git-cli-scanner 1.3.1 → 1.5.0

package/dist/cli.js

@@ -229,6 +229,20 @@ var init_cloudProviders = __esm({
         pattern: /AIza[0-9A-Za-z\-_]{35}/,
         risk: "Attackers can bypass quotas to abuse GCP services like Maps API or Vertex AI, causing high billing charges.",
         solution: "Restrict the key in Google Cloud Console (APIs & Services > Credentials) to specific IP addresses/apps, or revoke it and use GCP Service Accounts."
+      },
+      {
+        id: "firebase-secret",
+        description: "Firebase API Key or Secret",
+        pattern: /firebase[_-]?(?:api[_-]?key|secret)[\s:=]+["'][a-zA-Z0-9\-_]{30,}["']/i,
+        risk: "Attackers can bypass security rules, read/write to your Firebase database, or exhaust quotas.",
+        solution: "Revoke the key in the Firebase console and restrict new keys to specific domains or IP addresses."
+      },
+      {
+        id: "firebase-service-account",
+        description: "Firebase Service Account JSON (Heuristic)",
+        pattern: /"type"\s*:\s*"service_account"|-----BEGIN PRIVATE KEY-----/i,
+        risk: "Service accounts grant full administrative access to your Firebase project, including databases, auth, and storage.",
+        solution: "Delete the service account key in Google Cloud IAM and never commit service account JSON files. Use environment variables."
       }
     ];
     cloudProviderScanner = {
@@ -397,7 +411,7 @@ var init_envFiles = __esm({
       scan(diff) {
         const issues = [];
         const filename = diff.file.split("/").pop() || "";
-        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx"];
+        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx", ".crt", ".cer", ".keystore"];
         const isEnvFile = /(^|\/)\.env(\..+)?$/.test(diff.file);
         const isNodeModules = diff.file.startsWith("node_modules/");
         if (isEnvFile || isNodeModules || bannedExtensions.some((ext) => diff.file.endsWith(ext))) {
@@ -439,6 +453,308 @@ var init_envFiles = __esm({
   }
 });
 
