entkapp 4.1.0

package/src/ast/OxcAnalyzer.js

@@ -0,0 +1,337 @@
+export class OxcAnalyzer {
+  constructor(context) {
+    this.context = context;
+    this.oxc = null;
+    this.isAvailable = false;
+    // Initialization is handled via init() or lazily during parseFile
+  }
+
+  async init() {
+    if (this.isAvailable) return true;
+    try {
+      // In ESM, we use dynamic import()
+      const oxc = await import("oxc-parser");
+      this.oxc = oxc;
+      this.isAvailable = true;
+      return true;
+    } catch (e) {
+      try {
+        // Fallback for older node versions or specific bundling setups
+        const { createRequire } = await import('module');
+        const require = createRequire(import.meta.url);
+        this.oxc = require("oxc-parser");
+        this.isAvailable = true;
+        return true;
+      } catch (err) {
+        this.isAvailable = false;
+        if (this.context.verbose) {
+          console.warn("[OxcAnalyzer] oxc-parser not found or failed to load, falling back to TypeScript compiler API.");
+        }
+        return false;
+      }
+    }
+  }
+
+  async parseFile(filePath, content, fileNode) {
+    if (!this.isAvailable) {
+      const initialized = await this.init();
+      if (!initialized) return false;
+    }
+
+    try {
+      if (this.context.verbose) {
+        console.log(`[OXC] Fast-parsing: ${filePath}`);
+      }
+
+      const ast = this.oxc.parseSync(content, {
+        sourceType: "module",
+        sourceFilename: filePath,
+        ecmaVersion: "latest",
+      });
+
+      // Initialize new properties for JSX and Decorator analysis
+      fileNode.jsxComponents = new Set();
+      fileNode.jsxProps = new Set();
+      fileNode.decorators = new Set();
+
+      this.walkOxcAst(ast.program, fileNode, content);
+      
+      // Compute line/column for each export start position
+      const lines = content.split('\n');
+      const getLineCol = (pos) => {
+        let count = 0;
+        for (let i = 0; i < lines.length; i++) {
+          if (count + lines[i].length + 1 > pos) {
+            return { line: i + 1, column: pos - count + 1 };
+          }
+          count += lines[i].length + 1;
+        }
+        return { line: 1, column: 1 };
+      };
+
+      for (const [name, meta] of fileNode.internalExports.entries()) {
+        if (meta.start !== undefined) {
+          fileNode.symbolSourceLocations.set(name, getLineCol(meta.start));
+        }
+      }
+
+      return true;
+    } catch (e) {
+      if (this.context.verbose) {
+        console.warn(`[OXC] Failed to parse ${filePath}: ${e.message}`);
+      }
+      return false;
+    }
+  }
+
+  walkOxcAst(node, fileNode, content) {
+    if (!node) return;
+
+    switch (node.type) {
+      case "ImportDeclaration":
+        this.handleImportDeclaration(node, fileNode);
+        break;
+      case "ExportNamedDeclaration":
+      case "ExportDefaultDeclaration":
+      case "ExportAllDeclaration":
+        this.handleExportDeclaration(node, fileNode, content);
+        break;
+      case "CallExpression":
+        this.handleCallExpression(node, fileNode);
+        break;
+      case "JSXElement":
+      case "JSXFragment": // Consider fragments as well
+        this.handleJsxElement(node, fileNode);
+        break;
+      case "Decorator":
+        this.handleDecorator(node, fileNode);
+        break;
+      case "StringLiteral":
+        // Track for secret scanning if it looks like a secret
+        fileNode.rawStringReferences.add(node.value);
+        break;
+    }
+
+    // Traverse children
+    for (const key in node) {
+      if (node[key] && typeof node[key] === "object") {
+        if (Array.isArray(node[key])) {
+          node[key].forEach((child) => this.walkOxcAst(child, fileNode, content));
+        } else {
+          this.walkOxcAst(node[key], fileNode, content);
+        }
+      }
+    }
+  }
+
+  handleImportDeclaration(node, fileNode) {
+    const specifier = node.source.value;
+    fileNode.explicitImports.add(specifier);
+
+    // Track external package usage for dependency analysis
+    if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
+      fileNode.externalPackageUsage.add(this._extractPackageName(specifier));
+    }
+
+    if (node.specifiers) {
+      node.specifiers.forEach((spec) => {
+        if (spec.type === "ImportSpecifier") {
+          const importedName = spec.imported.name;
+          fileNode.importedSymbols.add(`${specifier}:${importedName}`);
+        } else if (spec.type === "ImportDefaultSpecifier") {
+          fileNode.importedSymbols.add(`${specifier}:default`);
+        } else if (spec.type === "ImportNamespaceSpecifier") {
+          fileNode.importedSymbols.add(`${specifier}:*`);
+        }
+      });
+    }
+  }
+
+  handleExportDeclaration(node, fileNode, content) {
+    if (node.type === "ExportDefaultDeclaration") {
+      fileNode.internalExports.set("default", { type: "default", start: node.start, end: node.end });
+      return;
+    }
+
+    if (node.type === "ExportAllDeclaration") {
+      const sourceSpecifier = node.source ? node.source.value : null;
+      if (sourceSpecifier) {
+        // Register re-export source as an explicit import so the graph linker
+        // creates an incomingEdge on the re-exported file.
