flecto 2.0.0 → 3.0.0

package/src/notifiers.js

@@ -0,0 +1,430 @@
+import { highestSeverity } from './policy.js';
+
+/**
+ * Chat payload formatters.
+ *
+ * These are pure functions: envelope in, service-shaped JSON body out. They are
+ * applied at delivery time in `alerter.js`, so the existing webhook machinery
+ * (headers, timeout, retries, delivery modes, persistent queue) is reused
+ * unchanged — only the serialized body differs.
+ *
+ * Limits coded against (service-documented maximums):
+ * - Slack: 3000 chars per section `text`, 150 chars per `header` plain_text,
+ *   50 blocks per message.
+ * - Discord: 4096 chars per embed `description`, 256 per `title`,
+ *   6000 chars across one embed.
+ * - Microsoft Teams: 28 KB per incoming-webhook message.
+ *
+ * @typedef {'flecto' | 'slack' | 'discord' | 'teams'} WebhookFormat
+ * @typedef {'error' | 'warn' | 'info' | 'none'} AlertSeverity
+ */
+
+/** Payload formats that can be selected directly. @type {WebhookFormat[]} */
+export const WEBHOOK_FORMATS = ['flecto', 'slack', 'discord', 'teams'];
+
+/** Accepted `--webhook-format` values, including URL auto-detection. */
+export const WEBHOOK_FORMAT_CHOICES = [...WEBHOOK_FORMATS, 'auto'];
+
+/**
+ * Presentation per severity: emoji for text-first services, an integer color
+ * for Discord embeds, and a hex string for the Teams card theme.
+ */
+const SEVERITY_STYLE = {
+  error: { emoji: '🔴', color: 0xd92d20, themeColor: 'D92D20' },
+  warn: { emoji: '🟡', color: 0xf79009, themeColor: 'F79009' },
+  info: { emoji: '🔵', color: 0x2e90fa, themeColor: '2E90FA' },
+  none: { emoji: '🟢', color: 0x12b76a, themeColor: '12B76A' },
+};
+
+/** Per-service budgets, kept under the documented hard limits above. */
+const LIMITS = {
+  slack: { title: 150, fallback: 300, body: 2_800, lines: 20 },
+  discord: { title: 256, body: 3_800, lines: 20 },
+  teams: { title: 256, body: 8_000, lines: 20 },
+};
+
+const VALUE_CHARS = 80;
+const MESSAGE_CHARS = 200;
+
+/**
+ * @param {string} text
+ * @param {number} max
+ * @returns {string}
+ */
+function truncate(text, max) {
+  const value = String(text);
+  return value.length <= max ? value : `${value.slice(0, Math.max(0, max - 1))}…`;
+}
+
+/**
+ * Last path segment of a file path, POSIX or Windows.
+ * @param {string} file
+ * @returns {string}
+ */
+function baseName(file) {
+  const parts = String(file ?? '').split(/[\\/]/).filter(Boolean);
+  return parts.length > 0 ? parts[parts.length - 1] : String(file ?? '');
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function formatValue(value) {
+  if (value === undefined) return 'undefined';
+  if (value === null) return 'null';
+  if (typeof value === 'string' || typeof value === 'object') {
+    try {
+      return truncate(JSON.stringify(value), VALUE_CHARS);
+    } catch {
+      return truncate(String(value), VALUE_CHARS);
+    }
+  }
+  return truncate(String(value), VALUE_CHARS);
+}
+
+/**
+ * Highest severity across the envelope's policy findings.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {AlertSeverity}
+ */
+export function envelopeSeverity(envelope) {
+  return highestSeverity(envelope?.policies ?? []) ?? 'none';
+}
+
+/**
