clawsec 0.0.1

package/rules/builtin/database-nosql.yaml

@@ -0,0 +1,58 @@
+# NoSQL Database Security Rules
+# Protects against destructive NoSQL operations
+
+name: database-nosql
+description: Prevents destructive NoSQL database operations
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: block
+    shell:
+      enabled: true
+      patterns:
+        # MongoDB
+        - "db.dropDatabase()"
+        - "db.collection.drop()"
+        - "db.dropAllUsers()"
+        - "db.collection.deleteMany({})"
+        - "db.collection.remove({})"
+        - "mongorestore --drop"
+
+        # Redis
+        - "FLUSHALL"
+        - "FLUSHDB"
+        - "redis-cli FLUSHALL"
+        - "redis-cli FLUSHDB"
+        - "DEL *"
+
+        # Elasticsearch
+        - "DELETE /_all"
+        - "DELETE /*"
+        - "curl.*DELETE.*_all"
+        - "curl.*DELETE.*\\*"
+
+        # Cassandra
+        - "DROP KEYSPACE"
+        - "DROP TABLE"
+        - "TRUNCATE"
+
+        # DynamoDB
+        - "aws dynamodb delete-table"
+        - "aws dynamodb batch-write-item"
+
+        # CouchDB
+        - "curl.*DELETE.*/.*/_all_docs"
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "MONGODB_URI"
+      - "MONGO_PASSWORD"
+      - "REDIS_PASSWORD"
+      - "REDIS_URL"
+      - "ELASTICSEARCH_PASSWORD"

package/rules/builtin/database-sql.yaml

@@ -0,0 +1,62 @@
+# Database SQL Security Rules
+# Protects against destructive SQL operations
+
+name: database-sql
+description: Prevents destructive SQL operations across databases
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: block
+    shell:
+      enabled: true
+      patterns:
+        # Table operations
+        - "DROP TABLE"
+        - "DROP DATABASE"
+        - "DROP SCHEMA"
+        - "DROP INDEX"
+        - "DROP VIEW"
+        - "DROP FUNCTION"
+        - "DROP PROCEDURE"
+        - "DROP TRIGGER"
+
+        # Data deletion
+        - "TRUNCATE TABLE"
+        - "DELETE FROM .* WHERE 1=1"
+        - "DELETE FROM .* WHERE true"
+        - "DELETE FROM [^W]*$"  # DELETE without WHERE
+
+        # Dangerous updates
+        - "UPDATE .* SET .* WHERE 1=1"
+        - "UPDATE .* SET .* WHERE true"
+
+        # Schema modifications
+        - "ALTER TABLE .* DROP"
+        - "ALTER DATABASE"
+
+        # User/Permission operations
+        - "DROP USER"
+        - "DROP ROLE"
+        - "REVOKE ALL"
+
+        # MySQL specific
+        - "FLUSH PRIVILEGES"
+        - "RESET MASTER"
+
+        # PostgreSQL specific
+        - "DROP OWNED BY"
+        - "REASSIGN OWNED"
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "DATABASE_URL"
+      - "DB_PASSWORD"
+      - "MYSQL_ROOT_PASSWORD"
+      - "POSTGRES_PASSWORD"
+      - "PGPASSWORD"

package/rules/builtin/development-env.yaml

@@ -0,0 +1,67 @@
+# Development Environment Security Rules
+# Balanced security for development environments
+
+name: development-env
+description: Balanced security rules for development environments
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: high
+    action: confirm  # Confirm instead of block for dev
+    shell:
+      enabled: true
+      patterns:
+        - "rm -rf /"
+        - "rm -rf /*"
+        - "dd if=/dev/zero"
+        - "mkfs"
+    cloud:
+      enabled: true
+      patterns:
+        - ".*delete.*--force"
+        - ".*destroy.*-auto-approve"
+    code:
+      enabled: true
+
+  secrets:
+    enabled: true
+    severity: high
+    action: warn  # Warn instead of block for dev
+    patterns:
+      # Only catch real production secrets
+      - "sk_live_"  # Stripe live keys
+      - "AKIA"  # AWS production keys
+      - "-----BEGIN.*PRIVATE KEY-----"
+
+  website:
+    enabled: true
+    mode: blocklist
+    severity: medium
+    action: warn
+    blocklist:
+      - "*.malware.com"
+      - "*.phishing.com"
+    allowlist:
+      - "localhost"
+      - "127.0.0.1"
+      - "*.local"
+
+  purchase:
+    enabled: true
+    severity: high
+    action: confirm  # Confirm instead of block
+    spendLimits:
+      perTransaction: 100
+      daily: 500
+
+  exfiltration:
+    enabled: true
+    severity: medium
+    action: warn
+
+  sanitization:
+    enabled: true
+    severity: medium
+    action: warn

