codeslick-cli 1.0.0

package/dist/src/lib/analyzers/secrets/patterns/api-keys.d.ts

@@ -0,0 +1,15 @@
+/**
+ * API Keys Pattern Index
+ *
+ * Combines all API key patterns from various providers.
+ * Total: 23 patterns across 7 categories.
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+import { SecretPattern } from '../secrets-analyzer';
+/**
+ * All API key patterns combined
+ */
+export declare const API_KEY_PATTERNS: SecretPattern[];
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/src/lib/analyzers/secrets/patterns/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/api-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,EAQ3C,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/api-keys.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * API Keys Pattern Index
+ *
+ * Combines all API key patterns from various providers.
+ * Total: 23 patterns across 7 categories.
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.API_KEY_PATTERNS = void 0;
+const aws_1 = require("./api-keys/aws");
+const github_1 = require("./api-keys/github");
+const stripe_1 = require("./api-keys/stripe");
+const ai_providers_1 = require("./api-keys/ai-providers");
+const communication_1 = require("./api-keys/communication");
+const cloud_providers_1 = require("./api-keys/cloud-providers");
+const generic_1 = require("./api-keys/generic");
+/**
+ * All API key patterns combined
+ */
+exports.API_KEY_PATTERNS = [
+    ...aws_1.AWS_PATTERNS,
+    ...github_1.GITHUB_PATTERNS,
+    ...stripe_1.STRIPE_PATTERNS,
+    ...ai_providers_1.AI_PROVIDER_PATTERNS,
+    ...communication_1.COMMUNICATION_PATTERNS,
+    ...cloud_providers_1.CLOUD_PROVIDER_PATTERNS,
+    ...generic_1.GENERIC_PATTERNS,
+];
+//# sourceMappingURL=api-keys.js.map

package/dist/src/lib/analyzers/secrets/patterns/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/api-keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAGH,wCAA8C;AAC9C,8CAAoD;AACpD,8CAAoD;AACpD,0DAA+D;AAC/D,4DAAkE;AAClE,gEAAqE;AACrE,gDAAsD;AAEtD;;GAEG;AACU,QAAA,gBAAgB,GAAoB;IAC/C,GAAG,kBAAY;IACf,GAAG,wBAAe;IAClB,GAAG,wBAAe;IAClB,GAAG,mCAAoB;IACvB,GAAG,sCAAsB;IACzB,GAAG,yCAAuB;IAC1B,GAAG,0BAAgB;CACpB,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/credentials.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Credentials Pattern Detection
+ *
+ * Detects hardcoded credentials:
+ * - Database passwords
+ * - Generic passwords
+ * - JWT secrets
+ * - Database connection strings
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+import { SecretPattern } from '../secrets-analyzer';
+export declare const CREDENTIAL_PATTERNS: SecretPattern[];
+//# sourceMappingURL=credentials.d.ts.map

package/dist/src/lib/analyzers/secrets/patterns/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,eAAO,MAAM,mBAAmB,EAAE,aAAa,EAmD9C,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/credentials.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * Credentials Pattern Detection
+ *
+ * Detects hardcoded credentials:
+ * - Database passwords
+ * - Generic passwords
+ * - JWT secrets
+ * - Database connection strings
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_PATTERNS = void 0;
+exports.CREDENTIAL_PATTERNS = [
+    {
+        id: 'database-password',
+        name: 'Database Password',
+        pattern: /(?:db[_-]?password|database[_-]?password)\s*[:=]\s*['"]([^'"]{8,})['"]/i,
+        minEntropy: 3.0,
+        description: 'Database password hardcoded in source code',
+        severity: 'critical',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+    {
+        id: 'generic-password',
+        name: 'Generic Password',
+        pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"]([^'"]{8,})['"]/i,
+        minEntropy: 3.0,
+        description: 'Password hardcoded in source code',
+        severity: 'high',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+    {
+        id: 'jwt-secret',
+        name: 'JWT Secret',
+        pattern: /(?:jwt[_-]?secret|token[_-]?secret)\s*[:=]\s*['"]([^'"]{16,})['"]/i,
+        minEntropy: 4.0,
+        description: 'JWT secret hardcoded - allows token forgery',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-321',
+    },
+    {
+        id: 'database-connection-string',
+        name: 'Database Connection String',
+        pattern: /(?:postgres|mysql|mongodb):\/\/[^:]+:[^@]+@/i,
+        minEntropy: 3.0,
+        description: 'Database connection string with credentials',
+        severity: 'critical',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+    {
+        id: 'encryption-key',
+        name: 'Encryption Key',
+        pattern: /(?:encryption[_-]?key|encrypt[_-]?key)\s*[:=]\s*['"]([A-Za-z0-9+/=]{32,})['"]/i,
+        minEntropy: 4.5,
+        description: 'Encryption key hardcoded in source code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-321',
+    },
+];
+//# sourceMappingURL=credentials.js.map