+ * One-line description of what happened, used in every service's title.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {string}
+ */
+function summarize(envelope) {
+  const name = baseName(envelope?.file) || 'config';
+  if (envelope?.lifecycle) {
+    return `${envelope.lifecycle.type ?? 'lifecycle'} — ${name}`;
+  }
+  const changes = envelope?.changes?.length ?? 0;
+  const findings = envelope?.policies?.length ?? 0;
+  const base = `${changes} change${changes === 1 ? '' : 's'} in ${name}`;
+  return findings > 0
+    ? `${base} · ${findings} policy finding${findings === 1 ? '' : 's'}`
+    : base;
+}
+
+/**
+ * Render change events as one line each.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {string[]}
+ */
+export function changeLines(envelope) {
+  const changes = Array.isArray(envelope?.changes) ? envelope.changes : [];
+  return changes.map((change) => {
+    if (change.type === 'added') return `+ ${change.path}: ${formatValue(change.after)}`;
+    if (change.type === 'removed') return `- ${change.path}: ${formatValue(change.before)}`;
+    const note = change.note ? ` [${change.note}]` : '';
+    return `~ ${change.path}: ${formatValue(change.before)} → ${formatValue(change.after)}${note}`;
+  });
+}
+
+/**
+ * Render policy findings as one line each.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {string[]}
+ */
+export function policyLines(envelope) {
+  const findings = Array.isArray(envelope?.policies) ? envelope.policies : [];
+  return findings.map((finding) => {
+    const pack = finding.pack ? ` [${finding.pack}]` : '';
+    return `[${finding.severity}] ${finding.id}${pack} ${finding.path}: ${truncate(finding.message ?? '', MESSAGE_CHARS)}`;
+  });
+}
+
+/**
+ * Join lines within a line count and character budget, appending a "+N more"
+ * marker instead of posting a wall of text.
+ * @param {string[]} lines
+ * @param {{ maxLines: number, maxChars: number, label: string, separator?: string }} limits
+ * @returns {string}
+ */
+export function fitLines(lines, limits) {
+  if (!lines || lines.length === 0) return '';
+  const separator = limits.separator ?? '\n';
+  let kept = lines.slice(0, limits.maxLines);
+  const render = () => {
+    const omitted = lines.length - kept.length;
+    const body = kept.join(separator);
+    return omitted > 0 ? `${body}${separator}… +${omitted} more ${limits.label}` : body;
+  };
+
+  let text = render();
+  while (text.length > limits.maxChars && kept.length > 1) {
+    kept = kept.slice(0, -1);
+    text = render();
+  }
+  return truncate(text, limits.maxChars);
+}
+
+/**
+ * Body lines for an envelope: change lines, or the lifecycle message when the
+ * envelope carries no changes.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {string[]}
+ */
+function bodyLines(envelope) {
+  if (envelope?.lifecycle) {
+    return [`${envelope.lifecycle.type ?? 'lifecycle'}: ${envelope.lifecycle.message ?? ''}`.trim()];
+  }
+  return changeLines(envelope);
+}
+
+/**
+ * Neutralize fence sequences so a value can never break out of a code block.
+ * @param {string} text
+ * @returns {string}
+ */
+function sanitizeFence(text) {
+  return text.replaceAll('```', "'''");
+}
+
+/**
+ * Escape the characters Slack reserves in mrkdwn text.
