code-secret-handler 1.0.0

package/dist/scanner/rules/network.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkRules = void 0;
+/**
+ * Network, infrastructure, and communication credential patterns.
+ * Covers: SMTP, proxy, VPN, Twilio SMS, mail servers, webhooks, etc.
+ */
+exports.networkRules = [
+    // ── SMTP / Email server ─────────────────────────────────────────────────────────
+    {
+        id: 'smtp-password',
+        description: 'SMTP server password or auth credentials',
+        pattern: /(?:smtp[_-]?(?:pass(?:word)?|auth[_-]?pass(?:word)?)|SMTP_PASSWORD|MAIL_PASSWORD|EMAIL_PASSWORD)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SMTP_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'smtp-uri',
+        description: 'SMTP URI with embedded credentials',
+        pattern: /(?:smtp[_-]?(?:url|uri)|SMTP_URL|EMAIL_SERVER|MAIL_URL)\s*[:=]\s*['"\`](smtps?:\/\/[^'"\`\s]+:[^'"\`\s]+@[^'"\`\s]+)['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SMTP_URL',
+        severity: 'critical',
+    },
+    {
+        id: 'smtp-user',
+        description: 'SMTP username assignment',
+        pattern: /(?:smtp[_-]?user(?:name)?|SMTP_USER(?:NAME)?|MAIL_USER(?:NAME)?|EMAIL_USER(?:NAME)?)\s*[:=]\s*['"\`]([^'"\`\n]{2,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SMTP_USER',
+        severity: 'medium',
+    },
+    // ── Proxy / VPN ───────────────────────────────────────────────────────────────
+    {
+        id: 'proxy-url-with-creds',
+        description: 'Proxy URL with embedded username/password',
+        pattern: /(?:http[s]?[_-]?proxy|proxy[_-]?url|HTTPS?_PROXY|ALL_PROXY)\s*[:=]\s*['"\`](https?:\/\/[^'"\`\s]+:[^'"\`\s]+@[^'"\`\s]+)['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'PROXY_URL',
+        severity: 'critical',
+    },
+    {
+        id: 'proxy-password',
+        description: 'Proxy server password',
+        pattern: /(?:proxy[_-]?pass(?:word)?|PROXY_PASSWORD)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'PROXY_PASSWORD',
+        severity: 'critical',
+    },
+    // ── CI/CD secrets ──────────────────────────────────────────────────────────────
+    {
+        id: 'ci-deploy-token',
+        description: 'CI/CD deploy token or secret',
+        pattern: /(?:ci[_-]?(?:deploy[_-]?)?(?:token|secret|key)|deploy[_-]?(?:token|key|secret)|DEPLOY_TOKEN|CI_DEPLOY_TOKEN)\s*[:=]\s*['"\`]([A-Za-z0-9\-_]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'DEPLOY_TOKEN',
+        severity: 'critical',
+    },
+    {
+        id: 'github-actions-secret',
+        description: 'GitHub Actions secret reference used as a hardcoded value',
+        pattern: /(?:ACTIONS_RUNNER_TOKEN|ACTIONS_ID_TOKEN_REQUEST_TOKEN|ACTIONS_RUNTIME_TOKEN)\s*[:=]\s*['"\`]([A-Za-z0-9+/=]{20,})['"\`]/,
+        valueGroup: 1,
+        envKeyPrefix: 'GITHUB_ACTIONS_TOKEN',
+        severity: 'critical',
+    },
+    // ── Apple / iOS ───────────────────────────────────────────────────────────────
+    {
+        id: 'apple-private-key-id',
+        description: 'Apple APNs / App Store Connect Private Key ID',
+        pattern: /(?:apple[_-]?(?:private[_-]?)?key[_-]?id|APPLE_KEY_ID|APP_STORE_CONNECT_KEY_ID)\s*[:=]\s*['"\`]([A-Z0-9]{10})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'APPLE_KEY_ID',
+        severity: 'high',
+    },
+    {
+        id: 'apple-team-id',
+        description: 'Apple Developer Team ID',
+        pattern: /(?:apple[_-]?team[_-]?id|APPLE_TEAM_ID|TEAM_ID)\s*[:=]\s*['"\`]([A-Z0-9]{10})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'APPLE_TEAM_ID',