+        fileNode.explicitImports.add(sourceSpecifier);
+
+        // Track external package usage from re-exports
+        if (!sourceSpecifier.startsWith('.') && !sourceSpecifier.startsWith('/')) {
+          fileNode.externalPackageUsage.add(this._extractPackageName(sourceSpecifier));
+        }
+
+        if (node.exported) {
+          // export * as name from 'module'
+          const name = node.exported.name || (node.exported.type === "Identifier" ? node.exported.name : null);
+          if (name) {
+            fileNode.internalExports.set(name, { type: "re-export-namespace", source: sourceSpecifier, originalName: "*", start: node.start, end: node.end });
+            fileNode.importedSymbols.add(`${sourceSpecifier}:*`);
+          }
+        } else {
+          // export * from 'module'
+          fileNode.internalExports.set("*", { type: "re-export-all", source: sourceSpecifier });
+          // Register as wildcard importedSymbol so graph linker creates incomingEdge
+          fileNode.importedSymbols.add(`${sourceSpecifier}:*`);
+        }
+      }
+      return;
+    }
+
+    if (node.source) {
+      // Re-export with source: export { x } from 'module'
+      const specifier = node.source.value;
+      // Register re-export source as an explicit import
+      fileNode.explicitImports.add(specifier);
+
+      // Track external package usage from re-exports
+      if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
+        fileNode.externalPackageUsage.add(this._extractPackageName(specifier));
+      }
+
+      if (node.specifiers) {
+        node.specifiers.forEach((spec) => {
+          const exportedName = spec.exported.name;
+          const localName = spec.local.name;
+          fileNode.internalExports.set(exportedName, {
+            type: "re-export",
+            source: specifier,
+            originalName: localName,
+            start: node.start,
+            end: node.end,
+          });
+          // Register as importedSymbol so barrel-tracer can resolve origin file
+          fileNode.importedSymbols.add(`${specifier}:${localName}`);
+        });
+      }
+    } else if (node.declaration) {
+      // Direct export
+      const decl = node.declaration;
+      if (decl.type === "VariableDeclaration") {
+        decl.declarations.forEach((d) => {
+          if (d.id.type === "Identifier") {
+            fileNode.internalExports.set(d.id.name, { type: "variable", start: d.start, end: d.end });
+          } else if (d.id.type === "ObjectPattern") {
+            d.id.properties.forEach((p) => {
+              if (p.type === "Property" && p.value.type === "Identifier") {
+                fileNode.internalExports.set(p.value.name, { type: "variable", start: p.start, end: p.end });
+              }
+            });
+          } else if (d.id.type === "ArrayPattern") {
+            d.id.elements.forEach((e) => {
+              if (e && e.type === "Identifier") {
+                fileNode.internalExports.set(e.name, { type: "variable", start: e.start, end: e.end });
+              }
+            });
+          }
+        });
+      } else if (decl.id && decl.id.name) {
+        let type = "unknown";
+        if (decl.type === "FunctionDeclaration") type = "function";
+        else if (decl.type === "ClassDeclaration") type = "class";
+        else if (decl.type === "TSEnumDeclaration") type = "enum";
+        else if (decl.type === "TSInterfaceDeclaration") type = "interface";
+        else if (decl.type === "TSTypeAliasDeclaration") type = "type";
+        else if (decl.type === "TSModuleDeclaration") type = "namespace";
+
+        const exportInfo = { type, start: decl.start, end: decl.end };
+        fileNode.internalExports.set(decl.id.name, exportInfo);
+
+        if (decl.type === "TSEnumDeclaration") {
+          exportInfo.members = decl.members.map((m) => m.id.name || (m.id.type === "Identifier" ? m.id.name : ""));
+        } else if (decl.type === "TSInterfaceDeclaration" || decl.type === "ClassDeclaration") {
