git-cli-scanner 1.3.0 → 1.4.0

package/dist/cli.js

@@ -439,6 +439,58 @@ var init_envFiles = __esm({
   }
 });
 
+// src/scans/infrastructure.ts
+var rules5, infrastructureScanner;
+var init_infrastructure = __esm({
+  "src/scans/infrastructure.ts"() {
+    "use strict";
+    rules5 = [
+      {
+        id: "docker-hub-token",
+        description: "Docker Hub Personal Access Token",
+        pattern: /dckr_pat_[a-zA-Z0-9_\-]{25,}/,
+        risk: "An attacker can push malicious images to your Docker registries, leading to a supply chain attack on your production containers.",
+        solution: "Revoke this token immediately in Docker Hub (Account Settings > Security > New Access Token) and replace it using CI/CD secrets."
+      },
+      {
+        id: "database-connection-string",
+        description: "Database Connection String with Credentials",
+        pattern: /(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\/\s]+:[^@\/\s]+@[^:\/\s]+(?::\d+)?\//,
+        risk: "An attacker can directly connect to your database instance, allowing them to steal, modify, or delete all of your user data.",
+        solution: "Remove the hardcoded database URL and read it from an environment variable (e.g., process.env.DATABASE_URL) at runtime."
+      }
+    ];
+    infrastructureScanner = {
+      id: "infrastructure",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules5) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
 // src/scans/index.ts
 var allScanners;
 var init_scans = __esm({
@@ -449,12 +501,14 @@ var init_scans = __esm({
     init_collaboration();
     init_privateKeys();
     init_envFiles();
+    init_infrastructure();
     allScanners = [
       apiKeyScanner,
       cloudProviderScanner,
       collaborationScanner,
       privateKeyScanner,
-      envFileScanner
+      envFileScanner,
+      infrastructureScanner
     ];
   }
 });
@@ -901,7 +955,7 @@ var import_child_process2 = require("child_process");
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
 var program = new import_commander.Command();
-program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.3.0");
+program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.3.1");
 program.command("init").description("Install pre-commit hook for automatic scanning").action(() => {
   info("Setting up pre-commit hook...");
   try {
@@ -1061,7 +1115,7 @@ program.command("scan-history").description("Scan Git commit history for exposed
       const { printIssues: printIssues2 } = (init_logger(), __toCommonJS(logger_exports));
       printIssues2(issues, options.showSol);
     } else {
-      spinner.succeed("No vulnerabilities found in the scanned history!");
+      spinner.stop("No vulnerabilities found in the scanned history!");
     }
   } catch (err) {
     error(`History scan failed: ${err.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {

package/readme.md

@@ -1,82 +1,54 @@
 # Git CLI Scanner
 
-A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.
+A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, database credentials, and Docker infrastructure tokens before they reach your Git history.
 
 ---
 
-## Installation
-
-```bash
-# Install globally
-npm install -g git-cli-scanner
-
-# Or use directly with npx (no install needed)
-npx git-cli-scanner <command>
-```
-
----
+## What Does It Scan For?
 
-## Setup
+Git CLI Scanner uses regex heuristics and pattern matching to detect:
 
-```bash
-# Navigate to your project
-cd your-project
-
-# Initialize the pre-commit hook
-npx git-cli-scanner init
-```
+- **Cloud Provider Keys**: AWS Access/Secret Keys, Google Cloud API Keys.
+- **Infrastructure & Databases**: Database Connection Strings (MongoDB, PostgreSQL, MySQL, Redis), Docker Hub Personal Access Tokens.
+- **Collaboration Tools**: Slack Tokens, Slack Webhooks, GitHub PATs, OAuth Tokens, Discord Webhooks.
+- **Private Keys**: RSA, DSA, EC, OpenSSH, PGP Private Keys.
+- **Banned Files**: Accidental commits of `.env`, `.pem`, `.sqlite`, `.log` files (unless they are explicitly added to `.gitignore`).
 
-After running `init`, every time you run `git commit`, the scanner will automatically scan your staged files and warn you if any vulnerabilities are found.
+It features an intelligent **Ignore System** (Dummy Detection) that automatically downgrades the severity of fake, dummy, or test secrets commonly used in unit tests (e.g., `1234567890abcdef`, `dummy_token`).
 