package/dist/src/lib/analyzers/secrets/patterns/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAIU,QAAA,mBAAmB,GAAoB;IAClD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,yEAAyE;QAClF,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,4CAA4C;QACzD,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,uDAAuD;QAChE,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,oEAAoE;QAC7E,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,8CAA8C;QACvD,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gFAAgF;QACzF,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;CACF,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/private-keys.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Private Keys Pattern Detection
+ *
+ * Detects hardcoded private keys:
+ * - RSA Private Keys
+ * - SSH Private Keys
+ * - PGP Private Keys
+ * - EC Private Keys
+ * - DSA Private Keys
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+import { SecretPattern } from '../secrets-analyzer';
+export declare const PRIVATE_KEY_PATTERNS: SecretPattern[];
+//# sourceMappingURL=private-keys.d.ts.map

package/dist/src/lib/analyzers/secrets/patterns/private-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-keys.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/private-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,eAAO,MAAM,oBAAoB,EAAE,aAAa,EA6D/C,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/private-keys.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Private Keys Pattern Detection
+ *
+ * Detects hardcoded private keys:
+ * - RSA Private Keys
+ * - SSH Private Keys
+ * - PGP Private Keys
+ * - EC Private Keys
+ * - DSA Private Keys
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRIVATE_KEY_PATTERNS = void 0;
+exports.PRIVATE_KEY_PATTERNS = [
+    {
+        id: 'rsa-private-key',
+        name: 'RSA Private Key',
+        pattern: /-----BEGIN RSA PRIVATE KEY-----/,
+        minEntropy: 3.0, // Lower threshold - very specific marker
+        description: 'RSA private key detected in code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-312',
+    },
+    {
+        id: 'ssh-private-key',
+        name: 'SSH Private Key',
+        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/,
+        minEntropy: 3.0, // Lower threshold - very specific marker
+        description: 'SSH private key detected in code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-312',
+    },
+    {
+        id: 'pgp-private-key',
+        name: 'PGP Private Key',
+        pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----/,
+        minEntropy: 3.0, // Lower threshold - very specific marker
+        description: 'PGP private key detected in code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-312',
+    },
+    {
+        id: 'ec-private-key',
+        name: 'EC Private Key',
+        pattern: /-----BEGIN EC PRIVATE KEY-----/,
+        minEntropy: 3.0, // Lower threshold - very specific marker
+        description: 'Elliptic Curve private key detected in code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-312',
+    },
+    {
+        id: 'dsa-private-key',
+        name: 'DSA Private Key',
+        pattern: /-----BEGIN DSA PRIVATE KEY-----/,
+        minEntropy: 3.0, // Lower threshold - very specific marker
+        description: 'DSA private key detected in code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-312',
+    },
+    {
+        id: 'generic-private-key',
+        name: 'Generic Private Key',
+        pattern: /-----BEGIN PRIVATE KEY-----/,
+        minEntropy: 3.0, // Lower threshold - very specific marker
+        description: 'Generic private key detected in code',
+        severity: 'critical',
+        owaspCategory: 'A02:2021 - Cryptographic Failures',
+        cwe: 'CWE-312',
+    },
+];
+//# sourceMappingURL=private-keys.js.map

package/dist/src/lib/analyzers/secrets/patterns/private-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-keys.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/private-keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAIU,QAAA,oBAAoB,GAAoB;IACnD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,GAAG,EAAG,yCAAyC;QAC3D,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,qCAAqC;QAC9C,UAAU,EAAE,GAAG,EAAG,yCAAyC;QAC3D,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,uCAAuC;QAChD,UAAU,EAAE,GAAG,EAAG,yCAAyC;QAC3D,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,gCAAgC;QACzC,UAAU,EAAE,GAAG,EAAG,yCAAyC;QAC3D,WAAW,EAAE,6CAA6C;QAC1D,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,GAAG,EAAG,yCAAyC;QAC3D,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,6BAA6B;QACtC,UAAU,EAAE,GAAG,EAAG,yCAAyC;QAC3D,WAAW,EAAE,sCAAsC;QACnD,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,mCAAmC;QAClD,GAAG,EAAE,SAAS;KACf;CACF,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/tokens.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Token Pattern Detection
+ *
+ * Detects hardcoded tokens:
+ * - Bearer tokens
+ * - Session tokens
+ * - Auth tokens
+ * - Refresh tokens
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+import { SecretPattern } from '../secrets-analyzer';
+export declare const TOKEN_PATTERNS: SecretPattern[];
+//# sourceMappingURL=tokens.d.ts.map