+// src/scans/infrastructure.ts
+var rules5, infrastructureScanner;
+var init_infrastructure = __esm({
+  "src/scans/infrastructure.ts"() {
+    "use strict";
+    rules5 = [
+      {
+        id: "docker-hub-token",
+        description: "Docker Hub Personal Access Token",
+        pattern: /dckr_pat_[a-zA-Z0-9_\-]{25,}/,
+        risk: "An attacker can push malicious images to your Docker registries, leading to a supply chain attack on your production containers.",
+        solution: "Revoke this token immediately in Docker Hub (Account Settings > Security > New Access Token) and replace it using CI/CD secrets."
+      },
+      {
+        id: "database-connection-string",
+        description: "Database Connection String with Credentials",
+        pattern: /(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\/\s]+:[^@\/\s]+@[^:\/\s]+(?::\d+)?\//,
+        risk: "An attacker can directly connect to your database instance, allowing them to steal, modify, or delete all of your user data.",
+        solution: "Remove the hardcoded database URL and read it from an environment variable (e.g., process.env.DATABASE_URL) at runtime."
+      },
+      {
+        id: "smtp-credentials",
+        description: "SMTP Email Credentials",
+        pattern: /(?:smtp|mail|sendgrid|mailgun)[\w\-]*(?:password|secret|key)[\s:=]+["'][^"'\s]+["']/i,
+        risk: "Attackers can use your SMTP server to send spam or phishing emails, ruining your domain reputation and incurring massive costs.",
+        solution: "Change the SMTP password via your email provider and inject it securely using a secrets manager."
+      },
+      {
+        id: "terraform-helm-secret",
+        description: "Terraform / Helm Variable Secret",
+        pattern: /(?:tf_var|helm_var)_[a-zA-Z0-9_]+[\s:=]+["'][^"'\s]+["']/i,
+        risk: "Hardcoded infrastructure secrets can grant access to the underlying platform resources and services.",
+        solution: "Use a proper secrets management backend for Terraform (e.g. Vault) or pass secrets via CI/CD runners."
+      }
+    ];
+    infrastructureScanner = {
+      id: "infrastructure",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules5) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/authentication.ts
+var rules6, authenticationScanner;
+var init_authentication = __esm({
+  "src/scans/authentication.ts"() {
+    "use strict";
+    rules6 = [
+      {
+        id: "jwt-secret",
+        description: "JWT Secret Key",
+        pattern: /(?:jwt[_-]?(?:secret|key)|secret[_-]?key)[\s:=]+[\"'][a-zA-Z0-9\-_!@#$%^&*()=+]{16,}[\"']/i,
+        risk: "An attacker can forge JWT tokens to impersonate any user, including admins, bypassing all authentication.",
+        solution: "Rotate the secret, ensure all existing JWT sessions are invalidated, and inject it via environment variables."
+      },
+      {
+        id: "oauth-client-secret",
+        description: "OAuth Client Secret",
+        pattern: /(?:oauth|client)[_-]?(?:secret|key)[\s:=]+[\"'][a-zA-Z0-9\-_]{16,}[\"']/i,
+        risk: "Attackers can hijack the OAuth flow, authenticate on behalf of your users, or exhaust API quotas.",
+        solution: "Revoke the OAuth client secret in the identity provider console and generate a new one."
+      },
+      {
+        id: "session-secret",
+        description: "Session Cookie Secret",
+        pattern: /(?:session)[_-]?(?:secret|key)[\s:=]+[\"'][a-zA-Z0-9\-_!@#$%^&*()=+]{16,}[\"']/i,
+        risk: "Attackers can forge signed session cookies, allowing them to hijack active user sessions.",
+        solution: "Change the session secret to immediately invalidate all current user sessions."
+      }
+    ];
+    authenticationScanner = {
+      id: "authentication",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules6) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/packageRegistries.ts
+var rules7, packageRegistryScanner;
+var init_packageRegistries = __esm({
+  "src/scans/packageRegistries.ts"() {
+    "use strict";
+    rules7 = [
+      {
+        id: "npm-token",
+        description: "NPM Access Token",
+        pattern: /(?:npm|NPM)[_-]?(?:token|TOKEN)[\s:=]+["'](?:npm_[a-zA-Z0-9]{36})["']/i,
+        risk: "Attackers can publish malicious versions of your packages (Supply Chain Attack) to compromise all users downloading your code.",
+        solution: "Revoke the token immediately on npmjs.com and check your package versions for unauthorized releases."
+      },
+      {
+        id: "pypi-token",
+        description: "PyPI Access Token",
+        pattern: /pypi-[a-zA-Z0-9_-]{50,}/,
+        risk: "Attackers can upload malicious packages to PyPI under your name, distributing malware to your downstream users.",
+        solution: "Revoke the token in your PyPI account settings immediately and inspect recent package uploads."
+      },
+      {
+        id: "maven-gradle-password",
+        description: "Maven/Gradle Repository Password",
+        pattern: /(?:maven|gradle|nexus|artifactory)[\w\-]*password[\s:=]+["'][a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']/i,
+        risk: "Attackers can access your private artifact repository, steal proprietary code, or inject backdoors into your Java packages.",
+        solution: "Change your repository password and remove it from the hardcoded configuration file (e.g. settings.xml)."
+      }
+    ];
+    packageRegistryScanner = {
+      id: "package-registries",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules7) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/cicd.ts
+var rules8, cicdScanner;
+var init_cicd = __esm({
+  "src/scans/cicd.ts"() {
+    "use strict";
+    rules8 = [
+      {
+        id: "gitlab-ci-token",
+        description: "GitLab Personal Access Token",
+        pattern: /glpat-[a-zA-Z0-9\-]{20,}/,
+        risk: "Attackers can access your GitLab repositories, modify CI/CD pipelines, and steal sensitive code or deployment secrets.",
+        solution: "Revoke the token in your GitLab account (User Settings > Access Tokens) and use environment variables for CI authentication."
+      },
+      {
+        id: "github-actions-token",
+        description: "GitHub Actions Token / Fine-grained PAT",
+        pattern: /gh[p|a|s|r]_[a-zA-Z0-9]{36}/,
+        risk: "Compromised GitHub tokens can allow attackers to push code, trigger malicious Actions workflows, or steal repository secrets.",
+        solution: "Revoke the token immediately in GitHub (Settings > Developer Settings) and switch to short-lived GitHub App tokens if possible."
+      },
+      {
+        id: "jenkins-token",
+        description: "Jenkins Token or API Secret",
+        pattern: /(?:jenkins)[\w\-]*(?:token|secret|password)[\s:=]+["'][a-zA-Z0-9]{32}["']/i,
+        risk: "Attackers can trigger or modify your Jenkins build pipelines, leading to malicious deployments or lateral movement.",
+        solution: "Revoke the API token in the Jenkins User Configuration page and inject secrets using the Jenkins Credentials Manager."
+      }
+    ];
+    cicdScanner = {
+      id: "cicd-secrets",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules8) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "critical",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/webhooks.ts
+var rules9, webhooksScanner;
+var init_webhooks = __esm({
+  "src/scans/webhooks.ts"() {
+    "use strict";
+    rules9 = [
+      {
+        id: "stripe-secret",
+        description: "Stripe Secret Key / Webhook Secret",
+        pattern: /(?:sk_live|rk_live|whsec)_[a-zA-Z0-9]{24,}/,
+        risk: "Attackers can process fraudulent transactions, issue refunds, or steal customer financial data from your Stripe account.",
+        solution: "Roll the secret key immediately in the Stripe Dashboard (Developers > API keys) and monitor recent charges."
+      },
+      {
+        id: "paypal-secret",
+        description: "PayPal Client Secret",
+        pattern: /paypal[_-]?(?:client[_-]?secret|secret)[\s:=]+["'][a-zA-Z0-9\-_]{30,}["']/i,
+        risk: "Attackers can process fraudulent payments, manipulate subscriptions, or steal transaction history.",
+        solution: "Revoke the secret in the PayPal Developer Dashboard and generate a new one."
+      },
+      {
+        id: "generic-webhook",
+        description: "Generic Webhook URL (Slack, Discord, etc)",
+        pattern: /(?:https?:\/\/)?(?:hooks\.slack\.com|discord\.com\/api\/webhooks|maker\.ifttt\.com)[^\s'"]+/i,
+        risk: "Attackers can spam your internal channels, launch phishing attacks on your team, or exhaust rate limits.",
+        solution: "Delete the webhook in the respective service platform and re-generate a new URL. Do not commit webhook URLs directly."
+      }
+    ];
+    webhooksScanner = {
+      id: "webhooks",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules9) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
 // src/scans/index.ts
 var allScanners;
 var init_scans = __esm({
@@ -449,12 +765,22 @@ var init_scans = __esm({
     init_collaboration();
     init_privateKeys();
     init_envFiles();
+    init_infrastructure();
+    init_authentication();
+    init_packageRegistries();
+    init_cicd();
+    init_webhooks();
     allScanners = [
       apiKeyScanner,
       cloudProviderScanner,
       collaborationScanner,
       privateKeyScanner,
-      envFileScanner
+      envFileScanner,
+      infrastructureScanner,
+      authenticationScanner,
+      packageRegistryScanner,
+      cicdScanner,
+      webhooksScanner
     ];
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {

package/readme.md

@@ -1,98 +1,54 @@
 # Git CLI Scanner
 
-A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.
+A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, database credentials, and Docker infrastructure tokens before they reach your Git history.
 
 ---
 
-## Installation
-
-```bash
-# Install globally
-npm install -g git-cli-scanner
-
-# Or use directly with npx (no install needed)
-npx git-cli-scanner <command>
-```
-
----
+## What Does It Scan For?
 
-## Setup
+Git CLI Scanner uses regex heuristics and pattern matching to detect:
 
-```bash
-# Navigate to your project
-cd your-project
+- **Cloud Provider Keys**: AWS Access/Secret Keys, Google Cloud API Keys.
+- **Infrastructure & Databases**: Database Connection Strings (MongoDB, PostgreSQL, MySQL, Redis), Docker Hub Personal Access Tokens.
+- **Collaboration Tools**: Slack Tokens, Slack Webhooks, GitHub PATs, OAuth Tokens, Discord Webhooks.
+- **Private Keys**: RSA, DSA, EC, OpenSSH, PGP Private Keys.
+- **Banned Files**: Accidental commits of `.env`, `.pem`, `.sqlite`, `.log` files (unless they are explicitly added to `.gitignore`).
 
-# Initialize the pre-commit hook
-npx git-cli-scanner init
-```
-
-After running `init`, every time you run `git commit`, the scanner will automatically scan your staged files and warn you if any vulnerabilities are found.
+It features an intelligent **Ignore System** (Dummy Detection) that automatically downgrades the severity of fake, dummy, or test secrets commonly used in unit tests (e.g., `1234567890abcdef`, `dummy_token`).
 