 ---
 
-## Commands
-
-| Command | Description |
-|---------|-------------|
-| `init` | Install the pre-commit hook for automatic scanning |
-| `disable` | Remove the pre-commit hook and stop automatic scanning |
-| `scan` | Manually scan staged files |
-| `scan --show-sol` | Scan staged files and show suggested fixes |
-| `scan-all [dir]` | Scan an entire directory recursively |
-| `scan-all [dir] --show-sol` | Scan a directory and show suggested fixes |
-| `explore` | Launch interactive file explorer TUI |
-
-### Enable automatic scanning
+## Installation
 
 ```bash
-npx git-cli-scanner init
-```
-
-Installs a pre-commit hook. After this, every `git commit` will automatically scan your staged files. If vulnerabilities are found, you choose to continue or abort.
-
-### Disable automatic scanning
+# Install globally via NPM
+npm install -g git-cli-scanner
 
-```bash
-npx git-cli-scanner disable
+# Or use directly with npx (no install needed)
+npx git-cli-scanner <command>
 ```
 
-Removes the pre-commit hook. The scanner will no longer run automatically on `git commit`.
+---
 
-### Scan staged files
+## 🚀 Usage & Commands
 
-```bash
-npx git-cli-scanner scan
-npx git-cli-scanner scan --show-sol
-```
+### Commands Overview
 
-### Scan an entire directory
+| Command | Description | Arguments & Flags | Example Usage |
+|---------|-------------|-------------------|---------------|
+| `init` | Installs the pre-commit hook to automatically scan files on `git commit`. | None | `npx git-cli-scanner init` |
+| `disable` | Removes the pre-commit hook to stop automatic scanning. | None | `npx git-cli-scanner disable` |
+| `scan` | Manually scans the currently staged files (files added via `git add`). | `--show-sol` (Shows suggested solutions) | `npx git-cli-scanner scan`<br>`npx git-cli-scanner scan --show-sol` |
+| `scan-all` | Recursively scans an entire directory for secrets. | `<dir>` (The directory to scan)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-all .`<br>`npx git-cli-scanner scan-all ./src --show-sol` |
+| `scan-history`| Scans Git commit history for leaked secrets (Time Travel). | `--id <hash>` (Scan a specific commit)<br>`--since="<time>"` (Scan from a time)<br>`--all` (Scan entire history)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-history`<br>`npx git-cli-scanner scan-history --id 3a4b5c6`<br>`npx git-cli-scanner scan-history --since="30 days ago"`<br>`npx git-cli-scanner scan-history --all` |
+| `explore` | Launches an interactive Terminal User Interface (TUI) to navigate and scan files. | None | `npx git-cli-scanner explore` |
 
-```bash
-npx git-cli-scanner scan-all .
-npx git-cli-scanner scan-all ./src
-npx git-cli-scanner scan-all tests --show-sol
-```
+### 6. Interactive File Explorer (TUI)
 
-### Interactive file explorer
+Launch an interactive Terminal User Interface (TUI) to navigate your project directory and manually select files to scan.
 
 ```bash
-npx git-cli-scanner explore
+git-cli-scanner explore
 ```
 
 | Key | Action |
@@ -90,15 +62,39 @@ npx git-cli-scanner explore
 
 ## Severity Levels
 
+The scanner categorizes findings into different severity levels:
+
 | Indicator | Level | Color | Meaning |
 |-----------|-------|-------|---------|
-| `●` | HIGH | Red | Hardcoded secrets that must be removed |
-| `●` | MEDIUM | Yellow | Risky files not in .gitignore |
-| `○` | IGNORED | Dim | Test/example values (auto-detected) |
+| `●` | HIGH | Red | Hardcoded secrets that pose a critical risk and must be removed. |
+| `●` | MEDIUM | Yellow | Risky files or configurations not safely ignored in `.gitignore`. |
+| `○` | IGNORED | Dim | Test/example values (auto-detected dummy values that pose no risk). |
 
 ---
 
-## Running Tests
+## Example Output
+
+```
+✖ Found 2 vulnerabilities! (2 blockers)
+
+Scan Results:
+
+  ● HIGH · aws-secret-key
+    File:  src/config/aws.ts:12
+    Match: aws_secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEX...
+    Risk:  Compromised AWS Secret Keys grant direct access to your entire cloud infrastructure.
+
+  ● HIGH · database-connection-string
+    File:  src/db/connection.ts:5
+    Match: mongodb+srv://admin:supersecret123@cluster0.mongo...
+    Risk:  An attacker can directly connect to your database instance, allowing them to steal user data.
+```
+
+---
+
+## Running Tests Locally
+
+If you are contributing to the project, you can run the test suite using Vitest:
 
 ```bash
 npm test