package/dist/src/lib/analyzers/secrets/patterns/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,eAAO,MAAM,cAAc,EAAE,aAAa,EAyCzC,CAAC"}

package/dist/src/lib/analyzers/secrets/patterns/tokens.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Token Pattern Detection
+ *
+ * Detects hardcoded tokens:
+ * - Bearer tokens
+ * - Session tokens
+ * - Auth tokens
+ * - Refresh tokens
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_PATTERNS = void 0;
+exports.TOKEN_PATTERNS = [
+    {
+        id: 'bearer-token',
+        name: 'Bearer Token',
+        pattern: /Bearer\s+[A-Za-z0-9\-._~+/]+=*/i,
+        minEntropy: 4.0,
+        description: 'Bearer authentication token hardcoded',
+        severity: 'high',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+    {
+        id: 'session-token',
+        name: 'Session Token',
+        pattern: /(?:session[_-]?token|sessiontoken)\s*[:=]\s*['"]([A-Za-z0-9\-_]{32,})['"]/i,
+        minEntropy: 4.0,
+        description: 'Session token hardcoded in source code',
+        severity: 'high',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+    {
+        id: 'auth-token',
+        name: 'Auth Token',
+        pattern: /(?:auth[_-]?token|authtoken)\s*[:=]\s*['"]([A-Za-z0-9\-_]{32,})['"]/i,
+        minEntropy: 4.0,
+        description: 'Authentication token hardcoded in source code',
+        severity: 'high',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+    {
+        id: 'refresh-token',
+        name: 'Refresh Token',
+        pattern: /(?:refresh[_-]?token|refreshtoken)\s*[:=]\s*['"]([A-Za-z0-9\-_]{32,})['"]/i,
+        minEntropy: 4.0,
+        description: 'Refresh token hardcoded in source code',
+        severity: 'high',
+        owaspCategory: 'A07:2021 - Identification and Authentication Failures',
+        cwe: 'CWE-798',
+    },
+];
+//# sourceMappingURL=tokens.js.map

package/dist/src/lib/analyzers/secrets/patterns/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/patterns/tokens.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAIU,QAAA,cAAc,GAAoB;IAC7C;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,uCAAuC;QACpD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,4EAA4E;QACrF,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,wCAAwC;QACrD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,sEAAsE;QAC/E,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,+CAA+C;QAC5D,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;IACD;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,4EAA4E;QACrF,UAAU,EAAE,GAAG;QACf,WAAW,EAAE,wCAAwC;QACrD,QAAQ,EAAE,MAAM;QAChB,aAAa,EAAE,uDAAuD;QACtE,GAAG,EAAE,SAAS;KACf;CACF,CAAC"}