+ * @param {string} text
+ * @returns {string}
+ */
+function escapeSlack(text) {
+  return String(text)
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;');
+}
+
+/**
+ * Format an envelope as a Slack Block Kit message. `text` carries the same
+ * summary as a notification fallback for clients that do not render blocks.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {Record<string, unknown>}
+ */
+export function formatSlackMessage(envelope) {
+  const severity = envelopeSeverity(envelope);
+  const style = SEVERITY_STYLE[severity];
+  const summary = summarize(envelope);
+  const title = `${style.emoji} Flecto — ${summary}`;
+  const limits = LIMITS.slack;
+
+  const blocks = [
+    {
+      type: 'header',
+      text: { type: 'plain_text', text: truncate(title, limits.title), emoji: true },
+    },
+    {
+      type: 'section',
+      text: {
+        type: 'mrkdwn',
+        text: [
+          `*File:* \`${escapeSlack(envelope?.file ?? '')}\``,
+          `*Source:* \`${escapeSlack(envelope?.source ?? '')}\` · *Severity:* \`${severity}\``,
+        ].join('\n'),
+      },
+    },
+  ];
+
+  const changes = fitLines(bodyLines(envelope).map((line) => escapeSlack(line)), {
+    maxLines: limits.lines,
+    maxChars: limits.body,
+    label: 'changes',
+  });
+  if (changes) {
+    blocks.push({
+      type: 'section',
+      text: { type: 'mrkdwn', text: `\`\`\`\n${sanitizeFence(changes)}\n\`\`\`` },
+    });
+  }
+
+  const findings = fitLines(policyLines(envelope).map((line) => escapeSlack(line)), {
+    maxLines: limits.lines,
+    maxChars: limits.body,
+    label: 'findings',
+  });
+  if (findings) {
+    blocks.push({
+      type: 'section',
+      text: { type: 'mrkdwn', text: `*Policy findings*\n\`\`\`\n${sanitizeFence(findings)}\n\`\`\`` },
+    });
+  }
+
+  blocks.push({
+    type: 'context',
+    elements: [{
+      type: 'mrkdwn',
+      text: `event \`${escapeSlack(envelope?.event_id ?? '')}\` · ${escapeSlack(envelope?.emitted_at ?? '')}`,
+    }],
+  });
+
+  return { text: truncate(escapeSlack(title), limits.fallback), blocks };
+}
+
+/**
+ * Format an envelope as a Discord webhook message with one embed, colored by
+ * the highest policy severity.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {Record<string, unknown>}
+ */
+export function formatDiscordMessage(envelope) {
+  const severity = envelopeSeverity(envelope);
+  const style = SEVERITY_STYLE[severity];
+  const summary = summarize(envelope);
+  const limits = LIMITS.discord;
+
+  const sections = [];
+  const changes = fitLines(bodyLines(envelope), {
+    maxLines: limits.lines,
+    maxChars: Math.floor(limits.body * 0.65),
+    label: 'changes',
+  });
+  if (changes) sections.push(`\`\`\`\n${sanitizeFence(changes)}\n\`\`\``);
+
+  const findings = fitLines(policyLines(envelope), {
+    maxLines: limits.lines,
+    maxChars: Math.floor(limits.body * 0.3),
+    label: 'findings',
+  });
+  if (findings) sections.push(`**Policy findings**\n\`\`\`\n${sanitizeFence(findings)}\n\`\`\``);
+
+  /** @type {Record<string, unknown>} */
+  const embed = {
+    title: truncate(`${style.emoji} Flecto — ${summary}`, limits.title),
+    color: style.color,
+    fields: [
+      { name: 'File', value: truncate(`\`${envelope?.file ?? ''}\``, 1_024), inline: false },
+      { name: 'Source', value: String(envelope?.source ?? 'watch'), inline: true },
+      { name: 'Severity', value: severity, inline: true },
+    ],
+    footer: { text: truncate(`event ${envelope?.event_id ?? ''}`, 2_048) },
+  };
+  const description = truncate(sections.join('\n'), limits.body);
+  if (description) embed.description = description;
+  if (envelope?.emitted_at) embed.timestamp = envelope.emitted_at;
+
+  return { embeds: [embed] };
+}
+
+/**
+ * Format an envelope as a Microsoft Teams MessageCard (the shape Office 365
+ * connector webhooks accept). Card text uses blank-line separators because
+ * MessageCard markdown collapses single newlines.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @returns {Record<string, unknown>}
+ */
