code-secret-handler 1.0.0

package/dist/rewriter/templates/toml.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteToml = rewriteToml;
+/**
+ * Rewrites TOML files:
+ *  - Replaces literal secret with a reference comment and env var placeholder.
+ *  - TOML does not support env var interpolation natively, so we replace
+ *    the value with "${KEY}" and add a guidance comment.
+ */
+function rewriteToml(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const quoteStyles = ['"', "'"];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            // Replace with env var reference as a string — note: not all TOML loaders support this
+            rewrittenContent = rewrittenContent.replace(re, `"$\{${envKey}}"  # Set ${envKey} in environment`);
+            replacements++;
+            break;
+        }
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=toml.js.map

package/dist/rewriter/templates/toml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.js","sourceRoot":"","sources":["../../../src/rewriter/templates/toml.ts"],"names":[],"mappings":";;;AAEA;;;;;GAKG;AACH,qBAA4B,GAAmB;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,uFAAuF;YACvF,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,MAAM,aAAa,MAAM,iBAAiB,CAAC,CAAC;YACnG,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/rewriter/templates/yaml.d.ts

@@ -0,0 +1,8 @@
+import { RewriteContext, RewriteResult } from '../../types';
+/**
+ * Rewrites YAML files:
+ *  - Replaces literal secret with `${KEY}` (shell-style substitution)
+ *  - Adds a comment suggesting the use of an env-var substitution tool.
+ */
+export declare function rewriteYaml(ctx: RewriteContext): RewriteResult;
+//# sourceMappingURL=yaml.d.ts.map

package/dist/rewriter/templates/yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/rewriter/templates/yaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,aAAa,CA+B9D"}

package/dist/rewriter/templates/yaml.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteYaml = rewriteYaml;
+/**
+ * Rewrites YAML files:
+ *  - Replaces literal secret with `${KEY}` (shell-style substitution)
+ *  - Adds a comment suggesting the use of an env-var substitution tool.
+ */
+function rewriteYaml(ctx) {
+    const { finding, fileContent } = ctx;
+    const { rawValue, envKey } = finding;
+    let rewrittenContent = fileContent;
+    let replacements = 0;
+    const quoteStyles = ["'", '"', ''];
+    for (const q of quoteStyles) {
+        const escaped = rawValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`${q}${escaped}${q}`, 'g');
+        if (re.test(rewrittenContent)) {
+            rewrittenContent = rewrittenContent.replace(re, `\${${envKey}}`);
+            replacements++;
+            break;
+        }
+    }
+    if (replacements > 0 && !/# env-var substitution/i.test(rewrittenContent)) {
+        rewrittenContent =
+            `# Note: Use envsubst, docker-compose, or a similar tool to substitute \${...} env vars.\n` +
+                rewrittenContent;
+    }
+    return {
+        filePath: finding.file,
+        originalContent: fileContent,
+        rewrittenContent,
+        replacements,
+        dotenvInjected: false,
+    };
+}
+//# sourceMappingURL=yaml.js.map

package/dist/rewriter/templates/yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../../../src/rewriter/templates/yaml.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,qBAA4B,GAAmB;IAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAErC,IAAI,gBAAgB,GAAG,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9B,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,MAAM,GAAG,CAAC,CAAC;YACjE,YAAY,EAAE,CAAC;YACf,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,gBAAgB;YACd,2FAA2F;gBAC3F,gBAAgB,CAAC;IACrB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI;QACtB,eAAe,EAAE,WAAW;QAC5B,gBAAgB;QAChB,YAAY;QACZ,cAAc,EAAE,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/scanner/detector.d.ts

@@ -0,0 +1,18 @@
+import { Finding, Rule } from '../types';
+/**
+ * Generates the env variable name for a finding using context from the line.
+ * Falls back to the rule's envKeyPrefix.
+ */
+export declare function generateEnvKeyBase(rule: Rule, lineContent: string, filePath: string): string;
+/**
+ * Scans a single file for secrets using all rules.
+ * Returns a list of raw findings (envKey not yet deduplicated).
+ */
+export declare function scanFile(filePath: string): Finding[];
+/**
+ * Deduplicates env keys across all findings.
+ * If two findings would share the same key, appends _2, _3, etc.
+ * Also accepts existing .env keys to avoid collisions with them.
+ */
+export declare function deduplicateEnvKeys(findings: Finding[], existingKeys: Set<string>): Finding[];
+//# sourceMappingURL=detector.d.ts.map

package/dist/scanner/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/scanner/detector.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAsDzC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAoB5F;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE,CA4DpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,EAAE,CAa5F"}

package/dist/scanner/detector.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateEnvKeyBase = generateEnvKeyBase;
+exports.scanFile = scanFile;
+exports.deduplicateEnvKeys = deduplicateEnvKeys;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const rules_1 = require("./rules");
+/**
+ * Values that are commonly used as placeholder/example values — skip these.
+ */
+const PLACEHOLDER_PATTERNS = [
+    /^your[_-]/i,
+    /^xxx+$/i,
+    /^<.+>$/, // <YOUR_KEY>
+    /^\$\{.+\}$/, // ${MY_VAR}
+    /^\$[A-Z_]+$/, // $MY_VAR
+    /^process\.env\./,
+    /^os\.environ/,
+    /^ENV\[/,
+    /^System\.getenv/,
+    /^getenv\(/,
+    /^placeholder$/i,
+    /^changeme$/i,
+    /^change_me$/i,
+    /^replace_?me$/i,
+    /^todo$/i,
+    /^fixme$/i,
+    /^insert[_-]?here$/i,
+    /^example$/i,
+    /^test$/i,
+    /^dummy$/i,
+    /^fake$/i,
+    /^mock$/i,
+    /^secret$/i, // bare word "secret" — likely a placeholder
+    /^password$/i, // bare word "password"
+    /^12345+$/,
+    /^0{8,}$/,
+    /^1{8,}$/,
+    /^null$/i,
+    /^undefined$/i,
+    /^none$/i,
+    /^empty$/i,
+    /^n\/a$/i,
+];
+/**
+ * Minimum lengths for secret values to avoid false positives.
+ */
+const MIN_SECRET_LENGTH = 4;
+/**
+ * Returns true if the value looks like a placeholder/template value.
+ */
+function isPlaceholder(value) {
+    if (value.length < MIN_SECRET_LENGTH)
+        return true;
+    return PLACEHOLDER_PATTERNS.some(p => p.test(value));
+}
+/**
+ * Generates the env variable name for a finding using context from the line.
+ * Falls back to the rule's envKeyPrefix.
+ */
+function generateEnvKeyBase(rule, lineContent, filePath) {
+    // Try to infer a more specific name from the variable name on the line
+    const assignmentMatch = lineContent.match(/(?:const|let|var|val|final|private|public|protected|static)?\s*([A-Za-z_][A-Za-z0-9_]*)\s*(?:[:=])/);
+    if (assignmentMatch) {
+        const varName = assignmentMatch[1]
+            .replace(/([a-z])([A-Z])/g, '$1_$2') // camelCase → snake_case
+            .toUpperCase();
+        // Only use var name if it looks meaningful and is not too generic
+        const genericNames = new Set(['VALUE', 'VAL', 'V', 'S', 'K', 'KEY', 'DATA', 'RESULT', 'RES', 'X', 'Y']);
+        if (!genericNames.has(varName) && varName.length > 2) {
+            return varName;
+        }
+    }
+    // Fall back to the rule's prefix
+    return rule.envKeyPrefix;
+}
+/**
+ * Scans a single file for secrets using all rules.
+ * Returns a list of raw findings (envKey not yet deduplicated).
+ */
+function scanFile(filePath) {
+    let content;
+    try {
+        content = fs_1.default.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        // Binary or unreadable — skip
+        return [];
+    }
+    // Skip files larger than 5 MB
+    const stats = fs_1.default.statSync(filePath);
+    if (stats.size > 5 * 1024 * 1024)
+        return [];
+    const findings = [];
+    const lines = content.split('\n');
+    for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+        const lineContent = lines[lineIdx];
+        // Skip comment-only lines (best-effort)
+        const trimmed = lineContent.trim();
+        if (trimmed.startsWith('//') ||
+            trimmed.startsWith('#') ||
+            trimmed.startsWith('*') ||
+            trimmed.startsWith('/*') ||
+            trimmed.startsWith('<!--')) {
+            continue;
+        }
+        for (const rule of rules_1.ALL_RULES) {
+            // Reset lastIndex for global regexes
+            rule.pattern.lastIndex = 0;
+            const match = rule.pattern.exec(lineContent);
+            if (!match)
+                continue;
+            const rawValue = match[rule.valueGroup] ?? match[0];
+            if (!rawValue || isPlaceholder(rawValue))
+                continue;
+            const column = lineContent.indexOf(rawValue) + 1;
+            const envKey = generateEnvKeyBase(rule, lineContent, filePath);
+            findings.push({
+                file: path_1.default.resolve(filePath),
+                line: lineIdx + 1,
+                column,
+                rule,
+                rawValue,
+                lineContent,
+                envKey,
+            });
+            // Only match first rule per line to avoid duplicates
+            break;
+        }
+    }
+    return findings;
+}
+/**
+ * Deduplicates env keys across all findings.
+ * If two findings would share the same key, appends _2, _3, etc.
+ * Also accepts existing .env keys to avoid collisions with them.
+ */
+function deduplicateEnvKeys(findings, existingKeys) {
+    const usedKeys = new Set(existingKeys);
+    return findings.map(finding => {
+        let candidate = finding.envKey;
+        if (usedKeys.has(candidate)) {
+            let suffix = 2;
+            while (usedKeys.has(`${candidate}_${suffix}`))
+                suffix++;
+            candidate = `${candidate}_${suffix}`;
+        }
+        usedKeys.add(candidate);
+        return { ...finding, envKey: candidate };
+    });
+}
+//# sourceMappingURL=detector.js.map

package/dist/scanner/detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../../src/scanner/detector.ts"],"names":[],"mappings":";;;;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AAExB,mCAAoC;AAEpC;;GAEG;AACH,MAAM,oBAAoB,GAAG;IAC3B,YAAY;IACZ,SAAS;IACT,QAAQ,EAAmB,aAAa;IACxC,YAAY,EAAe,YAAY;IACvC,aAAa,EAAc,UAAU;IACrC,iBAAiB;IACjB,cAAc;IACd,QAAQ;IACR,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,UAAU;IACV,oBAAoB;IACpB,YAAY;IACZ,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW,EAAgB,4CAA4C;IACvE,aAAa,EAAc,uBAAuB;IAClD,UAAU;IACV,SAAS;IACT,SAAS;IACT,SAAS;IACT,cAAc;IACd,SAAS;IACT,UAAU;IACV,SAAS;CACV,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,4BAAmC,IAAU,EAAE,WAAmB,EAAE,QAAgB;IAClF,uEAAuE;IACvE,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,CACvC,oGAAoG,CACrG,CAAC;IAEF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC;aAC/B,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,yBAAyB;aAC7D,WAAW,EAAE,CAAC;QAEjB,kEAAkE;QAClE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACxG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,kBAAyB,QAAgB;IACvC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8BAA8B;IAC9B,MAAM,KAAK,GAAG,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,EAAE,CAAC;IAE5C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,wCAAwC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QACnC,IACE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAC1B,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,iBAAS,EAAE,CAAC;YAC7B,qCAAqC;YACrC,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEnD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAE/D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC5B,IAAI,EAAE,OAAO,GAAG,CAAC;gBACjB,MAAM;gBACN,IAAI;gBACJ,QAAQ;gBACR,WAAW;gBACX,MAAM;aACP,CAAC,CAAC;YAEH,qDAAqD;YACrD,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,4BAAmC,QAAmB,EAAE,YAAyB;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,CAAC;IAE/C,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5B,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC;YACxD,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;QACvC,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scanner/fileWalker.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Recursively walks `targetDir` and returns the absolute paths of all
+ * scannable files, respecting the nearest .gitignore.
+ */
+export declare function walkFiles(targetDir: string): Promise<string[]>;
+//# sourceMappingURL=fileWalker.d.ts.map

package/dist/scanner/fileWalker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileWalker.d.ts","sourceRoot":"","sources":["../../src/scanner/fileWalker.ts"],"names":[],"mappings":"AAuHA;;;GAGG;AACH,wBAAsB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBpE"}

package/dist/scanner/fileWalker.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkFiles = walkFiles;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const ignore_1 = __importDefault(require("ignore"));
+const fast_glob_1 = __importDefault(require("fast-glob"));
+/**
+ * File extensions we will attempt to scan for secrets.
+ * Binary and compiled files are excluded.
+ */
+const SCANNABLE_EXTENSIONS = new Set([
+    // Web / JS ecosystem
+    '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.vue', '.svelte',
+    // Config / env
+    '.env', '.env.local', '.env.development', '.env.staging', '.env.production',
+    '.json', '.jsonc', '.json5',
+    '.yaml', '.yml',
+    '.toml',
+    '.ini',
+    '.properties',
+    '.conf', '.config',
+    '.xml',
+    // Backend languages
+    '.py', '.rb', '.php', '.java', '.kt', '.kts', '.scala',
+    '.go', '.rs', '.cs', '.vb', '.fs', '.fsx',
+    '.cpp', '.c', '.h', '.hpp', '.cc',
+    '.swift', '.m', '.mm',
+    '.dart',
+    '.ex', '.exs', // Elixir
+    '.erl', '.hrl', // Erlang
+    '.clj', '.cljs', // Clojure
+    '.hs', '.lhs', // Haskell
+    '.lua',
+    '.pl', '.pm', // Perl
+    '.r', '.R', // R
+    // Shell / scripting
+    '.sh', '.bash', '.zsh', '.fish', '.ps1', '.psm1', '.bat', '.cmd',
+    // Infrastructure as code
+    '.tf', '.tfvars', // Terraform
+    '.hcl',
+    '.dockerfile',
+    // Misc
+    '.gradle', '.groovy',
+    '.sql',
+    '.graphql', '.gql',
+    '.proto',
+    '.md', '.mdx', '.txt', '.log',
+]);
+/**
+ * File names (without extension, or exact names) that should always be scanned.
+ */
+const SCANNABLE_FILENAMES = new Set([
+    'Dockerfile', 'docker-compose', 'docker-compose.yml', 'docker-compose.yaml',
+    '.env', '.envrc', 'Makefile', 'Procfile', 'Gemfile', 'Rakefile',
+    '.npmrc', '.yarnrc', '.pypirc', '.netrc', '.htpasswd',
+]);
+/**
+ * Patterns for paths that should always be excluded regardless of .gitignore.
+ */
+const ALWAYS_IGNORE_GLOBS = [
+    '**/node_modules/**',
+    '**/.git/**',
+    '**/dist/**',
+    '**/build/**',
+    '**/out/**',
+    '**/__pycache__/**',
+    '**/*.pyc',
+    '**/*.pyo',
+    '**/vendor/**',
+    '**/.yarn/**',
+    '**/.pnp.*',
+    '**/coverage/**',
+    '**/.nyc_output/**',
+    '**/*.min.js',
+    '**/*.min.css',
+    '**/*.map',
+    '**/*.lock', // package-lock.json, yarn.lock, etc.
+    '**/Cargo.lock',
+    '**/*.png', '**/*.jpg', '**/*.jpeg', '**/*.gif', '**/*.ico',
+    '**/*.svg', '**/*.webp', '**/*.avif',
+    '**/*.woff', '**/*.woff2', '**/*.ttf', '**/*.eot',
+    '**/*.pdf', '**/*.zip', '**/*.tar', '**/*.gz', '**/*.tgz',
+    '**/*.exe', '**/*.dll', '**/*.so', '**/*.dylib',
+    '**/*.jar', '**/*.war', '**/*.ear', '**/*.class',
+    '**/*.DS_Store',
+];
+/**
+ * Loads a .gitignore file from the given directory and returns an `ignore` instance.
+ */
+function loadGitIgnore(dir) {
+    const ig = (0, ignore_1.default)();
+    const gitignorePath = path_1.default.join(dir, '.gitignore');
+    if (fs_1.default.existsSync(gitignorePath)) {
+        const content = fs_1.default.readFileSync(gitignorePath, 'utf-8');
+        ig.add(content);
+    }
+    // Also check nested .gitignore files by adding the built-in always-ignore patterns
+    ig.add(ALWAYS_IGNORE_GLOBS.map(g => g.replace(/\*\*\//g, '')));
+    return ig;
+}
+/**
+ * Determines whether a file is scannable based on its extension or filename.
+ */
+function isScannableFile(filePath) {
+    const basename = path_1.default.basename(filePath);
+    const ext = path_1.default.extname(filePath).toLowerCase();
+    if (SCANNABLE_FILENAMES.has(basename))
+        return true;
+    if (ext && SCANNABLE_EXTENSIONS.has(ext))
+        return true;
+    // Files with no extension that look like config files
+    if (!ext && basename.startsWith('.'))
+        return true;
+    return false;
+}
+/**
+ * Recursively walks `targetDir` and returns the absolute paths of all
+ * scannable files, respecting the nearest .gitignore.
+ */
+async function walkFiles(targetDir) {
+    const absoluteDir = path_1.default.resolve(targetDir);
+    const ig = loadGitIgnore(absoluteDir);
+    const allFiles = await (0, fast_glob_1.default)('**/*', {
+        cwd: absoluteDir,
+        absolute: true,
+        onlyFiles: true,
+        dot: true,
+        ignore: ALWAYS_IGNORE_GLOBS,
+        followSymbolicLinks: false,
+    });
+    return allFiles.filter(filePath => {
+        const relative = path_1.default.relative(absoluteDir, filePath);
+        // Apply gitignore rules
+        if (ig.ignores(relative))
+            return false;
+        // Apply extension/filename filter
+        if (!isScannableFile(filePath))
+            return false;
+        return true;
+    });
+}
+//# sourceMappingURL=fileWalker.js.map

package/dist/scanner/fileWalker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileWalker.js","sourceRoot":"","sources":["../../src/scanner/fileWalker.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AACpB,gDAAwB;AACxB,oDAAwC;AACxC,0DAA2B;AAE3B;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,qBAAqB;IACrB,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IAC/D,eAAe;IACf,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,iBAAiB;IAC3E,OAAO,EAAE,QAAQ,EAAE,QAAQ;IAC3B,OAAO,EAAE,MAAM;IACf,OAAO;IACP,MAAM;IACN,aAAa;IACb,OAAO,EAAE,SAAS;IAClB,MAAM;IACN,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ;IACtD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACzC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK;IACjC,QAAQ,EAAE,IAAI,EAAE,KAAK;IACrB,OAAO;IACP,KAAK,EAAE,MAAM,EAAG,SAAS;IACzB,MAAM,EAAE,MAAM,EAAE,SAAS;IACzB,MAAM,EAAE,OAAO,EAAE,UAAU;IAC3B,KAAK,EAAE,MAAM,EAAG,UAAU;IAC1B,MAAM;IACN,KAAK,EAAE,KAAK,EAAI,OAAO;IACvB,IAAI,EAAE,IAAI,EAAM,IAAI;IACpB,oBAAoB;IACpB,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;IAChE,yBAAyB;IACzB,KAAK,EAAE,SAAS,EAAE,YAAY;IAC9B,MAAM;IACN,aAAa;IACb,OAAO;IACP,SAAS,EAAE,SAAS;IACpB,MAAM;IACN,UAAU,EAAE,MAAM;IAClB,QAAQ;IACR,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC9B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,qBAAqB;IAC3E,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;IAC/D,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW;CACtD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,oBAAoB;IACpB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,WAAW;IACX,mBAAmB;IACnB,UAAU;IACV,UAAU;IACV,cAAc;IACd,aAAa;IACb,WAAW;IACX,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,UAAU;IACV,WAAW,EAAS,qCAAqC;IACzD,eAAe;IACf,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU;IAC3D,UAAU,EAAE,WAAW,EAAE,WAAW;IACpC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU;IACjD,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;IACzD,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY;IAC/C,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY;IAChD,eAAe;CAChB,CAAC;AAEF;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,EAAE,GAAG,IAAA,gBAAM,GAAE,CAAC;IACpB,MAAM,aAAa,GAAG,cAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,YAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxD,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,mFAAmF;IACnF,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,sDAAsD;IACtD,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACI,KAAK,oBAAoB,SAAiB;IAC/C,MAAM,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAE,EAAC,MAAM,EAAE;QAChC,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,mBAAmB;QAC3B,mBAAmB,EAAE,KAAK;KAC3B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QAChC,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtD,wBAAwB;QACxB,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,kCAAkC;QAClC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scanner/index.d.ts

@@ -0,0 +1,8 @@
+import { ScanSummary } from '../types';
+/**
+ * Main scanner orchestrator.
+ * Walks the target directory, scans every file, deduplicates env keys,
+ * and returns a full ScanSummary.
+ */
+export declare function runScanner(targetDir: string, envFilePath: string): Promise<ScanSummary>;
+//# sourceMappingURL=index.d.ts.map

package/dist/scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAW,WAAW,EAAE,MAAM,UAAU,CAAC;AAqBhD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA8C7F"}

package/dist/scanner/index.js

@@ -0,0 +1,74 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runScanner = runScanner;
+const ora_1 = __importDefault(require("ora"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const fileWalker_1 = require("./fileWalker");
+const detector_1 = require("./detector");
+/**
+ * Reads existing keys from a .env file to seed the deduplication set.
+ */
+function readExistingEnvKeys(envFilePath) {
+    const keys = new Set();
+    if (!fs_1.default.existsSync(envFilePath))
+        return keys;
+    const content = fs_1.default.readFileSync(envFilePath, 'utf-8');
+    for (const line of content.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx > 0)
+            keys.add(trimmed.slice(0, eqIdx).trim());
+    }
+    return keys;
+}
+/**
+ * Main scanner orchestrator.
+ * Walks the target directory, scans every file, deduplicates env keys,
+ * and returns a full ScanSummary.
+ */
+async function runScanner(targetDir, envFilePath) {
+    const spinner = (0, ora_1.default)({
+        text: `Discovering files in ${path_1.default.resolve(targetDir)} …`,
+        color: 'cyan',
+    }).start();
+    let files;
+    try {
+        files = await (0, fileWalker_1.walkFiles)(targetDir);
+    }
+    catch (err) {
+        spinner.fail('Failed to walk directory');
+        throw err;
+    }
+    spinner.text = `Scanning ${files.length} files for secrets …`;
+    const allFindings = [];
+    const filesWithSecrets = new Set();
+    for (const filePath of files) {
+        const fileFindings = (0, detector_1.scanFile)(filePath);
+        if (fileFindings.length > 0) {
+            allFindings.push(...fileFindings);
+            filesWithSecrets.add(filePath);
+        }
+        spinner.text = `Scanned ${files.indexOf(filePath) + 1}/${files.length} files — ${allFindings.length} secret(s) found so far …`;
+    }
+    spinner.succeed(`Scan complete: ${files.length} files scanned, ${allFindings.length} secret(s) found in ${filesWithSecrets.size} file(s).`);
+    // Deduplicate env keys, considering what's already in .env
+    const existingKeys = readExistingEnvKeys(envFilePath);
+    const deduplicated = (0, detector_1.deduplicateEnvKeys)(allFindings, existingKeys);
+    return {
+        targetDir: path_1.default.resolve(targetDir),
+        filesScanned: files.length,
+        filesWithSecrets: filesWithSecrets.size,
+        totalFindings: deduplicated.length,
+        findings: deduplicated,
+        envFile: path_1.default.resolve(envFilePath),
+        dryRun: false, // set by caller
+        scannedAt: new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/scanner/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/scanner/index.ts"],"names":[],"mappings":";;;;;;AAAA,8CAAsB;AACtB,gDAAwB;AACxB,4CAAoB;AAEpB,6CAAyC;AACzC,yCAA0D;AAE1D;;GAEG;AACH,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACI,KAAK,qBAAqB,SAAiB,EAAE,WAAmB;IACrE,MAAM,OAAO,GAAG,IAAA,aAAG,EAAC;QAClB,IAAI,EAAE,wBAAwB,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI;QACzD,KAAK,EAAE,MAAM;KACd,CAAC,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAA,sBAAS,EAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,YAAY,KAAK,CAAC,MAAM,sBAAsB,CAAC;IAE9D,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,IAAA,mBAAQ,EAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YAClC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,WAAW,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,YAAY,WAAW,CAAC,MAAM,2BAA2B,CAAC;IACjI,CAAC;IAED,OAAO,CAAC,OAAO,CACb,kBAAkB,KAAK,CAAC,MAAM,mBAAmB,WAAW,CAAC,MAAM,uBAAuB,gBAAgB,CAAC,IAAI,WAAW,CAC3H,CAAC;IAEF,2DAA2D;IAC3D,MAAM,YAAY,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,IAAA,6BAAkB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAEnE,OAAO;QACL,SAAS,EAAE,cAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAClC,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,gBAAgB,EAAE,gBAAgB,CAAC,IAAI;QACvC,aAAa,EAAE,YAAY,CAAC,MAAM;QAClC,QAAQ,EAAE,YAAY;QACtB,OAAO,EAAE,cAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAClC,MAAM,EAAE,KAAK,EAAE,gBAAgB;QAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/scanner/rules/aws.d.ts

@@ -0,0 +1,6 @@
+import { Rule } from '../../types';
+/**
+ * AWS credential patterns.
+ */
+export declare const awsRules: Rule[];
+//# sourceMappingURL=aws.d.ts.map

package/dist/scanner/rules/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/aws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,IAAI,EAkF1B,CAAC"}

package/dist/scanner/rules/aws.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.awsRules = void 0;
+/**
+ * AWS credential patterns.
+ */
+exports.awsRules = [
+    {
+        id: 'aws-access-key-id',
+        description: 'AWS Access Key ID',
+        // AWS access key IDs start with AKIA, ABIA, ACCA, or ASIA
+        pattern: /(?:aws[_-]?access[_-]?key[_-]?id|aws[_-]?access[_-]?key)\s*[:=]\s*['"\`]?((?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})['"\`]?/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_ACCESS_KEY_ID',
+        severity: 'critical',
+    },
+    {
+        id: 'aws-access-key-id-bare',
+        description: 'Bare AWS Access Key ID (without variable name context)',
+        pattern: /['"\`]((?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})['"\`]/,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_ACCESS_KEY_ID',
+        severity: 'critical',
+    },
+    {
+        id: 'aws-secret-access-key',
+        description: 'AWS Secret Access Key',
+        pattern: /(?:aws[_-]?secret[_-]?access[_-]?key|aws[_-]?secret[_-]?key)\s*[:=]\s*['"\`]([A-Za-z0-9+/]{40})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_SECRET_ACCESS_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'aws-session-token',
+        description: 'AWS Session Token',
+        pattern: /(?:aws[_-]?session[_-]?token|aws[_-]?security[_-]?token)\s*[:=]\s*['"\`]([A-Za-z0-9+/=]{100,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_SESSION_TOKEN',
+        severity: 'critical',
+    },
+    {
+        id: 'aws-account-id',
+        description: 'AWS Account ID',
+        pattern: /(?:aws[_-]?account[_-]?id|aws[_-]?account)\s*[:=]\s*['"\`]?(\d{12})['"\`]?/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_ACCOUNT_ID',
+        severity: 'high',
+    },
+    {
+        id: 'aws-mws-key',
+        description: 'AWS MWS (Marketplace Web Service) Key',
+        pattern: /amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i,
+        valueGroup: 0,
+        envKeyPrefix: 'AWS_MWS_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'aws-region',
+        description: 'AWS Region hardcoded assignment',
+        pattern: /(?:aws[_-]?region)\s*[:=]\s*['"\`](us-east-[12]|us-west-[12]|eu-west-[123]|eu-central-1|ap-southeast-[12]|ap-northeast-[123]|sa-east-1|ca-central-1|ap-south-1|ap-east-1|me-south-1|af-south-1)['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_REGION',
+        severity: 'low',
+    },
+    {
+        id: 'aws-arn',
+        description: 'Hardcoded AWS ARN (resource identifier)',
+        pattern: /(?:arn[_-]?value|resource[_-]?arn|target[_-]?arn|(?:sns|sqs|lambda|iam|s3)[_-]?arn)\s*[:=]\s*['"\`](arn:aws:[a-z0-9\-]+:[a-z0-9\-]*:\d{12}:[^'"\`\s]+)['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_ARN',
+        severity: 'medium',
+    },
+    {
+        id: 'aws-s3-bucket',
+        description: 'AWS S3 bucket name hardcoded assignment',
+        pattern: /(?:s3[_-]?bucket(?:[_-]?name)?|bucket[_-]?name|AWS_S3_BUCKET)\s*[:=]\s*['"\`]([a-z0-9][a-z0-9\-\.]{1,61}[a-z0-9])['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AWS_S3_BUCKET',
+        severity: 'medium',
+    },
+    {
+        id: 'aws-cloudfront-key-pair-id',
+        description: 'AWS CloudFront Key Pair ID',
+        pattern: /(?:cloudfront[_-]?key[_-]?pair[_-]?id|CLOUDFRONT_KEY_PAIR_ID)\s*[:=]\s*['"\`]([A-Z0-9]{14,20})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'CLOUDFRONT_KEY_PAIR_ID',
+        severity: 'high',
+    },
+];
+//# sourceMappingURL=aws.js.map

package/dist/scanner/rules/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/scanner/rules/aws.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACU,QAAA,QAAQ,GAAW;IAC9B;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,mBAAmB;QAChC,0DAA0D;QAC1D,OAAO,EAAE,wHAAwH;QACjI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,mBAAmB;QACjC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,wDAAwD;QACrE,OAAO,EAAE,mDAAmD;QAC5D,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,mBAAmB;QACjC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,wGAAwG;QACjH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,uBAAuB;QACrC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,uGAAuG;QAChH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,mBAAmB;QACjC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,gBAAgB;QAC7B,OAAO,EAAE,6EAA6E;QACtF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,0EAA0E;QACnF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,wMAAwM;QACjN,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,EAAE,EAAE,SAAS;QACb,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,+JAA+J;QACxK,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,0HAA0H;QACnI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,uGAAuG;QAChH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,wBAAwB;QACtC,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC"}