package/rules/builtin/docker.yaml

@@ -0,0 +1,57 @@
+# Docker Security Rules
+# Protects against dangerous Docker operations
+
+name: docker
+description: Prevents destructive Docker operations and insecure practices
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: high
+    action: confirm
+    shell:
+      enabled: true
+      patterns:
+        # Container removal
+        - "docker rm -f"
+        - "docker rm --force"
+        - "docker container rm -f"
+        - "docker container prune"
+
+        # Image removal
+        - "docker rmi -f"
+        - "docker image rm -f"
+        - "docker image prune -a"
+
+        # Volume removal
+        - "docker volume rm"
+        - "docker volume prune"
+
+        # Network removal
+        - "docker network rm"
+        - "docker network prune"
+
+        # System cleanup
+        - "docker system prune"
+        - "docker system prune -a"
+
+        # Dangerous run options
+        - "docker run --privileged"
+        - "docker run --cap-add=ALL"
+        - "docker run -v /:/host"
+        - "docker run --pid=host"
+        - "docker run --network=host"
+
+        # Compose operations
+        - "docker-compose down -v"
+        - "docker compose down -v"
+        - "docker-compose rm -f"
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "DOCKER_AUTH_CONFIG"
+      - "DOCKER_PASSWORD"

package/rules/builtin/filesystem.yaml

@@ -0,0 +1,71 @@
+# Filesystem Security Rules
+# Protects against dangerous filesystem operations
+
+name: filesystem
+description: Prevents destructive filesystem operations
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: block
+    shell:
+      enabled: true
+      patterns:
+        # Recursive deletion
+        - "rm -rf /"
+        - "rm -rf /*"
+        - "rm -rf ~"
+        - "rm -rf $HOME"
+        - "rm -rf /home"
+        - "rm -rf /var"
+        - "rm -rf /etc"
+        - "rm -rf /usr"
+        - "rm -rf --no-preserve-root"
+
+        # Disk formatting
+        - "mkfs"
+        - "mkfs.ext4"
+        - "mkfs.xfs"
+        - "mkfs.btrfs"
+
+        # Disk writing
+        - "dd if=/dev/zero of=/dev/"
+        - "dd if=/dev/random of=/dev/"
+        - "dd if=.* of=/dev/sd"
+        - "dd if=.* of=/dev/nvme"
+
+        # Shredding
+        - "shred -u"
+        - "shred -z"
+
+        # Permission changes
+        - "chmod -R 777 /"
+        - "chmod -R 000 /"
+        - "chown -R.*:.*/"
+
+        # Symbolic link attacks
+        - "ln -sf /dev/null"
+
+        # System directories
+        - "rm -rf /boot"
+        - "rm -rf /bin"
+        - "rm -rf /sbin"
+        - "rm -rf /lib"
+
+    code:
+      enabled: true
+      patterns:
+        # Python
+        - "shutil.rmtree('/')"
+        - "os.remove("
+        - "pathlib.Path.unlink"
+
+        # Node.js
+        - "fs.rm(.*recursive.*true)"
+        - "fs.rmSync(.*recursive.*true)"
+        - "rimraf"
+
+        # Go
+        - "os.RemoveAll("

package/rules/builtin/financial-pci.yaml

@@ -0,0 +1,61 @@
+# Financial/PCI-DSS Security Rules
+# PCI-DSS compliant security rules for financial applications
+
+name: financial-pci
+description: PCI-DSS compliant security rules for payment processing
+version: "1.0"
+
+rules:
+  purchase:
+    enabled: true
+    severity: critical
+    action: block
+    spendLimits:
+      perTransaction: 0  # Block all purchases
+      daily: 0
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      # Primary Account Numbers (PAN) - Credit/Debit cards
+      - "\\b4[0-9]{12}(?:[0-9]{3})?\\b"  # Visa
+      - "\\b5[1-5][0-9]{14}\\b"  # Mastercard
+      - "\\b3[47][0-9]{13}\\b"  # Amex
+      - "\\b6(?:011|5[0-9]{2})[0-9]{12}\\b"  # Discover
+      - "\\b3(?:0[0-5]|[68][0-9])[0-9]{11}\\b"  # Diners
+
+      # CVV/CVC
+      - "(?i)cvv\\s*[:=]\\s*[0-9]{3,4}"
+      - "(?i)cvc\\s*[:=]\\s*[0-9]{3,4}"
+      - "(?i)security[_\\s-]?code\\s*[:=]\\s*[0-9]{3,4}"
+
+      # Expiration dates
+      - "(?i)exp(?:iry|iration)?[_\\s-]?date\\s*[:=]"
+
+      # Bank account numbers
+      - "(?i)account[_\\s-]?number\\s*[:=]\\s*[0-9]{8,17}"
+      - "(?i)routing[_\\s-]?number\\s*[:=]\\s*[0-9]{9}"
+
+      # IBAN
+      - "\\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}([A-Z0-9]?){0,16}\\b"
+
+      # SWIFT/BIC
+      - "\\b[A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?\\b"
+
+      # Payment processor secrets
+      - "sk_live_[a-zA-Z0-9]{24,}"  # Stripe
+      - "PAYPAL_CLIENT_SECRET"
+      - "BRAINTREE_PRIVATE_KEY"
+
+  exfiltration:
+    enabled: true
+    severity: critical
+    action: block
+
+  sanitization:
+    enabled: true
+    severity: critical
+    action: block
+    redactMatches: true