+export function formatTeamsMessage(envelope) {
+  const severity = envelopeSeverity(envelope);
+  const style = SEVERITY_STYLE[severity];
+  const summary = summarize(envelope);
+  const limits = LIMITS.teams;
+
+  const sections = [{
+    facts: [
+      { name: 'File', value: String(envelope?.file ?? '') },
+      { name: 'Source', value: String(envelope?.source ?? 'watch') },
+      { name: 'Severity', value: severity },
+      { name: 'Event', value: String(envelope?.event_id ?? '') },
+    ],
+    markdown: true,
+  }];
+
+  const changes = fitLines(bodyLines(envelope), {
+    maxLines: limits.lines,
+    maxChars: limits.body,
+    label: 'changes',
+    separator: '\n\n',
+  });
+  if (changes) {
+    sections.push({
+      title: envelope?.lifecycle ? 'Lifecycle' : 'Changes',
+      text: changes,
+      markdown: true,
+    });
+  }
+
+  const findings = fitLines(policyLines(envelope), {
+    maxLines: limits.lines,
+    maxChars: limits.body,
+    label: 'findings',
+    separator: '\n\n',
+  });
+  if (findings) sections.push({ title: 'Policy findings', text: findings, markdown: true });
+
+  return {
+    '@type': 'MessageCard',
+    '@context': 'https://schema.org/extensions',
+    summary: truncate(`Flecto — ${summary}`, limits.title),
+    themeColor: style.themeColor,
+    title: truncate(`${style.emoji} Flecto — ${summary}`, limits.title),
+    sections,
+  };
+}
+
+/**
+ * Guess a payload format from the webhook host. Only used when the format is
+ * explicitly requested as `auto` — the default stays `flecto` so existing
+ * webhook receivers keep getting the raw envelope.
+ * @param {string | undefined} url
+ * @returns {WebhookFormat}
+ */
+export function detectWebhookFormat(url) {
+  if (!url) return 'flecto';
+  let parsed;
+  try {
+    parsed = new URL(String(url));
+  } catch {
+    return 'flecto';
+  }
+  const host = parsed.hostname.toLowerCase();
+  const path = parsed.pathname.toLowerCase();
+  const hostIs = (domain) => host === domain || host.endsWith(`.${domain}`);
+
+  if (hostIs('slack.com')) return 'slack';
+  if ((hostIs('discord.com') || hostIs('discordapp.com')) && path.includes('/api/webhooks')) {
+    return 'discord';
+  }
+  if (hostIs('office.com') || hostIs('office365.com')) return 'teams';
+  return 'flecto';
+}
+
+/**
+ * Normalize a requested webhook format. Unset means `flecto`; `auto` inspects
+ * the webhook URL.
+ * @param {unknown} requested
+ * @param {string} [url]
+ * @returns {WebhookFormat}
+ */
+export function resolveWebhookFormat(requested, url) {
+  if (requested === undefined || requested === null || requested === '') return 'flecto';
+  const value = String(requested).trim().toLowerCase();
+  if (value === 'auto') return detectWebhookFormat(url);
+  if (!WEBHOOK_FORMATS.includes(/** @type {WebhookFormat} */ (value))) {
+    throw new Error(`--webhook-format must be one of: ${WEBHOOK_FORMAT_CHOICES.join(', ')}`);
+  }
+  return /** @type {WebhookFormat} */ (value);
+}
+
+/**
+ * Shape an envelope for the target service. `flecto` returns the envelope
+ * itself — the exact object that has always been posted — so the default
+ * delivery path is byte-for-byte unchanged.
+ * @param {import('./envelope.js').FlectoEnvelope} envelope
+ * @param {WebhookFormat} [format]
+ * @returns {unknown}
+ */
+export function formatWebhookPayload(envelope, format = 'flecto') {
+  switch (format) {
+    case 'slack':
+      return formatSlackMessage(envelope);
+    case 'discord':
+      return formatDiscordMessage(envelope);
+    case 'teams':
+      return formatTeamsMessage(envelope);
+    case 'flecto':
+      return envelope;
+    default:
+      throw new Error(`Unknown webhook format: ${format}`);
+  }
+}

package/src/packs/compose.json

@@ -0,0 +1,45 @@
+{
+  "id": "compose",
+  "rules": [
+    {
+      "id": "compose-privileged-service",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)privileged$"
+      },
+      "afterEquals": true,
+      "message": "Docker Compose service is privileged. Remove privileged mode or document the required host access."