+          exportInfo.members = decl.body.body.filter((m) => m.key && m.key.name).map((m) => m.key.name);
+        }
+      }
+    } else if (node.specifiers) {
+      node.specifiers.forEach((spec) => {
+        const exportedName = spec.exported.name;
+        const localName = spec.local.name;
+        fileNode.internalExports.set(exportedName, {
+          type: "export",
+          originalName: localName,
+          start: node.start,
+          end: node.end,
+        });
+      });
+    }
+  }
+
+  handleCallExpression(node, fileNode) {
+    // Dynamic import(): import('./module')
+    if (node.callee.type === "Import" && node.arguments.length > 0) {
+      const arg = node.arguments[0];
+      if (arg.type === "StringLiteral") {
+        const specifier = arg.value;
+        fileNode.explicitImports.add(specifier);
+        fileNode.dynamicImports.add(specifier);
+        if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
+          fileNode.externalPackageUsage.add(this._extractPackageName(specifier));
+        }
+      } else {
+        // Non-literal dynamic import: record as calculated
+        if (fileNode.calculatedDynamicImports) {
+          fileNode.calculatedDynamicImports.push({ kind: arg.type, start: arg.start });
+        }
+      }
+    } else if (node.callee.type === "Identifier" && node.callee.name === "require" && node.arguments.length > 0 && node.arguments[0].type === "StringLiteral") {
+      const specifier = node.arguments[0].value;
+      fileNode.explicitImports.add(specifier);
+      if (!specifier.startsWith('.') && !specifier.startsWith('/')) {
+        fileNode.externalPackageUsage.add(this._extractPackageName(specifier));
+      }
+    }
+  }
+
+  handleJsxElement(node, fileNode) {
+    const getElementName = (nameNode) => {
+      if (nameNode.type === "JSXIdentifier") return nameNode.name;
+      if (nameNode.type === "JSXMemberExpression") return `${getElementName(nameNode.object)}.${nameNode.property.name}`;
+      return "unknown";
+    };
+
+    if (node.openingElement) {
+      const tagName = getElementName(node.openingElement.name);
+      fileNode.jsxComponents.add(tagName);
+
+      if (node.openingElement.attributes) {
+        node.openingElement.attributes.forEach(attr => {
+          if (attr.type === "JSXAttribute" && attr.name.type === "JSXIdentifier") {
+            fileNode.jsxProps.add(`${tagName}:${attr.name.name}`);
+          }
+        });
+      }
+    }
+  }
+
+  handleDecorator(node, fileNode) {
+    const getDecoratorName = (expr) => {
+      if (expr.type === "Identifier") return expr.name;
+      if (expr.type === "CallExpression" && expr.callee.type === "Identifier") return expr.callee.name;
+      if (expr.type === "CallExpression" && expr.callee.type === "MemberExpression" && expr.callee.property.type === "Identifier") return expr.callee.property.name;
+      return "unknown";
+    };
+
+    const decoratorName = getDecoratorName(node.expression);
+    fileNode.decorators.add(decoratorName);
+
+    // Optionally, extract decorator arguments
+    if (node.expression.type === "CallExpression") {
+      node.expression.arguments.forEach(arg => {
+        // Further analysis of arguments can be done here if needed
+      });
+    }
+  }
+
+  _extractPackageName(specifier) {
+    if (specifier.startsWith('@')) {
+      const parts = specifier.split('/');
+      return parts.length >= 2 ? `${parts[0]}/${parts[1]}` : specifier;
+    }
+    return specifier.split('/')[0];
+  }
+}

package/src/ast/SecretScanner.js

@@ -0,0 +1,304 @@
+/**
+ * ============================================================================
+ * 🔐 SecretScanner – Hardcoded Credential & API Key Detector
+ * ============================================================================
+ * Scans source files for hardcoded secrets such as API keys, tokens,
+ * passwords, and other sensitive credentials using heuristic pattern matching
+ * on both variable names and string literal values.