+        severity: 'medium',
+    },
+    // ── Webhook URLs (generic) ─────────────────────────────────────────────────────
+    {
+        id: 'generic-webhook-url',
+        description: 'Hardcoded webhook URL with embedded token',
+        pattern: /(?:webhook[_-]?url|WEBHOOK_URL)\s*[:=]\s*['"\`](https?:\/\/[^'"\`\s]{20,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'WEBHOOK_URL',
+        severity: 'high',
+    },
+    // ── LDAP credentials ───────────────────────────────────────────────────────────
+    {
+        id: 'ldap-bind-password',
+        description: 'LDAP bind password',
+        pattern: /(?:ldap[_-]?(?:bind[_-]?)?pass(?:word)?|LDAP_BIND_PASSWORD|LDAP_PASSWORD)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'LDAP_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'ldap-uri',
+        description: 'LDAP connection URI',
+        pattern: /(?:ldap[_-]?(?:url|uri)|LDAP_URL|LDAP_URI)\s*[:=]\s*['"\`](ldaps?:\/\/[^'"\`\s]+)['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'LDAP_URL',
+        severity: 'medium',
+    },
+    // Kubernetes Service Account Token
+    {
+        id: 'kubernetes-service-account-token',
+        description: 'Kubernetes Service Account Bearer Token (hardcoded JWT)',
+        pattern: /(?:k8s[_-]?(?:service[_-]?account[_-]?)?token|kube(?:rnetes)?[_-]?(?:service[_-]?account[_-]?)?token|K8S_TOKEN|KUBE_TOKEN)\s*[:=]\s*['"\`](eyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_.+\/=]+)['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'K8S_SERVICE_ACCOUNT_TOKEN',
+        severity: 'critical',
+    },
+    // Ansible Vault Password
+    {
+        id: 'ansible-vault-password',
+        description: 'Ansible Vault password variable',
+        pattern: /(?:ansible[_-]?vault[_-]?pass(?:word)?|ANSIBLE_VAULT_PASSWORD|vault[_-]?pass(?:word)?)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'ANSIBLE_VAULT_PASSWORD',
+        severity: 'critical',
+    },
+    // SonarQube / SonarCloud token
+    {
+        id: 'sonarqube-token',
+        description: 'SonarQube or SonarCloud analysis token (squ_ prefix)',
+        pattern: /(?:sonar(?:qube|cloud)?[_-]?token|SONAR_TOKEN|SONARQUBE_TOKEN)\s*[:=]\s*['"\`](squ_[A-Za-z0-9]{40,}|[A-Za-z0-9]{40,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SONAR_TOKEN',
+        severity: 'critical',
+    },
+    // CircleCI Personal API Token
+    {
+        id: 'circleci-personal-token',
+        description: 'CircleCI Personal API Token',
+        pattern: /(?:circleci[_-]?(?:personal[_-]?)?(?:api[_-]?)?token|CIRCLE_TOKEN|CIRCLECI_TOKEN)\s*[:=]\s*['"\`]([a-f0-9]{40})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'CIRCLECI_TOKEN',
+        severity: 'critical',
+    },
+    // ── Jenkins ───────────────────────────────────────────────────────────────────
+    {
+        id: 'jenkins-api-token',
+        description: 'Jenkins User API Token',
+        pattern: /(?:jenkins[_-]?(?:api[_-]?)?(?:token|key)|JENKINS_API_TOKEN|JENKINS_TOKEN)\s*[:=]\s*['"`]([A-Za-z0-9]{32,})['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'JENKINS_API_TOKEN',
+        severity: 'critical',
+    },
+    // ── Travis CI ─────────────────────────────────────────────────────────────────
+    {
+        id: 'travis-ci-token',
+        description: 'Travis CI API Token',
+        pattern: /(?:travis[_-]?(?:ci[_-]?)?(?:api[_-]?)?token|TRAVIS_TOKEN|TRAVIS_CI_TOKEN)\s*[:=]\s*['"`]([A-Za-z0-9\-_]{22,})['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'TRAVIS_CI_TOKEN',
+        severity: 'critical',
+    },
+];
+//# sourceMappingURL=network.js.map