+    },
+    {
+      "id": "compose-host-network",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)network_mode$"
+      },
+      "afterIn": ["host", "host:"],
+      "message": "Docker Compose service uses the host network. Confirm the service needs to bypass network isolation."
+    },
+    {
+      "id": "compose-docker-socket-bind",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)volumes\\[\\d+\\](\\.source)?$"
+      },
+      "afterMatches": "^/var/run/docker\\.sock(?::|$)",
+      "message": "Docker Compose service mounts the Docker socket. This grants control over the host Docker daemon."
+    },
+    {
+      "id": "compose-sensitive-host-bind",
+      "severity": "warn",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)volumes\\[\\d+\\](\\.source)?$"
+      },
+      "afterMatches": "^/(?:etc|root|home|var/lib)(?::|$)",
+      "message": "Docker Compose service bind-mounts a sensitive host directory. Confirm the container needs this host access."
+    }
+  ]
+}

package/src/packs/default.json

@@ -11,6 +11,28 @@
       },
       "message": "Sensitive-looking key added or changed. Confirm secret storage, rotation, and access controls."
     },
+    {
+      "id": "secret-value-detected",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "afterLooksSecret": true,
+      "message": "Value looks like a credential (known token format or high-entropy string) regardless of its key name. Move it to a secret store and rotate it."
+    },
+    {
+      "id": "sops-file-decrypted",
+      "severity": "error",
+      "when": ["changed"],
+      "match": { "pathEquals": "<encryption>" },
+      "afterEquals": "plaintext",
+      "message": "This file was encrypted and is now plaintext. Treat every value in it as exposed: rotate the secrets, then restore encryption before merging."
+    },
+    {
+      "id": "sops-value-decrypted",
+      "severity": "error",
+      "when": ["changed"],
+      "afterEquals": "<no longer encrypted>",
+      "messageTemplate": "{path} was an encrypted value and is now stored in the clear. Rotate it and re-encrypt the file."
+    },
     {
       "id": "dangerous-toggle-enabled",
       "severity": "error",
@@ -19,7 +41,7 @@
         "path": "(debug|allow_insecure|disable_tls|skip_tls_verify)",
         "pathFlags": "i"
       },
-      "afterEquals": true,
+      "afterTruthy": true,
       "message": "Potentially dangerous toggle enabled."
     },
     {

package/src/packs/kubernetes.json

@@ -0,0 +1,112 @@
+{
+  "id": "kubernetes",
+  "expandSubtrees": true,
+  "rules": [
+    {
+      "id": "k8s-privileged-container",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)securityContext\\.privileged$"
+      },
+      "afterTruthy": true,
+      "message": "Container runs privileged. A privileged container has effectively full access to the host. Drop privileged and grant only the specific capabilities the workload needs."
+    },
+    {
+      "id": "k8s-host-namespace-shared",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)(hostNetwork|hostPID|hostIPC)$"
+      },
+      "afterTruthy": true,
+      "messageTemplate": "Pod shares a host namespace ({path} = {after}). This removes the isolation boundary between the pod and the node. Confirm the workload genuinely needs host-level access."
+    },
+    {
+      "id": "k8s-run-as-non-root-weakened",
+      "severity": "error",
+      "when": ["added", "changed", "removed"],
+      "match": {
+        "path": "(^|\\.)runAsNonRoot$"
+      },
+      "anyOf": [
+        { "afterEquals": false },
+        { "beforeTruthy": true }
+      ],
+      "message": "runAsNonRoot was disabled or dropped, so the container may run as UID 0. Set runAsNonRoot: true and give the image a non-root user."
+    },
+    {
+      "id": "k8s-allow-privilege-escalation",
+      "severity": "error",
+      "when": ["added", "changed", "removed"],
+      "match": {
+        "path": "(^|\\.)allowPrivilegeEscalation$"
+      },
+      "anyOf": [
+        { "afterTruthy": true },
+        { "beforeEquals": false }
+      ],
+      "message": "allowPrivilegeEscalation was enabled or its explicit false was removed. A process can then gain more privileges than its parent (setuid binaries, file capabilities). Pin it back to false."