package/rules/builtin/gcp-security.yaml

@@ -0,0 +1,57 @@
+# GCP Security Rules
+# Protects against dangerous Google Cloud operations
+
+name: gcp-security
+description: Prevents destructive GCP operations
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: block
+    cloud:
+      enabled: true
+      patterns:
+        # Compute Engine
+        - "gcloud compute instances delete"
+        - "gcloud compute disks delete"
+        - "gcloud compute images delete"
+        - "gcloud compute snapshots delete"
+
+        # Cloud Storage
+        - "gsutil rm -r"
+        - "gsutil rb"
+        - "gcloud storage rm --recursive"
+        - "gcloud storage buckets delete"
+
+        # IAM
+        - "gcloud iam service-accounts delete"
+        - "gcloud iam roles delete"
+
+        # Cloud SQL
+        - "gcloud sql instances delete"
+        - "gcloud sql databases delete"
+        - "gcloud sql backups delete"
+
+        # Kubernetes Engine
+        - "gcloud container clusters delete"
+        - "gcloud container node-pools delete"
+
+        # Cloud Functions
+        - "gcloud functions delete"
+
+        # Cloud Run
+        - "gcloud run services delete"
+
+        # Firestore/Datastore
+        - "gcloud firestore databases delete"
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "GOOGLE_APPLICATION_CREDENTIALS"
+      - "type.*service_account"
+      - "private_key_id"

package/rules/builtin/git-operations.yaml

@@ -0,0 +1,68 @@
+# Git Operations Security Rules
+# Protects against dangerous Git operations
+
+name: git-operations
+description: Prevents destructive Git operations that could cause data loss
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: confirm
+    shell:
+      enabled: true
+      patterns:
+        # Force push
+        - "git push --force"
+        - "git push -f"
+        - "git push --force-with-lease"
+
+        # Hard reset
+        - "git reset --hard"
+        - "git checkout -- ."
+        - "git checkout ."
+        - "git restore --staged --worktree"
+
+        # Clean operations
+        - "git clean -f"
+        - "git clean -fd"
+        - "git clean -fx"
+        - "git clean -fdx"
+
+        # Rebase operations
+        - "git rebase -i"
+        - "git rebase --interactive"
+
+        # Branch deletion
+        - "git branch -D"
+        - "git branch --delete --force"
+        - "git push origin --delete"
+        - "git push origin :"
+
+        # Stash operations
+        - "git stash drop"
+        - "git stash clear"
+
+        # Filter-branch (history rewriting)
+        - "git filter-branch"
+        - "git filter-repo"
+
+        # Submodule removal
+        - "git submodule deinit"
+
+        # Reflog expiration
+        - "git reflog expire"
+        - "git gc --prune"
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "ghp_[a-zA-Z0-9]{36}"  # GitHub PAT
+      - "gho_[a-zA-Z0-9]{36}"  # GitHub OAuth
+      - "ghu_[a-zA-Z0-9]{36}"  # GitHub User
+      - "ghs_[a-zA-Z0-9]{36}"  # GitHub Server
+      - "ghr_[a-zA-Z0-9]{36}"  # GitHub Refresh
+      - "glpat-[a-zA-Z0-9-]{20}"  # GitLab PAT

