git-cli-scanner 1.4.0 → 1.5.0

package/dist/cli.js

@@ -229,6 +229,20 @@ var init_cloudProviders = __esm({
         pattern: /AIza[0-9A-Za-z\-_]{35}/,
         risk: "Attackers can bypass quotas to abuse GCP services like Maps API or Vertex AI, causing high billing charges.",
         solution: "Restrict the key in Google Cloud Console (APIs & Services > Credentials) to specific IP addresses/apps, or revoke it and use GCP Service Accounts."
+      },
+      {
+        id: "firebase-secret",
+        description: "Firebase API Key or Secret",
+        pattern: /firebase[_-]?(?:api[_-]?key|secret)[\s:=]+["'][a-zA-Z0-9\-_]{30,}["']/i,
+        risk: "Attackers can bypass security rules, read/write to your Firebase database, or exhaust quotas.",
+        solution: "Revoke the key in the Firebase console and restrict new keys to specific domains or IP addresses."
+      },
+      {
+        id: "firebase-service-account",
+        description: "Firebase Service Account JSON (Heuristic)",
+        pattern: /"type"\s*:\s*"service_account"|-----BEGIN PRIVATE KEY-----/i,
+        risk: "Service accounts grant full administrative access to your Firebase project, including databases, auth, and storage.",
+        solution: "Delete the service account key in Google Cloud IAM and never commit service account JSON files. Use environment variables."
       }
     ];
     cloudProviderScanner = {
@@ -397,7 +411,7 @@ var init_envFiles = __esm({
       scan(diff) {
         const issues = [];
         const filename = diff.file.split("/").pop() || "";
-        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx"];
+        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx", ".crt", ".cer", ".keystore"];
         const isEnvFile = /(^|\/)\.env(\..+)?$/.test(diff.file);
         const isNodeModules = diff.file.startsWith("node_modules/");
         if (isEnvFile || isNodeModules || bannedExtensions.some((ext) => diff.file.endsWith(ext))) {
@@ -458,6 +472,20 @@ var init_infrastructure = __esm({
         pattern: /(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\/\s]+:[^@\/\s]+@[^:\/\s]+(?::\d+)?\//,
         risk: "An attacker can directly connect to your database instance, allowing them to steal, modify, or delete all of your user data.",
         solution: "Remove the hardcoded database URL and read it from an environment variable (e.g., process.env.DATABASE_URL) at runtime."
+      },
+      {
+        id: "smtp-credentials",
+        description: "SMTP Email Credentials",
+        pattern: /(?:smtp|mail|sendgrid|mailgun)[\w\-]*(?:password|secret|key)[\s:=]+["'][^"'\s]+["']/i,
+        risk: "Attackers can use your SMTP server to send spam or phishing emails, ruining your domain reputation and incurring massive costs.",
+        solution: "Change the SMTP password via your email provider and inject it securely using a secrets manager."
+      },
+      {
+        id: "terraform-helm-secret",
+        description: "Terraform / Helm Variable Secret",
+        pattern: /(?:tf_var|helm_var)_[a-zA-Z0-9_]+[\s:=]+["'][^"'\s]+["']/i,
+        risk: "Hardcoded infrastructure secrets can grant access to the underlying platform resources and services.",
+        solution: "Use a proper secrets management backend for Terraform (e.g. Vault) or pass secrets via CI/CD runners."
       }
     ];
     infrastructureScanner = {
@@ -491,6 +519,242 @@ var init_infrastructure = __esm({
   }
 });
 