+    },
+    {
+      "id": "k8s-dangerous-capability-added",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)capabilities\\.add\\[[^\\]]*\\]$"
+      },
+      "afterIn": ["SYS_ADMIN", "NET_ADMIN", "ALL"],
+      "messageTemplate": "Container adds the {after} Linux capability, which is close to full host privilege. Add only the narrow capability the workload needs, or drop the change."
+    },
+    {
+      "id": "k8s-image-tag-unpinned",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "containers\\[[^\\]]*\\]\\.image$"
+      },
+      "afterMatches": "(?::latest$)|(?:^[^:@]*$)|(?:^[^@]*/[^/:@]*$)",
+      "messageTemplate": "Container image \"{after}\" is not pinned: it resolves to :latest, so what actually runs can change without a manifest change. Pin an immutable tag or a @sha256 digest."
+    },
+    {
+      "id": "k8s-image-pull-policy-always",
+      "severity": "warn",
+      "when": ["changed"],
+      "match": {
+        "path": "containers\\[[^\\]]*\\]\\.imagePullPolicy$"
+      },
+      "afterEquals": "Always",
+      "messageTemplate": "imagePullPolicy moved from {before} to Always, so a restart can silently pull different bits behind the same tag. Keep IfNotPresent with a pinned tag or digest."
+    },
+    {
+      "id": "k8s-replica-count-jump",
+      "severity": "warn",
+      "when": ["changed"],
+      "match": {
+        "path": "(^|\\.)spec\\.replicas$"
+      },
+      "numericJump": { "minMultiple": 3 },
+      "numericDelta": { "min": 3 },
+      "messageTemplate": "Replica count jumped from {before} to {after} (>=3x). Confirm the cluster has the capacity and that the cost is intended."
+    },
+    {
+      "id": "k8s-resource-limits-removed",
+      "severity": "warn",
+      "when": ["removed"],
+      "match": {
+        "path": "containers\\[[^\\]]*\\]\\.resources\\.limits\\.[^.]+$"
+      },
+      "messageTemplate": "Resource limit {path} was removed. An unbounded container can starve everything else scheduled on the node."
+    },
+    {
+      "id": "k8s-service-externally-exposed",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)spec\\.type$"
+      },
+      "afterIn": ["LoadBalancer", "NodePort"],
+      "messageTemplate": "Service type is {after}, which exposes the workload outside the cluster (a public load balancer, or a port open on every node). Confirm the exposure is intended and covered by network policy."
+    }
+  ]
+}

package/src/packs/node-runtime.json

@@ -0,0 +1,44 @@
+{
+  "id": "node-runtime",
+  "rules": [
+    {
+      "id": "node-runtime-engine-removed",
+      "severity": "warn",
+      "when": ["removed"],
+      "match": {
+        "pathEquals": "engines.node"
+      },
+      "message": "Node.js engine requirement was removed. Keep a supported runtime floor to avoid accidental runtime downgrades."
+    },
+    {
+      "id": "node-runtime-tls-verification-disabled",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)NODE_TLS_REJECT_UNAUTHORIZED$"
+      },
+      "afterIn": [0, "0"],
+      "message": "NODE_TLS_REJECT_UNAUTHORIZED disables TLS certificate verification. Remove it and fix the certificate chain."
+    },
+    {
+      "id": "node-runtime-debug-enabled",
+      "severity": "warn",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)NODE_DEBUG$"
+      },
+      "afterMatches": ".+",
+      "message": "NODE_DEBUG is enabled. Confirm verbose runtime debugging is appropriate for this environment."
+    },
+    {
+      "id": "node-runtime-inspector-enabled",
+      "severity": "warn",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(^|\\.)NODE_OPTIONS$"
+      },
+      "afterMatches": "(^|\\s)--inspect(?:-brk)?(?:=|\\s|$)",
+      "message": "Node.js inspector is enabled through NODE_OPTIONS. Avoid exposing debug ports outside trusted development environments."
+    }
+  ]
+}