package/dist/scanner/rules/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/scanner/rules/network.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACU,QAAA,YAAY,GAAW;IAClC,mFAAmF;IACnF;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,wIAAwI;QACjJ,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,6HAA6H;QACtI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,UAAU;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,4HAA4H;QACrI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,QAAQ;KACnB;IACD,iFAAiF;IACjF;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,iIAAiI;QAC1I,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,kFAAkF;QAC3F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;IACD,kFAAkF;IAClF;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,0JAA0J;QACnK,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,cAAc;QAC5B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,0HAA0H;QACnI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,sBAAsB;QACpC,QAAQ,EAAE,UAAU;KACrB;IACD,iFAAiF;IACjF;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,sHAAsH;QAC/H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,cAAc;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,sFAAsF;QAC/F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD,kFAAkF;IAClF;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,mFAAmF;QAC5F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,MAAM;KACjB;IACD,kFAAkF;IAClF;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,iHAAiH;QAC1H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,0FAA0F;QACnG,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,UAAU;QACxB,QAAQ,EAAE,QAAQ;KACnB;IAED,mCAAmC;IACnC;QACE,EAAE,EAAE,kCAAkC;QACtC,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,iNAAiN;QAC1N,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,2BAA2B;QACzC,QAAQ,EAAE,UAAU;KACrB;IACD,yBAAyB;IACzB;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,wBAAwB;QACtC,QAAQ,EAAE,UAAU;KACrB;IACD,+BAA+B;IAC/B;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,UAAU;KACrB;IACD,8BAA8B;IAC9B;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,wHAAwH;QACjI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;IAED,iFAAiF;IACjF;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,wBAAwB;QACrC,OAAO,EAAE,mHAAmH;QAC5H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,mBAAmB;QACjC,QAAQ,EAAE,UAAU;KACrB;IAED,iFAAiF;IACjF;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,sHAAsH;QAC/H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;CAEF,CAAC"}

package/dist/scanner/rules/privateKey.d.ts

@@ -0,0 +1,6 @@
+import { Rule } from '../../types';
+/**
+ * Generic PEM private key and certificate patterns.
+ */
+export declare const privateKeyRules: Rule[];
+//# sourceMappingURL=privateKey.d.ts.map

package/dist/scanner/rules/privateKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateKey.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/privateKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,IAAI,EAsDjC,CAAC"}

package/dist/scanner/rules/privateKey.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.privateKeyRules = void 0;
+/**
+ * Generic PEM private key and certificate patterns.
+ */
+exports.privateKeyRules = [
+    {
+        id: 'pem-private-key',
+        description: 'Generic PEM Private Key block',
+        pattern: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH |PKCS8 )?PRIVATE KEY-----[\s\S]{64,}-----END (?:RSA |EC |DSA |OPENSSH |PKCS8 )?PRIVATE KEY-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'PEM_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'pem-certificate',
+        description: 'PEM Certificate block',
+        pattern: /(-----BEGIN CERTIFICATE-----[\s\S]{64,}-----END CERTIFICATE-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'PEM_CERTIFICATE',
+        severity: 'medium',
+    },
+    {
+        id: 'pgp-private-key',
+        description: 'PGP / GPG Private Key Block',
+        pattern: /(-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]{64,}-----END PGP PRIVATE KEY BLOCK-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'PGP_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'pkcs12-password',
+        description: 'PKCS12 / PFX keystore password',
+        pattern: /(?:pkcs12[_-]?password|pfx[_-]?password|keystore[_-]?password|KEY_STORE_PASSWORD|PKCS12_PASSWORD)\s*[:=]\s*['"`]([^'"`\n]{4,})['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'PKCS12_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'ssl-key-path',
+        description: 'SSL/TLS private key file path',
+        pattern: /(?:ssl[_-]?key(?:[_-]?file)?|tls[_-]?key(?:[_-]?file)?|SSL_KEY_FILE)\s*[:=]\s*['"`]([^'"`\n]+\.(?:key|pem))['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SSL_KEY_FILE',
+        severity: 'medium',
+    },
+    // ── age encryption tool secret key ───────────────────────────────────────────
+    {
+        id: 'age-secret-key',
+        description: 'age encryption tool secret key (AGE-SECRET-KEY-1 Bech32 format)',
+        // age secret keys are Bech32-encoded and always start with AGE-SECRET-KEY-1
+        // followed by 58 uppercase alphanumeric Bech32 chars
+        pattern: /(AGE-SECRET-KEY-1[A-Z0-9]{58})/,
+        valueGroup: 1,
+        envKeyPrefix: 'AGE_SECRET_KEY',
+        severity: 'critical',
+    },
+];
+//# sourceMappingURL=privateKey.js.map