+ *
+ * New in v3.3.8: integrated into the main analysis pipeline so that secrets
+ * are surfaced alongside dead-code and unused-dependency findings.
+ */
+
+/**
+ * Severity levels for detected secrets.
+ */
+export const SecretSeverity = {
+  CRITICAL: 'CRITICAL',
+  HIGH: 'HIGH',
+  MEDIUM: 'MEDIUM',
+};
+
+/**
+ * Patterns that flag a variable/property *name* as likely containing a secret.
+ * Matched case-insensitively against the identifier text.
+ */
+const SENSITIVE_NAME_PATTERNS = [
+  // Generic credential names
+  /api[_-]?key/i,
+  /apikey/i,
+  /api[_-]?secret/i,
+  /access[_-]?token/i,
+  /auth[_-]?token/i,
+  /bearer[_-]?token/i,
+  /secret[_-]?key/i,
+  /private[_-]?key/i,
+  /client[_-]?secret/i,
+  /app[_-]?secret/i,
+  // Database credentials
+  /db[_-]?pass(word)?/i,
+  /database[_-]?pass(word)?/i,
+  /db[_-]?url/i,
+  /database[_-]?url/i,
+  /connection[_-]?string/i,
+  // Passwords
+  /^password$/i,
+  /^passwd$/i,
+  /^pwd$/i,
+  /[_-]password$/i,
+  // Tokens
+  /[_-]token$/i,
+  /^token$/i,
+  /jwt[_-]?secret/i,
+  /session[_-]?secret/i,
+  /cookie[_-]?secret/i,
+  // Cloud provider keys
+  /aws[_-]?(access[_-]?key|secret|session[_-]?token)/i,
+  /gcp[_-]?key/i,
+  /azure[_-]?(key|secret|connection)/i,
+  // Service-specific
+  /stripe[_-]?(key|secret)/i,
+  /twilio[_-]?(auth|token|sid)/i,
+  /sendgrid[_-]?key/i,
+  /github[_-]?token/i,
+  /slack[_-]?(token|webhook)/i,
+  /discord[_-]?(token|secret)/i,
+  /openai[_-]?(key|token)/i,
+  /anthropic[_-]?key/i,
+  /webhook[_-]?(url|secret)/i,
+  /encryption[_-]?key/i,
+  /signing[_-]?key/i,
+  /hmac[_-]?key/i,
+  /salt$/i,
+];
+
+/**
+ * Patterns that flag a *string literal value* as likely being a secret.
+ * These are matched against the raw string content.
