unset\\s+HISTFILE"
+    severity: high
+    description: "Clears or disables shell history — anti-forensics technique"
+    scope: command
+
+  - name: Log Tampering
+    regex: ">/var/log/|truncate.*(/var/log/|/var/audit/)"
+    severity: high
+    description: "Clears system logs — anti-forensics technique"
+    scope: command
+
+  - name: History File Deletion
+    regex: "history\\s+-c|>.*\\.bash_history"
+    severity: high
+    description: "Deletes bash history file — evidence destruction technique"
+    scope: command

package/patterns/pii.yaml

@@ -0,0 +1,95 @@
+# ChainWall — PII Detection Patterns
+#
+# Personally Identifiable Information patterns for Layer 5 detection.
+# Reference database. Consumed by security-audit.sh for project scanning.
+# Critical patterns are hardcoded in hooks for real-time enforcement.
+#
+# Fields:
+#   name:        Human-readable pattern name
+#   regex:       POSIX ERE with `(?i)` prefix convention (stripped by scanner, replaced with -i flag)
+#   severity:    critical | high | medium
+#   description: What PII this detects
+#   validation:  Optional extra validation logic (implemented in scanner)
+
+patterns:
+
+  # ── Government IDs ───────────────────────────────────────────────────
+  - name: US Social Security Number
+    regex: "[0-9]{3}-[0-9]{2}-[0-9]{4}"
+    severity: critical
+    description: "US SSN in XXX-XX-XXXX format — identity theft risk"
+    validation: "first_group_not_000_666_900plus"
+
+  - name: US SSN (No Dashes)
+    regex: "(?i)(ssn|social.?security)[\"'\\s=:]+[0-9]{9}"
+    severity: high
+    description: "US SSN as 9 continuous digits in labeled context"
+
+  - name: US EIN/Tax ID
+    regex: "(?i)(ein|tax.?id)[\"'\\s=:]+[0-9]{2}-[0-9]{7}"
+    severity: high
+    description: "US Employer Identification Number"
+
+  # ── Financial ────────────────────────────────────────────────────────
+  - name: Credit Card Number
+    regex: "[0-9]{4}[-\\s]?[0-9]{4}[-\\s]?[0-9]{4}[-\\s]?[0-9]{3,4}"
+    severity: critical
+    description: "15-16 digit credit/debit card number with optional separators (Amex=15, others=16)"
+
+  - name: Bank Account Number
+    regex: "(?i)(account.?num|acct.?no|bank.?account)[\"'\\s=:]+[0-9]{8,17}"
+    severity: high
+    description: "Bank account number in labeled context"
+
+  - name: Routing Number
+    regex: "(?i)(routing.?num|aba.?num|routing.?no)[\"'\\s=:]+[0-9]{9}"
+    severity: high
+    description: "US bank routing number (ABA) in labeled context"
+
+  - name: IBAN
+    regex: "[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}"
+    severity: high
+    description: "International Bank Account Number"
+
+  # ── Personal Contact ─────────────────────────────────────────────────
+  - name: Email with PII Context
+    regex: "(?i)(patient|ssn|medical|diagnosis|prescription).*[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
+    severity: medium
+    description: "Email address in medical/PII context — HIPAA risk"
+
+  - name: Phone in PII Context
+    regex: "(?i)(patient|ssn|medical|dob|birth).*[0-9]{3}[-.]?[0-9]{3}[-.]?[0-9]{4}"
+    severity: medium
+    description: "Phone number in medical/PII context"
+
+  # ── Medical/Health ───────────────────────────────────────────────────
+  - name: Medical Record Number
+    regex: "(?i)(mrn|medical.?record|patient.?id)[\"'\\s=:]+[A-Z0-9]{6,20}"
+    severity: high
+    description: "Medical record number — HIPAA protected"
+
+  - name: DEA Number
+    regex: "[A-Z][A-Z9][0-9]{7}"
+    severity: high
+    description: "DEA registration number for controlled substances"
+
+  # ── Identity Documents ───────────────────────────────────────────────
+  - name: Passport Number
+    regex: "(?i)(passport)[\"'\\s=:]+[A-Z0-9]{6,12}"
+    severity: high
+    description: "Passport number in labeled context"
+
+  - name: Driver License
+    regex: "(?i)(driver.?licen[sc]e|dl.?num)[\"'\\s=:]+[A-Z0-9]{5,15}"
+    severity: high
+    description: "Driver's license number in labeled context"
+
+  - name: Date of Birth
+    regex: "(?i)(dob|date.?of.?birth|birthdate)[\"'\\s=:]+[0-9]{1,4}[-/][0-9]{1,2}[-/][0-9]{1,4}"
+    severity: medium
+    description: "Date of birth in labeled context"
+
+  - name: Medicare ID
+    regex: "[0-9]{4}-[0-9]{3}-[0-9]{4}-[0-9]{3}"
+    severity: high
+    description: "US Medicare Beneficiary Identifier — HIPAA protected"