 ---
 
-## Commands
-
-| Command | Description |
-|---------|-------------|
-| `init` | Install the pre-commit hook for automatic scanning |
-| `disable` | Remove the pre-commit hook and stop automatic scanning |
-| `scan` | Manually scan staged files |
-| `scan --show-sol` | Scan staged files and show suggested fixes |
-| `scan-all [dir]` | Scan an entire directory recursively |
-| `scan-history` | Scan Git commit history for leaked secrets |
-| `explore` | Launch interactive file explorer TUI |
-
-### Enable automatic scanning
-
-```bash
-npx git-cli-scanner init
-```
-
-Installs a pre-commit hook. After this, every `git commit` will automatically scan your staged files. If vulnerabilities are found, you choose to continue or abort.
-
-### Disable automatic scanning
-
-```bash
-npx git-cli-scanner disable
-```
-
-Removes the pre-commit hook. The scanner will no longer run automatically on `git commit`.
-
-### Scan staged files
+## Installation
 
 ```bash
-npx git-cli-scanner scan
-npx git-cli-scanner scan --show-sol
-```
-
-### Scan an entire directory
+# Install globally via NPM
+npm install -g git-cli-scanner
 
-```bash
-npx git-cli-scanner scan-all .
-npx git-cli-scanner scan-all ./src
-npx git-cli-scanner scan-all tests --show-sol
+# Or use directly with npx (no install needed)
+npx git-cli-scanner <command>
 ```
 
-### Scan Git history (Time Travel)
+---
 
-```bash
-# Scan the very last commit (default)
-npx git-cli-scanner scan-history
+## 🚀 Usage & Commands
 
-# Scan a specific commit by hash
-npx git-cli-scanner scan-history --id <hash>
+### Commands Overview
 
-# Scan all commits in the last 30 days
-npx git-cli-scanner scan-history --since="30 days ago"
+| Command | Description | Arguments & Flags | Example Usage |
+|---------|-------------|-------------------|---------------|
+| `init` | Installs the pre-commit hook to automatically scan files on `git commit`. | None | `npx git-cli-scanner init` |
+| `disable` | Removes the pre-commit hook to stop automatic scanning. | None | `npx git-cli-scanner disable` |
+| `scan` | Manually scans the currently staged files (files added via `git add`). | `--show-sol` (Shows suggested solutions) | `npx git-cli-scanner scan`<br>`npx git-cli-scanner scan --show-sol` |
+| `scan-all` | Recursively scans an entire directory for secrets. | `<dir>` (The directory to scan)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-all .`<br>`npx git-cli-scanner scan-all ./src --show-sol` |
+| `scan-history`| Scans Git commit history for leaked secrets (Time Travel). | `--id <hash>` (Scan a specific commit)<br>`--since="<time>"` (Scan from a time)<br>`--all` (Scan entire history)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-history`<br>`npx git-cli-scanner scan-history --id 3a4b5c6`<br>`npx git-cli-scanner scan-history --since="30 days ago"`<br>`npx git-cli-scanner scan-history --all` |
+| `explore` | Launches an interactive Terminal User Interface (TUI) to navigate and scan files. | None | `npx git-cli-scanner explore` |
 
-# Scan the entire Git history across all branches!
-npx git-cli-scanner scan-history --all
-```
+### 6. Interactive File Explorer (TUI)
 
-### Interactive file explorer
+Launch an interactive Terminal User Interface (TUI) to navigate your project directory and manually select files to scan.
 
 ```bash
-npx git-cli-scanner explore
+git-cli-scanner explore
 ```
 
 | Key | Action |
@@ -106,15 +62,39 @@ npx git-cli-scanner explore
 
 ## Severity Levels
 
+The scanner categorizes findings into different severity levels:
+
 | Indicator | Level | Color | Meaning |
 |-----------|-------|-------|---------|
-| `●` | HIGH | Red | Hardcoded secrets that must be removed |
-| `●` | MEDIUM | Yellow | Risky files not in .gitignore |
-| `○` | IGNORED | Dim | Test/example values (auto-detected) |
+| `●` | HIGH | Red | Hardcoded secrets that pose a critical risk and must be removed. |
+| `●` | MEDIUM | Yellow | Risky files or configurations not safely ignored in `.gitignore`. |
+| `○` | IGNORED | Dim | Test/example values (auto-detected dummy values that pose no risk). |
 
 ---
 
-## Running Tests
+## Example Output
+
+```
+✖ Found 2 vulnerabilities! (2 blockers)
+
+Scan Results:
+
+  ● HIGH · aws-secret-key
+    File:  src/config/aws.ts:12
+    Match: aws_secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEX...
+    Risk:  Compromised AWS Secret Keys grant direct access to your entire cloud infrastructure.
+
+  ● HIGH · database-connection-string
+    File:  src/db/connection.ts:5
+    Match: mongodb+srv://admin:supersecret123@cluster0.mongo...
+    Risk:  An attacker can directly connect to your database instance, allowing them to steal user data.
+```
+
+---
+
+## Running Tests Locally
+
+If you are contributing to the project, you can run the test suite using Vitest:
 
 ```bash
 npm test