package/dist/src/lib/analyzers/secrets/secrets-analyzer.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Secrets Detection Analyzer
+ *
+ * Detects hardcoded secrets, API keys, passwords, tokens, and private keys in code.
+ *
+ * Features:
+ * - Pattern-based detection (20+ secret types)
+ * - Entropy analysis for high-randomness strings
+ * - Context checking to reduce false positives
+ * - Support for all 4 languages (JavaScript, Python, Java, TypeScript)
+ *
+ * Created: Phase 1.5, Week 1 (Feature #1)
+ * Date: January 7, 2026
+ */
+import { SecurityVulnerability } from '../types';
+/**
+ * Secret pattern definition
+ */
+export interface SecretPattern {
+    /** Pattern identifier (e.g., 'aws-access-key', 'github-token') */
+    id: string;
+    /** Human-readable name */
+    name: string;
+    /** Regex pattern to match the secret */
+    pattern: RegExp;
+    /** Minimum entropy threshold (0-8, where 8 is maximum randomness) */
+    minEntropy?: number;
+    /** Description of the secret type */
+    description: string;
+    /** Severity: 'critical', 'high', 'medium' */
+    severity: 'critical' | 'high' | 'medium';
+    /** OWASP 2025 category */
+    owaspCategory: string;
+    /** CWE identifier */
+    cwe: string;
+}
+/**
+ * Secret detection result
+ */
+export interface SecretMatch {
+    pattern: SecretPattern;
+    value: string;
+    line: number;
+    column: number;
+    entropy: number;
+    context: string;
+}
+/**
+ * Main secrets analyzer class
+ */
+export declare class SecretsAnalyzer {
+    private patterns;
+    constructor();
+    /**
+     * Analyze code for hardcoded secrets
+     *
+     * @param code - Source code to analyze
+     * @param filePath - File path (for context)
+     * @param language - Programming language
+     * @returns Array of security vulnerabilities
+     */
+    analyzeCode(code: string, filePath: string, language: 'javascript' | 'python' | 'java' | 'typescript'): SecurityVulnerability[];
+    /**
+     * Find pattern matches in a line of code
+     */
+    private findMatches;
+    /**
+     * Create a security vulnerability from a secret match
+     */
+    private createVulnerability;
+    /**
+     * Mask secret value for evidence (show only first/last few characters)
+     */
+    private maskSecret;
+    /**
+     * Get fix recommendation based on secret type and language
+     */
+    private getRecommendation;
+    /**
+     * Calculate confidence score (0-100) based on entropy and context
+     */
+    private calculateConfidence;
+}
+/**
+ * Factory function for creating secrets analyzer
+ */
+export declare function createSecretsAnalyzer(): SecretsAnalyzer;
+//# sourceMappingURL=secrets-analyzer.d.ts.map

package/dist/src/lib/analyzers/secrets/secrets-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-analyzer.d.ts","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/secrets/secrets-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzC,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAkB;;IAYlC;;;;;;;OAOG;IACI,WAAW,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,GACxD,qBAAqB,EAAE;IAiC1B;;OAEG;IACH,OAAO,CAAC,WAAW;IA4BnB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAiB5B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CAEvD"}