+ */
+const SENSITIVE_VALUE_PATTERNS = [
+  // AWS Access Key IDs
+  { pattern: /AKIA[0-9A-Z]{16}/, label: 'AWS_ACCESS_KEY_ID', severity: SecretSeverity.CRITICAL },
+  // AWS Secret Access Keys (40-char base64-ish)
+  { pattern: /[A-Za-z0-9/+=]{40}/, label: 'AWS_SECRET_KEY_CANDIDATE', severity: SecretSeverity.MEDIUM },
+  // Generic high-entropy hex strings (32+ chars)
+  { pattern: /^[0-9a-f]{32,}$/i, label: 'HEX_SECRET', severity: SecretSeverity.HIGH },
+  // Generic high-entropy base64 strings (32+ chars)
+  { pattern: /^[A-Za-z0-9+/]{32,}={0,2}$/, label: 'BASE64_SECRET', severity: SecretSeverity.MEDIUM },
+  // JWT tokens
+  { pattern: /^ey[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, label: 'JWT_TOKEN', severity: SecretSeverity.CRITICAL },
+  // GitHub personal access tokens
+  { pattern: /ghp_[A-Za-z0-9]{36}/, label: 'GITHUB_PAT', severity: SecretSeverity.CRITICAL },
+  { pattern: /github_pat_[A-Za-z0-9_]{82}/, label: 'GITHUB_PAT_FINE', severity: SecretSeverity.CRITICAL },
+  // Stripe keys
+  { pattern: /sk_(live|test)_[A-Za-z0-9]{24,}/, label: 'STRIPE_SECRET_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /pk_(live|test)_[A-Za-z0-9]{24,}/, label: 'STRIPE_PUBLIC_KEY', severity: SecretSeverity.HIGH },
+  // Slack tokens
+  { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/, label: 'SLACK_TOKEN', severity: SecretSeverity.CRITICAL },
+  // Discord tokens
+  { pattern: /[MN][A-Za-z0-9]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/, label: 'DISCORD_TOKEN', severity: SecretSeverity.CRITICAL },
+  // Twilio SID
+  { pattern: /AC[a-f0-9]{32}/, label: 'TWILIO_SID', severity: SecretSeverity.HIGH },
+  // SendGrid API key
+  { pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/, label: 'SENDGRID_KEY', severity: SecretSeverity.CRITICAL },
+  // OpenAI API key
+  { pattern: /sk-[A-Za-z0-9]{32,}/, label: 'OPENAI_KEY', severity: SecretSeverity.CRITICAL },
+  // Generic UUID-like tokens that look like secrets (not just any UUID)
+  { pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/, label: 'UUID_SECRET_CANDIDATE', severity: SecretSeverity.MEDIUM },
+];
+
+/**
+ * Minimum length a string value must have to be considered a potential secret.
+ * Short strings like "test", "dev", "localhost" are excluded.
+ */
+const MIN_SECRET_VALUE_LENGTH = 8;
+
+/**
+ * Values that are obviously not secrets (common placeholders / env-var references).
+ */
+const SAFE_VALUE_ALLOWLIST = new Set([
+  'your_api_key_here',
+  'your-api-key',
+  'YOUR_API_KEY',
+  'YOUR_SECRET',
+  'REPLACE_ME',
+  'changeme',
+  'placeholder',
+  'example',
+  'test',
+  'demo',
+  'localhost',
+  '127.0.0.1',
+  'process.env',
+  '',
+]);
+
+/**
+ * Checks whether a string value looks like an environment-variable reference
+ * (e.g. `process.env.SECRET` or `import.meta.env.SECRET`).
+ */
+function isEnvReference(value) {
+  return (
+    value.startsWith('process.env') ||
+    value.startsWith('import.meta.env') ||
+    value.startsWith('${') ||
+    /^[A-Z_][A-Z0-9_]*$/.test(value) // ALL_CAPS env-var placeholder
+  );
+}
+
+/**
+ * Determines whether a string value is high-entropy enough to be a real secret.
+ * Uses Shannon entropy as a heuristic.
+ */
+function shannonEntropy(str) {
+  const freq = {};
+  for (const ch of str) freq[ch] = (freq[ch] || 0) + 1;
+  let entropy = 0;
+  for (const count of Object.values(freq)) {
+    const p = count / str.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+/**
+ * Main scanner class. Operates on pre-parsed AST nodes produced by either
+ * ASTAnalyzer (TypeScript compiler API) or OxcAnalyzer (oxc-parser).
+ */
+export class SecretScanner {
+  /**
+   * Scans a source file's text for hardcoded secrets.
+   *
+   * @param {string} filePath   - Absolute path to the file being scanned.
+   * @param {string} fileContent - Raw source text of the file.
+   * @returns {Array<SecretFinding>} - Array of detected secret findings.
+   */
+  scanFileContent(filePath, fileContent) {
+    const findings = [];
+    const lines = fileContent.split('\n');
+
+    lines.forEach((line, lineIndex) => {
+      const lineNumber = lineIndex + 1;
+
+      // Skip comment-only lines and import statements
+      const trimmed = line.trim();
+      if (
+        trimmed.startsWith('//') ||
+        trimmed.startsWith('*') ||
+        trimmed.startsWith('/*') ||
+        trimmed.startsWith('import ') ||
+        trimmed.startsWith('export { ')
+      ) {
+        return;
+      }
+
+      // ── Strategy 1: Name-based heuristic ──────────────────────────────────
+      // Look for variable/property assignments where the name matches a
+      // sensitive pattern and the value is a non-trivial string literal.