package/dist/scanner/rules/privateKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateKey.js","sourceRoot":"","sources":["../../../src/scanner/rules/privateKey.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACU,QAAA,eAAe,GAAW;IACrC;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,uIAAuI;QAChJ,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,mEAAmE;QAC5E,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,uFAAuF;QAChG,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,sIAAsI;QAC/I,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,mHAAmH;QAC5H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,cAAc;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IAED,gFAAgF;IAChF;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,iEAAiE;QAC9E,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,EAAE,gCAAgC;QACzC,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;CAEF,CAAC"}

package/dist/scanner/rules/ssh.d.ts

@@ -0,0 +1,6 @@
+import { Rule } from '../../types';
+/**
+ * SSH and PEM private key patterns.
+ */
+export declare const sshRules: Rule[];
+//# sourceMappingURL=ssh.d.ts.map

package/dist/scanner/rules/ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/ssh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,IAAI,EAyC1B,CAAC"}

package/dist/scanner/rules/ssh.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sshRules = void 0;
+/**
+ * SSH and PEM private key patterns.
+ */
+exports.sshRules = [
+    {
+        id: 'ssh-private-key-pem',
+        description: 'SSH RSA Private Key (PEM block)',
+        pattern: /(-----BEGIN RSA PRIVATE KEY-----[\s\S]{64,}-----END RSA PRIVATE KEY-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'SSH_RSA_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'ssh-openssh-private-key',
+        description: 'OpenSSH Private Key',
+        pattern: /(-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]{64,}-----END OPENSSH PRIVATE KEY-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'SSH_OPENSSH_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'ssh-dsa-private-key',
+        description: 'SSH DSA Private Key (PEM block)',
+        pattern: /(-----BEGIN DSA PRIVATE KEY-----[\s\S]{64,}-----END DSA PRIVATE KEY-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'SSH_DSA_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'ssh-ec-private-key',
+        description: 'SSH EC Private Key (PEM block)',
+        pattern: /(-----BEGIN EC PRIVATE KEY-----[\s\S]{64,}-----END EC PRIVATE KEY-----)/,
+        valueGroup: 1,
+        envKeyPrefix: 'SSH_EC_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'ssh-private-key-inline',
+        description: 'SSH private key assigned as an inline string variable',
+        pattern: /(?:ssh[_-]?private[_-]?key|SSH_PRIVATE_KEY|id_rsa)\s*[:=]\s*['"`](-----BEGIN[^'"`]+-----END[^'"`]+-----)['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SSH_PRIVATE_KEY',
+        severity: 'critical',
+    },
+];
+//# sourceMappingURL=ssh.js.map