package/rules/builtin/healthcare-hipaa.yaml

@@ -0,0 +1,64 @@
+# Healthcare/HIPAA Security Rules
+# Strict security rules for healthcare applications
+
+name: healthcare-hipaa
+description: HIPAA-compliant security rules for healthcare applications
+version: "1.0"
+
+rules:
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      # Medical Record Numbers
+      - "\\bMRN[:\\s]*[0-9]{6,12}\\b"
+
+      # Patient identifiers
+      - "(?i)patient[_\\s-]?id\\s*[:=]"
+      - "(?i)ssn\\s*[:=]"
+
+      # Health insurance IDs
+      - "(?i)insurance[_\\s-]?id\\s*[:=]"
+      - "(?i)member[_\\s-]?id\\s*[:=]"
+      - "(?i)policy[_\\s-]?number\\s*[:=]"
+
+      # HL7/FHIR
+      - "(?i)hl7[_\\s-]?message"
+      - "(?i)fhir[_\\s-]?resource"
+
+      # PHI indicators
+      - "(?i)protected[_\\s-]?health"
+      - "(?i)medical[_\\s-]?record"
+      - "(?i)diagnosis[_\\s-]?code"
+      - "(?i)icd[_\\s-]?10"
+
+      # SSN
+      - "\\b\\d{3}-\\d{2}-\\d{4}\\b"
+
+      # Date of birth
+      - "(?i)date[_\\s-]?of[_\\s-]?birth\\s*[:=]"
+      - "(?i)dob\\s*[:=]"
+
+  exfiltration:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "curl.*patient"
+      - "curl.*medical"
+      - "wget.*health"
+
+  website:
+    enabled: true
+    mode: allowlist
+    allowlist:
+      - "*.healthcare.gov"
+      - "*.hl7.org"
+      - "*.fhir.org"
+
+  sanitization:
+    enabled: true
+    severity: critical
+    action: block
+    redactMatches: true

package/rules/builtin/kubernetes.yaml

@@ -0,0 +1,60 @@
+# Kubernetes Security Rules
+# Protects against dangerous Kubernetes operations
+
+name: kubernetes
+description: Prevents destructive Kubernetes operations
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: confirm
+    cloud:
+      enabled: true
+      patterns:
+        # Namespace Operations
+        - "kubectl delete namespace"
+        - "kubectl delete ns"
+        - "kubectl delete -n kube-system"
+        - "kubectl delete -n default --all"
+
+        # Cluster-wide deletions
+        - "kubectl delete --all"
+        - "kubectl delete -A"
+        - "kubectl delete --all-namespaces"
+
+        # Critical resources
+        - "kubectl delete deployment"
+        - "kubectl delete statefulset"
+        - "kubectl delete daemonset"
+        - "kubectl delete pvc"
+        - "kubectl delete pv"
+        - "kubectl delete secret"
+        - "kubectl delete configmap"
+
+        # Force deletions
+        - "kubectl delete --force"
+        - "kubectl delete --grace-period=0"
+
+        # Node operations
+        - "kubectl delete node"
+        - "kubectl drain"
+        - "kubectl cordon"
+
+        # RBAC
+        - "kubectl delete clusterrole"
+        - "kubectl delete clusterrolebinding"
+        - "kubectl delete serviceaccount"
+
+        # CRDs
+        - "kubectl delete crd"
+        - "kubectl delete customresourcedefinition"
+
+  website:
+    enabled: true
+    mode: allowlist
+    allowlist:
+      - "kubernetes.io"
+      - "k8s.io"
+      - "helm.sh"

package/rules/builtin/messaging-services.yaml

@@ -0,0 +1,53 @@
+# Messaging Services Security Rules
+# Protects messaging service credentials
+
+name: messaging-services
+description: Security rules for messaging and communication services
+version: "1.0"
+
+rules:
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      # Slack
+      - "xoxb-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}"
+      - "xoxp-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}"
+      - "xoxa-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}"
+      - "xoxr-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}"
+      - "SLACK_BOT_TOKEN"
+      - "SLACK_WEBHOOK_URL"
+
+      # Discord
+      - "DISCORD_TOKEN"
+      - "DISCORD_WEBHOOK"
+      - "[MN][A-Za-z\\d]{23,}\\.[\\w-]{6}\\.[\\w-]{27}"
+
+      # Telegram
+      - "TELEGRAM_BOT_TOKEN"
+      - "[0-9]+:AA[0-9A-Za-z_-]{33}"
+
+      # Twilio
+      - "TWILIO_AUTH_TOKEN"
+      - "TWILIO_ACCOUNT_SID"
+
+      # SendGrid
+      - "SENDGRID_API_KEY"
+      - "SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}"
+
+      # Mailchimp
+      - "MAILCHIMP_API_KEY"
+      - "[a-f0-9]{32}-us[0-9]{1,2}"
+
+      # Postmark
+      - "POSTMARK_API_TOKEN"
+
+      # Mailgun
+      - "MAILGUN_API_KEY"
+
+      # PagerDuty
+      - "PAGERDUTY_API_KEY"
+
+      # Intercom
+      - "INTERCOM_ACCESS_TOKEN"