+      const assignmentMatch = line.match(
+        /(?:const|let|var|readonly)?\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*[=:]\s*["'`]([^"'`]+)["'`]/
+      );
+      if (assignmentMatch) {
+        const [, varName, value] = assignmentMatch;
+        if (
+          value.length >= MIN_SECRET_VALUE_LENGTH &&
+          !SAFE_VALUE_ALLOWLIST.has(value) &&
+          !isEnvReference(value) &&
+          SENSITIVE_NAME_PATTERNS.some(p => p.test(varName))
+        ) {
+          findings.push({
+            file: filePath,
+            line: lineNumber,
+            column: line.indexOf(value),
+            variableName: varName,
+            valueSnippet: this._redact(value),
+            label: this._labelFromName(varName),
+            severity: SecretSeverity.CRITICAL,
+          });
+          return; // Don't double-report the same line
+        }
+      }
+
+      // ── Strategy 2: Value-pattern matching ────────────────────────────────
+      // Extract all string literals on this line and test them against known
+      // secret value patterns.
+      const stringLiterals = [...line.matchAll(/["'`]([^"'`\n]{8,})["'`]/g)];
+      for (const match of stringLiterals) {
+        const value = match[1];
+        if (SAFE_VALUE_ALLOWLIST.has(value) || isEnvReference(value)) continue;
+
+        for (const { pattern, label, severity } of SENSITIVE_VALUE_PATTERNS) {
+          if (pattern.test(value)) {
+            // Avoid duplicate findings for the same position
+            const alreadyReported = findings.some(
+              f => f.line === lineNumber && f.valueSnippet === this._redact(value)
+            );
+            if (!alreadyReported) {
+              findings.push({
+                file: filePath,
+                line: lineNumber,
+                column: line.indexOf(match[0]),
+                variableName: null,
+                valueSnippet: this._redact(value),
+                label,
+                severity,
+              });
+            }
+            break;
+          }
+        }
+      }
+
+      // ── Strategy 3: High-entropy string heuristic ─────────────────────────
+      // Any string literal with Shannon entropy > 4.5 and length >= 20 that
+      // is assigned to a sensitive-named variable is flagged.
+      if (assignmentMatch) {
+        const [, varName, value] = assignmentMatch;
+        if (
+          value.length >= 20 &&
+          shannonEntropy(value) > 4.5 &&
+          !SAFE_VALUE_ALLOWLIST.has(value) &&
+          !isEnvReference(value) &&
+          SENSITIVE_NAME_PATTERNS.some(p => p.test(varName))
+        ) {
+          const alreadyReported = findings.some(f => f.line === lineNumber);
+          if (!alreadyReported) {
+            findings.push({
+              file: filePath,
+              line: lineNumber,
+              column: line.indexOf(value),
+              variableName: varName,
+              valueSnippet: this._redact(value),
+              label: 'HIGH_ENTROPY_SECRET',
+              severity: SecretSeverity.HIGH,
+            });
+          }
+        }
+      }
+    });
+
+    return findings;
+  }
+
+  /**
+   * Redacts a secret value for safe display in reports.
+   * Shows the first 4 characters followed by asterisks.
+   */
+  _redact(value) {
+    if (value.length <= 4) return '****';
+    return value.slice(0, 4) + '*'.repeat(Math.min(value.length - 4, 8));
+  }
+
+  /**
+   * Derives a human-readable label from a variable name.
+   */
+  _labelFromName(name) {
+    const upper = name.toUpperCase();
+    if (/API[_-]?KEY/.test(upper)) return 'API_KEY';
+    if (/TOKEN/.test(upper)) return 'AUTH_TOKEN';
+    if (/PASSWORD|PASSWD|PWD/.test(upper)) return 'PASSWORD';
+    if (/SECRET/.test(upper)) return 'SECRET';
+    if (/DATABASE|DB/.test(upper)) return 'DATABASE_CREDENTIAL';
+    return 'SENSITIVE_VALUE';
+  }
+}