package/dist/scanner/rules/ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../src/scanner/rules/ssh.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACU,QAAA,QAAQ,GAAW;IAC9B;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,2EAA2E;QACpF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,mFAAmF;QAC5F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,yBAAyB;QACvC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,2EAA2E;QACpF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,yEAAyE;QAClF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,oBAAoB;QAClC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,gHAAgH;QACzH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;CACF,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,78 @@
+export type Severity = 'critical' | 'high' | 'medium' | 'low';
+export type ReportFormat = 'console' | 'json' | 'csv' | 'markdown';
+export interface Rule {
+    /** Unique rule identifier, e.g. "aws-access-key" */
+    id: string;
+    /** Human-readable description */
+    description: string;
+    /**
+     * Regex that matches the whole assignment / value line.
+     * Must have at least one capture group for the secret value.
+     */
+    pattern: RegExp;
+    /** Index of the capture group that contains the raw secret value (1-based) */
+    valueGroup: number;
+    /** Prefix used when auto-generating the env var name, e.g. "AWS_ACCESS_KEY" */
+    envKeyPrefix: string;
+    /** Severity classification */
+    severity: Severity;
+}
+export interface Finding {
+    /** Absolute path to the source file */
+    file: string;
+    /** 1-based line number */
+    line: number;
+    /** 1-based column where the secret value starts */
+    column: number;
+    /** The rule that triggered this finding */
+    rule: Rule;
+    /** The raw secret value extracted from source */
+    rawValue: string;
+    /** The full matched line (for context) */
+    lineContent: string;
+    /** Generated env var name (set after deduplication) */
+    envKey: string;
+    /** Whether this finding was already present in the .env file */
+    alreadyInEnv?: boolean;
+}
+export interface CliOptions {
+    /** Directory to scan (default: cwd) */
+    targetDir: string;
+    /** Report output format */
+    report: ReportFormat;
+    /** Report output file path (auto-derived if omitted) */
+    output?: string;
+    /** Path to .env file (default: <targetDir>/.env) */
+    envFile: string;
+    /** Scan only — do not write any files */
+    dryRun: boolean;
+    /** Write .env but skip source-file rewriting */
+    noRewrite: boolean;
+}
+export type Language = 'javascript' | 'typescript' | 'python' | 'java' | 'go' | 'ruby' | 'php' | 'csharp' | 'rust' | 'shell' | 'yaml' | 'toml' | 'properties' | 'generic';
+export interface RewriteContext {
+    finding: Finding;
+    language: Language;
+    fileContent: string;
+}
+export interface RewriteResult {
+    filePath: string;
+    originalContent: string;
+    rewrittenContent: string;
+    /** Number of replacements made */
+    replacements: number;
+    /** Whether a dotenv import/require was injected */
+    dotenvInjected: boolean;
+}
+export interface ScanSummary {
+    targetDir: string;
+    filesScanned: number;
+    filesWithSecrets: number;
+    totalFindings: number;
+    findings: Finding[];
+    envFile: string;
+    reportFile?: string;
+    dryRun: boolean;
+    scannedAt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AACA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAG9D,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;AAGnE,MAAM,WAAW,IAAI;IACnB,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAGD,MAAM,WAAW,OAAO;IACtB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,IAAI,EAAE,IAAI,CAAC;IACX,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAGD,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,gDAAgD;IAChD,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,IAAI,GACJ,MAAM,GACN,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,MAAM,GACN,MAAM,GACN,YAAY,GACZ,SAAS,CAAC;AAGd,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,cAAc,EAAE,OAAO,CAAC;CACzB;AAGD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "code-secret-handler",
+  "version": "1.0.0",
+  "description": "A language-agnostic CLI tool that scans codebases for hardcoded secrets, moves them to .env files, and rewrites source files with proper env-var references.",
+  "main": "dist/cli.js",
+  "bin": {
+    "code-secret-handler": "./dist/cli.js",
+    "csh": "./dist/cli.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "tsx src/cli.ts",
+    "dev": "tsx src/cli.ts",
+    "lint": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git@github-vic:vic-grambo/code-secret-handler.git"
+  },
+  "keywords": [
+    "security",
+    "secrets",
+    "scanner",
+    "hardcoded",
+    "env",
+    "dotenv",
+    "cli",
+    "devops"
+  ],
+  "author": "Vic <vic.grambo@gmail.com>",
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "type": "commonjs",
+  "dependencies": {
+    "chalk": "^6.0.0",
+    "commander": "^15.0.0",
+    "fast-glob": "^3.3.3",
+    "ignore": "^7.0.10",
+    "inquirer": "^14.2.2",
+    "ora": "^9.4.1"
+  },
+  "devDependencies": {
+    "@types/glob": "^8.1.0",
+    "@types/inquirer": "^9.0.10",
+    "@types/node": "^26.6.2",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2"
+  }
+}