+// src/scans/authentication.ts
+var rules6, authenticationScanner;
+var init_authentication = __esm({
+  "src/scans/authentication.ts"() {
+    "use strict";
+    rules6 = [
+      {
+        id: "jwt-secret",
+        description: "JWT Secret Key",
+        pattern: /(?:jwt[_-]?(?:secret|key)|secret[_-]?key)[\s:=]+[\"'][a-zA-Z0-9\-_!@#$%^&*()=+]{16,}[\"']/i,
+        risk: "An attacker can forge JWT tokens to impersonate any user, including admins, bypassing all authentication.",
+        solution: "Rotate the secret, ensure all existing JWT sessions are invalidated, and inject it via environment variables."
+      },
+      {
+        id: "oauth-client-secret",
+        description: "OAuth Client Secret",
+        pattern: /(?:oauth|client)[_-]?(?:secret|key)[\s:=]+[\"'][a-zA-Z0-9\-_]{16,}[\"']/i,
+        risk: "Attackers can hijack the OAuth flow, authenticate on behalf of your users, or exhaust API quotas.",
+        solution: "Revoke the OAuth client secret in the identity provider console and generate a new one."
+      },
+      {
+        id: "session-secret",
+        description: "Session Cookie Secret",
+        pattern: /(?:session)[_-]?(?:secret|key)[\s:=]+[\"'][a-zA-Z0-9\-_!@#$%^&*()=+]{16,}[\"']/i,
+        risk: "Attackers can forge signed session cookies, allowing them to hijack active user sessions.",
+        solution: "Change the session secret to immediately invalidate all current user sessions."
+      }
+    ];
+    authenticationScanner = {
+      id: "authentication",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules6) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/packageRegistries.ts
+var rules7, packageRegistryScanner;
+var init_packageRegistries = __esm({
+  "src/scans/packageRegistries.ts"() {
+    "use strict";
+    rules7 = [
+      {
+        id: "npm-token",
+        description: "NPM Access Token",
+        pattern: /(?:npm|NPM)[_-]?(?:token|TOKEN)[\s:=]+["'](?:npm_[a-zA-Z0-9]{36})["']/i,
+        risk: "Attackers can publish malicious versions of your packages (Supply Chain Attack) to compromise all users downloading your code.",
+        solution: "Revoke the token immediately on npmjs.com and check your package versions for unauthorized releases."
+      },
+      {
+        id: "pypi-token",
+        description: "PyPI Access Token",
+        pattern: /pypi-[a-zA-Z0-9_-]{50,}/,
+        risk: "Attackers can upload malicious packages to PyPI under your name, distributing malware to your downstream users.",
+        solution: "Revoke the token in your PyPI account settings immediately and inspect recent package uploads."
+      },
+      {
+        id: "maven-gradle-password",
+        description: "Maven/Gradle Repository Password",
+        pattern: /(?:maven|gradle|nexus|artifactory)[\w\-]*password[\s:=]+["'][a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']/i,
+        risk: "Attackers can access your private artifact repository, steal proprietary code, or inject backdoors into your Java packages.",
+        solution: "Change your repository password and remove it from the hardcoded configuration file (e.g. settings.xml)."
+      }
+    ];
+    packageRegistryScanner = {
+      id: "package-registries",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules7) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/cicd.ts
+var rules8, cicdScanner;
+var init_cicd = __esm({
+  "src/scans/cicd.ts"() {
+    "use strict";
+    rules8 = [
+      {
+        id: "gitlab-ci-token",
+        description: "GitLab Personal Access Token",
+        pattern: /glpat-[a-zA-Z0-9\-]{20,}/,
+        risk: "Attackers can access your GitLab repositories, modify CI/CD pipelines, and steal sensitive code or deployment secrets.",
+        solution: "Revoke the token in your GitLab account (User Settings > Access Tokens) and use environment variables for CI authentication."
+      },
+      {
+        id: "github-actions-token",
+        description: "GitHub Actions Token / Fine-grained PAT",
+        pattern: /gh[p|a|s|r]_[a-zA-Z0-9]{36}/,
+        risk: "Compromised GitHub tokens can allow attackers to push code, trigger malicious Actions workflows, or steal repository secrets.",
+        solution: "Revoke the token immediately in GitHub (Settings > Developer Settings) and switch to short-lived GitHub App tokens if possible."
+      },
+      {
+        id: "jenkins-token",
+        description: "Jenkins Token or API Secret",
+        pattern: /(?:jenkins)[\w\-]*(?:token|secret|password)[\s:=]+["'][a-zA-Z0-9]{32}["']/i,
+        risk: "Attackers can trigger or modify your Jenkins build pipelines, leading to malicious deployments or lateral movement.",
+        solution: "Revoke the API token in the Jenkins User Configuration page and inject secrets using the Jenkins Credentials Manager."
+      }
+    ];
+    cicdScanner = {
+      id: "cicd-secrets",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules8) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "critical",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/webhooks.ts
+var rules9, webhooksScanner;
+var init_webhooks = __esm({
+  "src/scans/webhooks.ts"() {
+    "use strict";
+    rules9 = [
+      {
+        id: "stripe-secret",
+        description: "Stripe Secret Key / Webhook Secret",
+        pattern: /(?:sk_live|rk_live|whsec)_[a-zA-Z0-9]{24,}/,
+        risk: "Attackers can process fraudulent transactions, issue refunds, or steal customer financial data from your Stripe account.",
+        solution: "Roll the secret key immediately in the Stripe Dashboard (Developers > API keys) and monitor recent charges."
+      },
+      {
+        id: "paypal-secret",
+        description: "PayPal Client Secret",
+        pattern: /paypal[_-]?(?:client[_-]?secret|secret)[\s:=]+["'][a-zA-Z0-9\-_]{30,}["']/i,
+        risk: "Attackers can process fraudulent payments, manipulate subscriptions, or steal transaction history.",
+        solution: "Revoke the secret in the PayPal Developer Dashboard and generate a new one."
+      },
+      {
+        id: "generic-webhook",
+        description: "Generic Webhook URL (Slack, Discord, etc)",
+        pattern: /(?:https?:\/\/)?(?:hooks\.slack\.com|discord\.com\/api\/webhooks|maker\.ifttt\.com)[^\s'"]+/i,
+        risk: "Attackers can spam your internal channels, launch phishing attacks on your team, or exhaust rate limits.",
+        solution: "Delete the webhook in the respective service platform and re-generate a new URL. Do not commit webhook URLs directly."
+      }
+    ];
+    webhooksScanner = {
+      id: "webhooks",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules9) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: rule.solution,
+                  risk: rule.risk
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
 // src/scans/index.ts
 var allScanners;
 var init_scans = __esm({
@@ -502,13 +766,21 @@ var init_scans = __esm({
     init_privateKeys();
     init_envFiles();
     init_infrastructure();
+    init_authentication();
+    init_packageRegistries();
+    init_cicd();
+    init_webhooks();
     allScanners = [
       apiKeyScanner,
       cloudProviderScanner,
       collaborationScanner,
       privateKeyScanner,
       envFileScanner,
-      infrastructureScanner
+      infrastructureScanner,
+      authenticationScanner,
+      packageRegistryScanner,
+      cicdScanner,
+      webhooksScanner
     ];
   }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {