code-secret-handler 1.0.0

package/dist/scanner/rules/generic.js

@@ -0,0 +1,305 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.genericRules = void 0;
+/**
+ * Generic secret patterns: API keys, passwords, tokens, secrets.
+ * These patterns match common assignment patterns across all languages.
+ *
+ * Assignment forms covered:
+ *   key = 'value'          (Python, JS, shell, YAML)
+ *   key: 'value'           (YAML, JSON)
+ *   define('KEY', 'value') (PHP)
+ *   KEY=value              (.env files)
+ */
+exports.genericRules = [
+    // ── PHP define() ────────────────────────────────────────────────────────────────
+    {
+        id: 'php-define-secret',
+        description: 'PHP define() call with any secret-looking key name',
+        // Matches: define('SOME_SECRET_KEY', 'value') or define("KEY", 'value')
+        pattern: /define\s*\(\s*['"]((?:[A-Z][A-Z0-9_]*_)?(?:SECRET|PASSWORD|PASSWD|API_KEY|API_SECRET|AUTH_KEY|ACCESS_TOKEN|REFRESH_TOKEN|SESSION_SECRET|OAUTH[0-9]?_CLIENT_SECRET|PRIVATE_KEY|TOKEN|INTEGRATION_KEY|STORAGE_KEY|VAULT_TOKEN|CLIENT_SECRET)[A-Z0-9_]*)['"\`]\s*,\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 2,
+        envKeyPrefix: 'SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'php-define-any-key',
+        description: 'PHP define() with any variable name ending in _KEY, _SECRET, _TOKEN, _PASSWORD',
+        // Broad fallback: any define('*_PASSWORD', ...), define('*_SECRET', ...), etc.
+        pattern: /define\s*\(\s*['"\`]([A-Za-z][A-Za-z0-9_]{2,}(?:_(?:PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|PRIVATE_KEY|AUTH_KEY|STORAGE_KEY|ACCESS_KEY|ACCESS_TOKEN|REFRESH_TOKEN|INTEGRATION_KEY|VAULT_TOKEN)))['"\`]\s*,\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 2,
+        envKeyPrefix: 'SECRET',
+        severity: 'critical',
+    },
+    // ── Uppercase _PASSWORD variable names (any service) ─────────────────────────────
+    {
+        id: 'uppercase-password-var',
+        description: 'Any uppercase *_PASSWORD or *_PASSWD variable assignment',
+        pattern: /\b([A-Z][A-Z0-9_]*_PASS(?:W(?:OR)?D)?)\s*=\s*['"\`]([^'"\`\n]{4,})['"\`]/,
+        valueGroup: 2,
+        envKeyPrefix: 'PASSWORD',
+        severity: 'critical',
+    },
+    // ── Uppercase _SECRET variable names (any service) ──────────────────────────────
+    {
+        id: 'uppercase-secret-var',
+        description: 'Any uppercase *_SECRET variable assignment',
+        pattern: /\b([A-Z][A-Z0-9_]*_SECRET)\s*=\s*['"\`]([^'"\`\n]{4,})['"\`]/,
+        valueGroup: 2,
+        envKeyPrefix: 'SECRET',
+        severity: 'critical',
+    },
+    // ── Uppercase _KEY variable names (any service) ─────────────────────────────────
+    {
+        id: 'uppercase-key-var',
+        description: 'Any uppercase *_KEY variable assignment (min 16 chars to avoid false positives)',
+        pattern: /\b([A-Z][A-Z0-9_]*_(?:API_)?KEY)\s*=\s*['"\`]([A-Za-z0-9!@#\$%^&*()_+\-=\[\]{};':"\\|,.<>\/?~]{8,})['"\`]/,
+        valueGroup: 2,
+        envKeyPrefix: 'API_KEY',
+        severity: 'high',
+    },
+    // ── Uppercase _TOKEN variable names (access / refresh) ────────────────────────
+    {
+        id: 'uppercase-token-var',
+        description: 'Any uppercase *_TOKEN variable with a long token value',
+        // Require the value to look like a real token (letters+digits, 16+ chars)
+        pattern: /\b([A-Z][A-Z0-9_]*_(?:ACCESS_|REFRESH_|AUTH_|API_|INTEGRATION_)?TOKEN)\s*=\s*['"\`]([A-Za-z0-9\-_.~+/=!]{16,})['"\`]/,
+        valueGroup: 2,
+        envKeyPrefix: 'TOKEN',
+        severity: 'high',
+    },
+    // ── Existing patterns below ────────────────────────────────────────────────────────────
+    {
+        id: 'generic-api-key',
+        description: 'Generic API key assignment',
+        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"\`]([A-Za-z0-9\-_]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'API_KEY',
+        severity: 'high',
+    },
+    {
+        id: 'generic-api-secret',
+        description: 'Generic API secret assignment',
+        pattern: /(?:api[_-]?secret|apisecret)\s*[:=]\s*['"\`]([A-Za-z0-9\-_+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'API_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-secret-key',
+        description: 'Generic secret key assignment',
+        pattern: /(?:secret[_-]?key|secretkey)\s*[:=]\s*['"\`]([A-Za-z0-9\-_+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SECRET_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-secret',
+        description: 'Generic secret/password variable',
+        pattern: /(?:^|[\s,({])(?:secret|password|passwd|pwd|pass)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-token',
+        description: 'Generic token assignment',
+        pattern: /(?:token|auth_token|access_token|refresh_token)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'TOKEN',
+        severity: 'high',
+    },
+    {
+        id: 'generic-bearer-token',
+        description: 'Bearer token in Authorization header value',
+        pattern: /(?:authorization|auth[_-]?header)\s*[:=]\s*['"\`](Bearer\s+[A-Za-z0-9\-_.~+/=]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'BEARER_TOKEN',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-private-key-value',
+        description: 'Generic private key value',
+        pattern: /(?:private[_-]?key|priv[_-]?key)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-client-secret',
+        description: 'OAuth client secret',
+        pattern: /client[_-]?secret\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'CLIENT_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-encryption-key',
+        description: 'Encryption or cipher key',
+        pattern: /(?:encryption[_-]?key|cipher[_-]?key|encrypt[_-]?key|aes[_-]?key)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'ENCRYPTION_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-hmac-key',
+        description: 'HMAC or hash signing key',
+        pattern: /(?:hmac[_-]?(?:secret|key)|hash[_-]?key|signing[_-]?key|sign[_-]?key)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'HMAC_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-auth-password',
+        description: 'Auth password field',
+        pattern: /(?:auth[_-]?password|auth[_-]?pass|admin[_-]?password|admin[_-]?pass)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AUTH_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-root-password',
+        description: 'Root or master password assignment',
+        pattern: /(?:root[_-]?password|root[_-]?pass|master[_-]?password|master[_-]?pass)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'ROOT_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-service-password',
+        description: 'Service account or service password',
+        pattern: /(?:service[_-]?password|service[_-]?pass|svc[_-]?password|svc[_-]?pass)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SERVICE_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-app-secret',
+        description: 'Application secret or app key',
+        pattern: /(?:app[_-]?secret|app[_-]?key|application[_-]?secret)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'APP_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-master-key',
+        description: 'Master key or root key assignment',
+        pattern: /(?:master[_-]?key|root[_-]?key)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'MASTER_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-webhook-secret',
+        description: 'Webhook secret or signing secret',
+        pattern: /(?:webhook[_-]?secret|signing[_-]?secret|consumer[_-]?secret)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'WEBHOOK_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-license-key',
+        description: 'License key or activation key',
+        pattern: /(?:license[_-]?key|activation[_-]?key|product[_-]?key|serial[_-]?key)\s*[:=]\s*['"\`]([A-Za-z0-9\-_]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'LICENSE_KEY',
+        severity: 'high',
+    },
+    {
+        id: 'generic-ssh-password',
+        description: 'SSH, FTP, or SFTP password',
+        pattern: /(?:ssh[_-]?pass(?:word)?|ftp[_-]?pass(?:word)?|sftp[_-]?pass(?:word)?)\s*[:=]\s*['"\`]([^'"\`\n]{4,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SSH_PASSWORD',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-basic-auth',
+        description: 'HTTP Basic Auth credentials embedded in a URL',
+        pattern: /https?:\/\/([A-Za-z0-9\-_.~%]+:[^@\s'"\`]{4,})@[A-Za-z0-9\-.]+/,
+        valueGroup: 1,
+        envKeyPrefix: 'BASIC_AUTH_CREDENTIALS',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-connection-string',
+        description: 'Generic connection string with embedded credentials',
+        pattern: /(?:connection[_-]?string|conn[_-]?str|connstring)\s*[:=]\s*['"\`]([^'"\`\n]{12,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'CONNECTION_STRING',
+        severity: 'critical',
+    },
+    {
+        id: 'generic-private-token',
+        description: 'Private or internal API token variable',
+        pattern: /(?:private[_-]?token|internal[_-]?token|server[_-]?token|service[_-]?token)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'PRIVATE_TOKEN',
+        severity: 'critical',
+    },
+    // API key in HTTP header assignment
+    {
+        id: 'generic-api-key-header',
+        description: 'API key passed as a raw HTTP header value (X-API-Key / X-Auth-Key)',
+        pattern: /(?:'X-API-Key'|"X-API-Key"|'X-Auth-Key'|"X-Auth-Key")\s*[:=,>]+\s*['"\`]([A-Za-z0-9\-_.~+\/=]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'API_KEY',
+        severity: 'critical',
+    },
+    // Unquoted .env secret
+    {
+        id: 'generic-secret-env-unquoted',
+        description: 'Unquoted secret value in .env-style assignment (no surrounding quotes)',
+        pattern: /^([A-Z][A-Z0-9_]*(?:SECRET|PASSWORD|PASSWD|API_KEY|TOKEN|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*)=([A-Za-z0-9+\/\-_!@#$%^&*]{12,})$/m,
+        valueGroup: 2,
+        envKeyPrefix: 'SECRET',
+        severity: 'critical',
+    },
+    // Hardcoded AES IV
+    {
+        id: 'generic-encryption-iv',
+        description: 'Hardcoded AES Initialization Vector (IV) — 16 or 32 bytes as hex',
+        pattern: /(?:iv|initialization[_-]?vector|aes[_-]?iv|cipher[_-]?iv)\s*[:=]\s*['"\`]([A-Fa-f0-9]{32}|[A-Fa-f0-9]{64})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'ENCRYPTION_IV',
+        severity: 'high',
+    },
+    // TOTP / 2FA shared secret
+    {
+        id: 'generic-totp-secret',
+        description: 'TOTP/2FA shared secret (Base32 format used by authenticator apps)',
+        pattern: /(?:totp[_-]?secret|otp[_-]?secret|two[_-]?fa[_-]?secret|mfa[_-]?secret|authenticator[_-]?secret|TOTP_SECRET|OTP_SECRET|MFA_SECRET)\s*[:=]\s*['"\`]([A-Z2-7]{16,32})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'TOTP_SECRET',
+        severity: 'critical',
+    },
+    // ── AES encryption key ────────────────────────────────────────────────────────
+    {
+        id: 'generic-aes-key',
+        description: 'Hardcoded AES encryption key (128-bit / 192-bit / 256-bit as hex string)',
+        // 128-bit = 32 hex chars, 192-bit = 48 hex chars, 256-bit = 64 hex chars
+        pattern: /(?:aes[_-]?(?:256[_-]?|192[_-]?|128[_-]?)?(?:encryption[_-]?)?key|AES_KEY|AES_SECRET_KEY|AES_ENCRYPTION_KEY)\s*[:=]\s*['"`]([A-Fa-f0-9]{32}|[A-Fa-f0-9]{48}|[A-Fa-f0-9]{64})['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'AES_KEY',
+        severity: 'critical',
+    },
+    // ── HMAC secret ───────────────────────────────────────────────────────────────
+    {
+        id: 'generic-hmac-secret',
+        description: 'Hardcoded HMAC signing secret (SHA-256 / SHA-512)',
+        pattern: /(?:hmac[_-]?(?:secret|key|signing[_-]?key)|HMAC_SECRET|HMAC_KEY)\s*[:=]\s*['"`]([A-Za-z0-9+/=\-_]{16,})['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'HMAC_SECRET',
+        severity: 'critical',
+    },
+    // ── Generic encryption / decryption key ──────────────────────────────────────
+    {
+        id: 'generic-encryption-key',
+        description: 'Generic hardcoded encryption or decryption key variable',
+        pattern: /(?:encrypt(?:ion)?[_-]?key|decrypt(?:ion)?[_-]?key|cipher[_-]?key|ENCRYPTION_KEY|DECRYPTION_KEY|CIPHER_KEY)\s*[:=]\s*['"`]([A-Za-z0-9+/=\-_]{16,})['"`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'ENCRYPTION_KEY',
+        severity: 'critical',
+    },
+];
+//# sourceMappingURL=generic.js.map

package/dist/scanner/rules/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../src/scanner/rules/generic.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACU,QAAA,YAAY,GAAW;IAClC,mFAAmF;IACnF;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,oDAAoD;QACjE,wEAAwE;QACxE,OAAO,EAAE,gSAAgS;QACzS,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,gFAAgF;QAC7F,+EAA+E;QAC/E,OAAO,EAAE,yOAAyO;QAClP,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,UAAU;KACrB;IACD,oFAAoF;IACpF;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,0EAA0E;QACnF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,UAAU;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD,mFAAmF;IACnF;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,8DAA8D;QACvE,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,UAAU;KACrB;IACD,mFAAmF;IACnF;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,2GAA2G;QACpH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,MAAM;KACjB;IACD,iFAAiF;IACjF;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,wDAAwD;QACrE,0EAA0E;QAC1E,OAAO,EAAE,sHAAsH;QAC/H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,OAAO;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD,0FAA0F;IAC1F;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,oEAAoE;QAC7E,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,4EAA4E;QACrF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,4EAA4E;QACrF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,wFAAwF;QACjG,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,kGAAkG;QAC3G,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,OAAO;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,6FAA6F;QACtG,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,cAAc;QAC5B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,mFAAmF;QAC5F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,mEAAmE;QAC5E,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,mHAAmH;QAC5H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,0BAA0B;QACvC,OAAO,EAAE,uHAAuH;QAChI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,UAAU;QACxB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,6GAA6G;QACtH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,+GAA+G;QACxH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,+GAA+G;QACxH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,kBAAkB;QAChC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,uGAAuG;QAChH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,iFAAiF;QAC1F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,+GAA+G;QACxH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,kHAAkH;QAC3H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,8GAA8G;QACvH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,cAAc;QAC5B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,gEAAgE;QACzE,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,wBAAwB;QACtC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,0FAA0F;QACnG,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,mBAAmB;QACjC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,UAAU;KACrB;IAED,oCAAoC;IACpC;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,4GAA4G;QACrH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,UAAU;KACrB;IACD,uBAAuB;IACvB;QACE,EAAE,EAAE,6BAA6B;QACjC,WAAW,EAAE,wEAAwE;QACrF,OAAO,EAAE,gIAAgI;QACzI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,QAAQ;QACtB,QAAQ,EAAE,UAAU;KACrB;IACD,mBAAmB;IACnB;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,mHAAmH;QAC5H,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD,2BAA2B;IAC3B;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,4KAA4K;QACrL,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,UAAU;KACrB;IAED,iFAAiF;IACjF;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,0EAA0E;QACvF,yEAAyE;QACzE,OAAO,EAAE,oLAAoL;QAC7L,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,SAAS;QACvB,QAAQ,EAAE,UAAU;KACrB;IAED,iFAAiF;IACjF;QACE,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,+GAA+G;QACxH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,UAAU;KACrB;IAED,gFAAgF;IAChF;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,0JAA0J;QACnK,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;CACF,CAAC"}

package/dist/scanner/rules/index.d.ts

@@ -0,0 +1,18 @@
+import { Rule } from '../../types';
+import { genericRules } from './generic';
+import { awsRules } from './aws';
+import { gcpRules } from './gcp';
+import { azureRules } from './azure';
+import { databaseRules } from './database';
+import { jwtRules } from './jwt';
+import { sshRules } from './ssh';
+import { privateKeyRules } from './privateKey';
+import { cloudRules } from './cloud';
+import { networkRules } from './network';
+/**
+ * All detection rules combined in a single flat array.
+ * Order matters: more specific rules should come before generic ones.
+ */
+export declare const ALL_RULES: Rule[];
+export { genericRules, awsRules, gcpRules, azureRules, databaseRules, jwtRules, sshRules, privateKeyRules, cloudRules, networkRules, };
+//# sourceMappingURL=index.d.ts.map

package/dist/scanner/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,SAAS,EAAE,IAAI,EAW3B,CAAC;AAEF,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,aAAa,EACb,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,UAAU,EACV,YAAY,GACb,CAAC"}

package/dist/scanner/rules/index.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkRules = exports.cloudRules = exports.privateKeyRules = exports.sshRules = exports.jwtRules = exports.databaseRules = exports.azureRules = exports.gcpRules = exports.awsRules = exports.genericRules = exports.ALL_RULES = void 0;
+const generic_1 = require("./generic");
+Object.defineProperty(exports, "genericRules", { enumerable: true, get: function () { return generic_1.genericRules; } });
+const aws_1 = require("./aws");
+Object.defineProperty(exports, "awsRules", { enumerable: true, get: function () { return aws_1.awsRules; } });
+const gcp_1 = require("./gcp");
+Object.defineProperty(exports, "gcpRules", { enumerable: true, get: function () { return gcp_1.gcpRules; } });
+const azure_1 = require("./azure");
+Object.defineProperty(exports, "azureRules", { enumerable: true, get: function () { return azure_1.azureRules; } });
+const database_1 = require("./database");
+Object.defineProperty(exports, "databaseRules", { enumerable: true, get: function () { return database_1.databaseRules; } });
+const jwt_1 = require("./jwt");
+Object.defineProperty(exports, "jwtRules", { enumerable: true, get: function () { return jwt_1.jwtRules; } });
+const ssh_1 = require("./ssh");
+Object.defineProperty(exports, "sshRules", { enumerable: true, get: function () { return ssh_1.sshRules; } });
+const privateKey_1 = require("./privateKey");
+Object.defineProperty(exports, "privateKeyRules", { enumerable: true, get: function () { return privateKey_1.privateKeyRules; } });
+const cloud_1 = require("./cloud");
+Object.defineProperty(exports, "cloudRules", { enumerable: true, get: function () { return cloud_1.cloudRules; } });
+const network_1 = require("./network");
+Object.defineProperty(exports, "networkRules", { enumerable: true, get: function () { return network_1.networkRules; } });
+/**
+ * All detection rules combined in a single flat array.
+ * Order matters: more specific rules should come before generic ones.
+ */
+exports.ALL_RULES = [
+    ...aws_1.awsRules,
+    ...gcp_1.gcpRules,
+    ...azure_1.azureRules,
+    ...cloud_1.cloudRules,
+    ...database_1.databaseRules,
+    ...jwt_1.jwtRules,
+    ...ssh_1.sshRules,
+    ...privateKey_1.privateKeyRules,
+    ...network_1.networkRules,
+    ...generic_1.genericRules,
+];
+//# sourceMappingURL=index.js.map

package/dist/scanner/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanner/rules/index.ts"],"names":[],"mappings":";;;AACA,uCAAyC;6FAAhC,sBAAY;AACrB,+BAAiC;yFAAxB,cAAQ;AACjB,+BAAiC;yFAAxB,cAAQ;AACjB,mCAAqC;2FAA5B,kBAAU;AACnB,yCAA2C;8FAAlC,wBAAa;AACtB,+BAAiC;yFAAxB,cAAQ;AACjB,+BAAiC;yFAAxB,cAAQ;AACjB,6CAA+C;gGAAtC,4BAAe;AACxB,mCAAqC;2FAA5B,kBAAU;AACnB,uCAAyC;6FAAhC,sBAAY;AAErB;;;GAGG;AACU,QAAA,SAAS,GAAW;IAC/B,GAAG,cAAQ;IACX,GAAG,cAAQ;IACX,GAAG,kBAAU;IACb,GAAG,kBAAU;IACb,GAAG,wBAAa;IAChB,GAAG,cAAQ;IACX,GAAG,cAAQ;IACX,GAAG,4BAAe;IAClB,GAAG,sBAAY;IACf,GAAG,sBAAY;CAChB,CAAC"}

package/dist/scanner/rules/jwt.d.ts

@@ -0,0 +1,6 @@
+import { Rule } from '../../types';
+/**
+ * JWT and authentication secret patterns.
+ */
+export declare const jwtRules: Rule[];
+//# sourceMappingURL=jwt.d.ts.map

package/dist/scanner/rules/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;GAEG;AACH,eAAO,MAAM,QAAQ,EAAE,IAAI,EAyF1B,CAAC"}

package/dist/scanner/rules/jwt.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtRules = void 0;
+/**
+ * JWT and authentication secret patterns.
+ */
+exports.jwtRules = [
+    {
+        id: 'jwt-secret',
+        description: 'JWT signing secret',
+        pattern: /(?:jwt[_-]?secret(?:[_-]?key)?|JWT_SECRET(?:_KEY)?)\s*[:=]\s*['"\`]([^'"\`\n]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'JWT_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'jwt-private-key',
+        description: 'JWT private key (RS256/ES256)',
+        pattern: /(?:jwt[_-]?private[_-]?key|JWT_PRIVATE_KEY)\s*[:=]\s*['"\`]([^'"\`\n]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'JWT_PRIVATE_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'jwt-public-key',
+        description: 'JWT public key',
+        pattern: /(?:jwt[_-]?public[_-]?key|JWT_PUBLIC_KEY)\s*[:=]\s*['"\`]([^'"\`\n]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'JWT_PUBLIC_KEY',
+        severity: 'medium',
+    },
+    {
+        id: 'jwt-token-literal',
+        description: 'Hardcoded JWT token (three base64url parts)',
+        pattern: /['"\`](eyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_.+/=]+)['"\`]/,
+        valueGroup: 1,
+        envKeyPrefix: 'JWT_TOKEN',
+        severity: 'critical',
+    },
+    {
+        id: 'session-secret',
+        description: 'Express/web framework session secret',
+        pattern: /(?:session[_-]?secret|SESSION_SECRET|cookie[_-]?secret|COOKIE_SECRET)\s*[:=]\s*['"\`]([^'"\`\n]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SESSION_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'nextauth-secret',
+        description: 'NextAuth.js / Auth.js secret',
+        pattern: /(?:NEXTAUTH_SECRET|AUTH_SECRET)\s*[:=]\s*['"\`]([^'"\`\n]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'NEXTAUTH_SECRET',
+        severity: 'critical',
+    },
+    {
+        id: 'oauth2-token',
+        description: 'OAuth2 access or refresh token assignment',
+        pattern: /(?:oauth2?[_-]?(?:access[_-]?|refresh[_-]?)?token|OAUTH_TOKEN|OAUTH2_TOKEN)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{20,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'OAUTH_TOKEN',
+        severity: 'critical',
+    },
+    {
+        id: 'csrf-secret',
+        description: 'CSRF secret or token secret',
+        pattern: /(?:csrf[_-]?secret|csrf[_-]?token[_-]?secret|CSRF_SECRET)\s*[:=]\s*['"\`]([^'"\`\n]{8,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'CSRF_SECRET',
+        severity: 'high',
+    },
+    {
+        id: 'flask-secret-key',
+        description: 'Flask SECRET_KEY assignment',
+        pattern: /(?:SECRET_KEY|app\.secret_key|app\.config\[.SECRET_KEY.\])\s*[:=]\s*['"\`]([^'"\`\n]{8,})['"\`]/,
+        valueGroup: 1,
+        envKeyPrefix: 'FLASK_SECRET_KEY',
+        severity: 'critical',
+    },
+    {
+        id: 'rails-secret-key-base',
+        description: 'Rails secret_key_base',
+        pattern: /(?:secret_key_base|SECRET_KEY_BASE)\s*[:=]\s*['"\`]([a-f0-9]{128,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'SECRET_KEY_BASE',
+        severity: 'critical',
+    },
+    {
+        id: 'api-auth-token',
+        description: 'API authentication token header value',
+        pattern: /(?:x[_-]?api[_-]?(?:key|token)|x[_-]?auth[_-]?token|X_API_KEY|X_AUTH_TOKEN)\s*[:=]\s*['"\`]([A-Za-z0-9\-_.~+/=]{16,})['"\`]/i,
+        valueGroup: 1,
+        envKeyPrefix: 'API_AUTH_TOKEN',
+        severity: 'critical',
+    },
+];
+//# sourceMappingURL=jwt.js.map

package/dist/scanner/rules/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/scanner/rules/jwt.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACU,QAAA,QAAQ,GAAW;IAC9B;QACE,EAAE,EAAE,YAAY;QAChB,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,2FAA2F;QACpG,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,YAAY;QAC1B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,oFAAoF;QAC7F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,gBAAgB;QAC7B,OAAO,EAAE,kFAAkF;QAC3F,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,2EAA2E;QACpF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,6GAA6G;QACtH,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,uEAAuE;QAChF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,iGAAiG;QAC1G,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,aAAa;QAC3B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,6BAA6B;QAC1C,OAAO,EAAE,iGAAiG;QAC1G,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,kBAAkB;QAChC,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,4EAA4E;QACrF,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,8HAA8H;QACvI,UAAU,EAAE,CAAC;QACb,YAAY,EAAE,gBAAgB;QAC9B,QAAQ,EAAE,UAAU;KACrB;CACF,CAAC"}

package/dist/scanner/rules/network.d.ts

@@ -0,0 +1,7 @@
+import { Rule } from '../../types';
+/**
+ * Network, infrastructure, and communication credential patterns.
+ * Covers: SMTP, proxy, VPN, Twilio SMS, mail servers, webhooks, etc.
+ */
+export declare const networkRules: Rule[];
+//# sourceMappingURL=network.d.ts.map

package/dist/scanner/rules/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../src/scanner/rules/network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,IAAI,EAiK9B,CAAC"}