package/dist/src/lib/analyzers/secrets/secrets-analyzer.js

@@ -0,0 +1,162 @@
+"use strict";
+/**
+ * Secrets Detection Analyzer
+ *
+ * Detects hardcoded secrets, API keys, passwords, tokens, and private keys in code.
+ *
+ * Features:
+ * - Pattern-based detection (20+ secret types)
+ * - Entropy analysis for high-randomness strings
+ * - Context checking to reduce false positives
+ * - Support for all 4 languages (JavaScript, Python, Java, TypeScript)
+ *
+ * Created: Phase 1.5, Week 1 (Feature #1)
+ * Date: January 7, 2026
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsAnalyzer = void 0;
+exports.createSecretsAnalyzer = createSecretsAnalyzer;
+const api_keys_1 = require("./patterns/api-keys");
+const private_keys_1 = require("./patterns/private-keys");
+const credentials_1 = require("./patterns/credentials");
+const tokens_1 = require("./patterns/tokens");
+const entropy_checker_1 = require("./validators/entropy-checker");
+const context_checker_1 = require("./validators/context-checker");
+/**
+ * Main secrets analyzer class
+ */
+class SecretsAnalyzer {
+    constructor() {
+        // Combine all patterns from different categories
+        this.patterns = [
+            ...api_keys_1.API_KEY_PATTERNS,
+            ...private_keys_1.PRIVATE_KEY_PATTERNS,
+            ...credentials_1.CREDENTIAL_PATTERNS,
+            ...tokens_1.TOKEN_PATTERNS,
+        ];
+    }
+    /**
+     * Analyze code for hardcoded secrets
+     *
+     * @param code - Source code to analyze
+     * @param filePath - File path (for context)
+     * @param language - Programming language
+     * @returns Array of security vulnerabilities
+     */
+    analyzeCode(code, filePath, language) {
+        const vulnerabilities = [];
+        const lines = code.split('\n');
+        // Scan each line for secrets
+        for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+            const line = lines[lineIndex];
+            const lineNumber = lineIndex + 1;
+            // Check against all patterns
+            for (const pattern of this.patterns) {
+                const matches = this.findMatches(line, pattern, lineNumber);
+                for (const match of matches) {
+                    // Validate entropy if required
+                    if (pattern.minEntropy && match.entropy < pattern.minEntropy) {
+                        continue; // Skip low-entropy matches
+                    }
+                    // Check for false positives
+                    if ((0, context_checker_1.isLikelyFalsePositive)(match.value, match.context, filePath)) {
+                        continue; // Skip likely false positives
+                    }
+                    // Create vulnerability
+                    vulnerabilities.push(this.createVulnerability(match, filePath, language));
+                }
+            }
+        }
+        return vulnerabilities;
+    }
+    /**
+     * Find pattern matches in a line of code
+     */
+    findMatches(line, pattern, lineNumber) {
+        const matches = [];
+        let match;
+        // Use global flag to find all matches
+        const regex = new RegExp(pattern.pattern.source, 'g');
+        while ((match = regex.exec(line)) !== null) {
+            const value = match[0];
+            const entropy = (0, entropy_checker_1.calculateEntropy)(value);
+            matches.push({
+                pattern,
+                value,
+                line: lineNumber,
+                column: match.index,
+                entropy,
+                context: line.trim(),
+            });
+        }
+        return matches;
+    }
+    /**
+     * Create a security vulnerability from a secret match
+     */
+    createVulnerability(match, filePath, language) {
+        return {
+            severity: match.pattern.severity,
+            message: `Hardcoded secret detected: ${match.pattern.name} - ${this.maskSecret(match.value)}`,
+            line: match.line,
+            suggestion: this.getRecommendation(match.pattern, language),
+            category: `hardcoded-secret-${match.pattern.id}`,
+            owasp: match.pattern.owaspCategory,
+            cwe: match.pattern.cwe,
+        };
+    }
+    /**
+     * Mask secret value for evidence (show only first/last few characters)
+     */
+    maskSecret(value) {
+        if (value.length <= 8) {
+            return '***';
+        }
+        const first = value.substring(0, 4);
+        const last = value.substring(value.length - 4);
+        return `${first}...${last}`;
+    }
+    /**
+     * Get fix recommendation based on secret type and language
+     */
+    getRecommendation(pattern, language) {
+        const baseRecommendation = pattern.description;
+        const envVarExample = language === 'python'
+            ? 'os.environ.get("API_KEY")'
+            : language === 'java'
+                ? 'System.getenv("API_KEY")'
+                : 'process.env.API_KEY';
+        return `${baseRecommendation}\n\nRecommended fix:\n` +
+            `1. Move secret to environment variable\n` +
+            `2. Load from secure vault (AWS Secrets Manager, HashiCorp Vault)\n` +
+            `3. Use: ${envVarExample}\n` +
+            `4. Add to .gitignore if stored in config file\n` +
+            `5. Rotate the exposed secret immediately`;
+    }
+    /**
+     * Calculate confidence score (0-100) based on entropy and context
+     */
+    calculateConfidence(match) {
+        let confidence = 70; // Base confidence
+        // Higher entropy = higher confidence
+        if (match.entropy > 4.5) {
+            confidence += 20;
+        }
+        else if (match.entropy > 3.5) {
+            confidence += 10;
+        }
+        // Known pattern structure = higher confidence
+        if (match.pattern.id.includes('aws') || match.pattern.id.includes('github')) {
+            confidence += 10;
+        }
+        return Math.min(confidence, 100);
+    }
+}
+exports.SecretsAnalyzer = SecretsAnalyzer;
+/**
+ * Factory function for creating secrets analyzer
+ */
+function createSecretsAnalyzer() {
+    return new SecretsAnalyzer();
+}
+//# sourceMappingURL=secrets-analyzer.js.map

