clawsec 0.0.1

package/rules/builtin/terraform.yaml

@@ -0,0 +1,51 @@
+# Terraform Security Rules
+# Protects against dangerous Terraform operations
+
+name: terraform
+description: Prevents destructive Terraform operations
+version: "1.0"
+
+rules:
+  destructive:
+    enabled: true
+    severity: critical
+    action: confirm
+    cloud:
+      enabled: true
+      patterns:
+        # Destroy operations
+        - "terraform destroy"
+        - "terraform destroy -auto-approve"
+        - "terraform apply -destroy"
+
+        # Forced replacements
+        - "terraform taint"
+        - "terraform apply -replace"
+
+        # State manipulation
+        - "terraform state rm"
+        - "terraform state mv"
+        - "terraform import"
+        - "terraform workspace delete"
+
+        # Force unlock
+        - "terraform force-unlock"
+
+        # OpenTofu equivalents
+        - "tofu destroy"
+        - "tofu destroy -auto-approve"
+        - "tofu state rm"
+
+        # Terragrunt
+        - "terragrunt destroy"
+        - "terragrunt destroy-all"
+        - "terragrunt run-all destroy"
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      - "TF_VAR_"
+      - "backend.*access_key"
+      - "backend.*secret_key"

package/rules/builtin/web-security.yaml

@@ -0,0 +1,62 @@
+# Web Application Security Rules
+# Prevents common web security vulnerabilities
+
+name: web-security
+description: Security rules for web application development
+version: "1.0"
+
+rules:
+  sanitization:
+    enabled: true
+    severity: high
+    action: block
+    categories:
+      instructionOverride: true
+      systemLeak: true
+      jailbreak: true
+      encodedPayload: true
+
+  secrets:
+    enabled: true
+    severity: critical
+    action: block
+    patterns:
+      # Session secrets
+      - "SESSION_SECRET"
+      - "COOKIE_SECRET"
+      - "JWT_SECRET"
+
+      # CORS
+      - "ACCESS_CONTROL_ALLOW_ORIGIN.*\\*"
+
+      # Encryption keys
+      - "ENCRYPTION_KEY"
+      - "CRYPTO_KEY"
+      - "SECRET_KEY_BASE"
+
+      # OAuth
+      - "OAUTH_CLIENT_SECRET"
+      - "GOOGLE_CLIENT_SECRET"
+      - "FACEBOOK_APP_SECRET"
+      - "TWITTER_CONSUMER_SECRET"
+
+      # Database
+      - "DATABASE_URL"
+      - "MONGODB_URI"
+      - "REDIS_URL"
+
+  website:
+    enabled: true
+    mode: blocklist
+    severity: high
+    blocklist:
+      # Known malicious domains (examples)
+      - "*.malware.com"
+      - "*.phishing.com"
+      - "evil*.com"
+
+      # Common honeypot domains
+      - "*.local"
+      - "*.test"
+      - "localhost"
+      - "127.0.0.1"