package/dist/src/lib/analyzers/secrets/secrets-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-analyzer.js","sourceRoot":"","sources":["../../../../../../../src/lib/analyzers/secrets/secrets-analyzer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAoNH,sDAEC;AAnND,kDAAuD;AACvD,0DAA+D;AAC/D,wDAA6D;AAC7D,8CAAmD;AACnD,kEAAgE;AAChE,kEAAqE;AAoCrE;;GAEG;AACH,MAAa,eAAe;IAG1B;QACE,iDAAiD;QACjD,IAAI,CAAC,QAAQ,GAAG;YACd,GAAG,2BAAgB;YACnB,GAAG,mCAAoB;YACvB,GAAG,iCAAmB;YACtB,GAAG,uBAAc;SAClB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,WAAW,CAChB,IAAY,EACZ,QAAgB,EAChB,QAAyD;QAEzD,MAAM,eAAe,GAA4B,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,6BAA6B;QAC7B,KAAK,IAAI,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,UAAU,GAAG,SAAS,GAAG,CAAC,CAAC;YAEjC,6BAA6B;YAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;gBAE5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;oBAC5B,+BAA+B;oBAC/B,IAAI,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;wBAC7D,SAAS,CAAC,2BAA2B;oBACvC,CAAC;oBAED,4BAA4B;oBAC5B,IAAI,IAAA,uCAAqB,EAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;wBAChE,SAAS,CAAC,8BAA8B;oBAC1C,CAAC;oBAED,uBAAuB;oBACvB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;OAEG;IACK,WAAW,CACjB,IAAY,EACZ,OAAsB,EACtB,UAAkB;QAElB,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,IAAI,KAA6B,CAAC;QAElC,sCAAsC;QACtC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAEtD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,IAAA,kCAAgB,EAAC,KAAK,CAAC,CAAC;YAExC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO;gBACP,KAAK;gBACL,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,KAAK,CAAC,KAAK;gBACnB,OAAO;gBACP,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,KAAkB,EAClB,QAAgB,EAChB,QAAgB;QAEhB,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;YAChC,OAAO,EAAE,8BAA8B,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;YAC7F,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC3D,QAAQ,EAAE,oBAAoB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE;YAChD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;YAClC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;SACvB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,KAAa;QAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/C,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAsB,EAAE,QAAgB;QAChE,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC;QAE/C,MAAM,aAAa,GAAG,QAAQ,KAAK,QAAQ;YACzC,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,QAAQ,KAAK,MAAM;gBACrB,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,qBAAqB,CAAC;QAE1B,OAAO,GAAG,kBAAkB,wBAAwB;YAClD,0CAA0C;YAC1C,oEAAoE;YACpE,WAAW,aAAa,IAAI;YAC5B,iDAAiD;YACjD,0CAA0C,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,KAAkB;QAC5C,IAAI,UAAU,GAAG,EAAE,CAAC,CAAC,kBAAkB;QAEvC,qCAAqC;QACrC,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YACxB,UAAU,IAAI,EAAE,CAAC;QACnB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;YAC/B,UAAU,IAAI,EAAE,CAAC;QACnB,CAAC;QAED,8CAA8C;QAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,UAAU,IAAI,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AAhKD,0CAgKC;AAED;;GAEG;AACH,SAAgB,qBAAqB;IACnC,OAAO,IAAI,eAAe,EAAE,CAAC;AAC/B,CAAC"}

package/dist/src/lib/analyzers/secrets/validators/context-checker.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Context Checker
+ *
+ * Reduces false positives by analyzing code context.
+ * Identifies safe patterns like:
+ * - Test files
+ * - Example code
+ * - Documentation
+ * - Placeholder values
+ * - Environment variable references
+ *
+ * Created: Phase 1.5, Week 1
+ * Date: January 7, 2026
+ */
+/**
+ * Check if value is a placeholder (not a real secret)
+ *
+ * @param value - Secret value to check
+ * @returns True if value is a placeholder
+ */
+export declare function isPlaceholder(value: string): boolean;
+/**
+ * Check if context indicates safe usage (not a real secret)
+ *
+ * @param context - Line of code containing the secret
+ * @returns True if context is safe
+ */
+export declare function isSafeContext(context: string): boolean;
+/**
+ * Check if file is test/example/documentation
+ *
+ * @param filePath - File path to check
+ * @returns True if file is test/example/docs
+ */
+export declare function isSafeFile(filePath: string): boolean;
+/**
+ * Check if value is likely a false positive
+ * Combines all heuristics to determine if secret detection should be skipped
+ *
+ * @param value - Secret value detected
+ * @param context - Line of code containing the secret
+ * @param filePath - File path
+ * @returns True if likely false positive
+ */
+export declare function isLikelyFalsePositive(value: string, context: string, filePath: string): boolean;
+/**
+ * Calculate confidence score (0-100) based on context
+ * Lower score = more likely false positive
+ *
+ * @param value - Secret value detected
+ * @param context - Line of code
+ * @param filePath - File path
+ * @returns Confidence score (0-100)
+ */
+export declare function calculateContextConfidence(value: string, context: string, filePath: string): number;
+//# sourceMappingURL=context-checker.d.ts.map

package/dist/src/lib/analyzers/secrets/validators/context-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-checker.d.ts","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/secrets/validators/context-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAwEH;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAqBpD;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAuBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,MAAM,CAwBR"}