git-cli-scanner 1.5.0 → 1.5.1

package/dist/cli.js

@@ -233,7 +233,7 @@ var init_cloudProviders = __esm({
       {
         id: "firebase-secret",
         description: "Firebase API Key or Secret",
-        pattern: /firebase[_-]?(?:api[_-]?key|secret)[\s:=]+["'][a-zA-Z0-9\-_]{30,}["']/i,
+        pattern: /firebase[_-]?(?:api[_-]?key|secret)[\s:=]+["']?[a-zA-Z0-9\-_]{30,}["']?/i,
         risk: "Attackers can bypass security rules, read/write to your Firebase database, or exhaust quotas.",
         solution: "Revoke the key in the Firebase console and restrict new keys to specific domains or IP addresses."
       },
@@ -476,14 +476,14 @@ var init_infrastructure = __esm({
       {
         id: "smtp-credentials",
         description: "SMTP Email Credentials",
-        pattern: /(?:smtp|mail|sendgrid|mailgun)[\w\-]*(?:password|secret|key)[\s:=]+["'][^"'\s]+["']/i,
+        pattern: /(?:smtp|mail|sendgrid|mailgun)[\w\-]*(?:password|secret|key)[\s:=]+["']?[^"'\s]+["']?/i,
         risk: "Attackers can use your SMTP server to send spam or phishing emails, ruining your domain reputation and incurring massive costs.",
         solution: "Change the SMTP password via your email provider and inject it securely using a secrets manager."
       },
       {
         id: "terraform-helm-secret",
         description: "Terraform / Helm Variable Secret",
-        pattern: /(?:tf_var|helm_var)_[a-zA-Z0-9_]+[\s:=]+["'][^"'\s]+["']/i,
+        pattern: /(?:tf_var|helm_var)_[a-zA-Z0-9_]+[\s:=]+["']?[^"'\s]+["']?/i,
         risk: "Hardcoded infrastructure secrets can grant access to the underlying platform resources and services.",
         solution: "Use a proper secrets management backend for Terraform (e.g. Vault) or pass secrets via CI/CD runners."
       }
@@ -528,21 +528,21 @@ var init_authentication = __esm({
       {
         id: "jwt-secret",
         description: "JWT Secret Key",
-        pattern: /(?:jwt[_-]?(?:secret|key)|secret[_-]?key)[\s:=]+[\"'][a-zA-Z0-9\-_!@#$%^&*()=+]{16,}[\"']/i,
+        pattern: /(?:jwt[_-]?(?:secret|key)|secret[_-]?key)[\s:=]+["']?[a-zA-Z0-9\-_!@#$%^&*()=+]{16,}["']?/i,
         risk: "An attacker can forge JWT tokens to impersonate any user, including admins, bypassing all authentication.",
         solution: "Rotate the secret, ensure all existing JWT sessions are invalidated, and inject it via environment variables."
       },
       {
         id: "oauth-client-secret",
         description: "OAuth Client Secret",
-        pattern: /(?:oauth|client)[_-]?(?:secret|key)[\s:=]+[\"'][a-zA-Z0-9\-_]{16,}[\"']/i,
+        pattern: /(?:oauth|client)[_-]?(?:secret|key)[\s:=]+["']?[a-zA-Z0-9\-_]{16,}["']?/i,
         risk: "Attackers can hijack the OAuth flow, authenticate on behalf of your users, or exhaust API quotas.",
         solution: "Revoke the OAuth client secret in the identity provider console and generate a new one."
       },
       {
         id: "session-secret",
         description: "Session Cookie Secret",
-        pattern: /(?:session)[_-]?(?:secret|key)[\s:=]+[\"'][a-zA-Z0-9\-_!@#$%^&*()=+]{16,}[\"']/i,
+        pattern: /(?:session)[_-]?(?:secret|key)[\s:=]+["']?[a-zA-Z0-9\-_!@#$%^&*()=+]{16,}["']?/i,
         risk: "Attackers can forge signed session cookies, allowing them to hijack active user sessions.",
         solution: "Change the session secret to immediately invalidate all current user sessions."
       }
@@ -587,7 +587,7 @@ var init_packageRegistries = __esm({
       {
         id: "npm-token",
         description: "NPM Access Token",
-        pattern: /(?:npm|NPM)[_-]?(?:token|TOKEN)[\s:=]+["'](?:npm_[a-zA-Z0-9]{36})["']/i,
+        pattern: /(?:npm|NPM)[_-]?(?:token|TOKEN)[\s:=]+["']?(?:npm_[a-zA-Z0-9]{36})["']?/i,
         risk: "Attackers can publish malicious versions of your packages (Supply Chain Attack) to compromise all users downloading your code.",
         solution: "Revoke the token immediately on npmjs.com and check your package versions for unauthorized releases."
       },
@@ -601,7 +601,7 @@ var init_packageRegistries = __esm({
       {
         id: "maven-gradle-password",
         description: "Maven/Gradle Repository Password",
-        pattern: /(?:maven|gradle|nexus|artifactory)[\w\-]*password[\s:=]+["'][a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']/i,
+        pattern: /(?:maven|gradle|nexus|artifactory)[\w\-]*password[\s:=]+["']?[a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']?/i,
         risk: "Attackers can access your private artifact repository, steal proprietary code, or inject backdoors into your Java packages.",
         solution: "Change your repository password and remove it from the hardcoded configuration file (e.g. settings.xml)."
       }
@@ -660,7 +660,7 @@ var init_cicd = __esm({
       {
         id: "jenkins-token",
         description: "Jenkins Token or API Secret",
-        pattern: /(?:jenkins)[\w\-]*(?:token|secret|password)[\s:=]+["'][a-zA-Z0-9]{32}["']/i,
+        pattern: /(?:jenkins)[\w\-]*(?:token|secret|password)[\s:=]+["']?[a-zA-Z0-9]{20,}["']?/i,
         risk: "Attackers can trigger or modify your Jenkins build pipelines, leading to malicious deployments or lateral movement.",
         solution: "Revoke the API token in the Jenkins User Configuration page and inject secrets using the Jenkins Credentials Manager."
       }
@@ -712,7 +712,7 @@ var init_webhooks = __esm({
       {
         id: "paypal-secret",
         description: "PayPal Client Secret",
-        pattern: /paypal[_-]?(?:client[_-]?secret|secret)[\s:=]+["'][a-zA-Z0-9\-_]{30,}["']/i,
+        pattern: /paypal[_-]?(?:client[_-]?secret|secret)[\s:=]+["']?[a-zA-Z0-9\-_]{30,}["']?/i,
         risk: "Attackers can process fraudulent payments, manipulate subscriptions, or steal transaction history.",
         solution: "Revoke the secret in the PayPal Developer Dashboard and generate a new one."
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {

package/readme.md

@@ -1,20 +1,6 @@
 # Git CLI Scanner
 
-A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, database credentials, and Docker infrastructure tokens before they reach your Git history.
-
----
-
-## What Does It Scan For?
-
-Git CLI Scanner uses regex heuristics and pattern matching to detect:
-
-- **Cloud Provider Keys**: AWS Access/Secret Keys, Google Cloud API Keys.
-- **Infrastructure & Databases**: Database Connection Strings (MongoDB, PostgreSQL, MySQL, Redis), Docker Hub Personal Access Tokens.
-- **Collaboration Tools**: Slack Tokens, Slack Webhooks, GitHub PATs, OAuth Tokens, Discord Webhooks.
-- **Private Keys**: RSA, DSA, EC, OpenSSH, PGP Private Keys.
-- **Banned Files**: Accidental commits of `.env`, `.pem`, `.sqlite`, `.log` files (unless they are explicitly added to `.gitignore`).
-
-It features an intelligent **Ignore System** (Dummy Detection) that automatically downgrades the severity of fake, dummy, or test secrets commonly used in unit tests (e.g., `1234567890abcdef`, `dummy_token`).
+A powerful CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, database credentials, Docker tokens, CI/CD secrets, and infrastructure configs before they reach your Git history.
 
 ---
 
@@ -30,26 +16,18 @@ npx git-cli-scanner <command>
 
 ---
 
-## 🚀 Usage & Commands
-
-### Commands Overview
+## 🚀 Commands
 
 | Command | Description | Arguments & Flags | Example Usage |
 |---------|-------------|-------------------|---------------|
 | `init` | Installs the pre-commit hook to automatically scan files on `git commit`. | None | `npx git-cli-scanner init` |
 | `disable` | Removes the pre-commit hook to stop automatic scanning. | None | `npx git-cli-scanner disable` |
-| `scan` | Manually scans the currently staged files (files added via `git add`). | `--show-sol` (Shows suggested solutions) | `npx git-cli-scanner scan`<br>`npx git-cli-scanner scan --show-sol` |
-| `scan-all` | Recursively scans an entire directory for secrets. | `<dir>` (The directory to scan)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-all .`<br>`npx git-cli-scanner scan-all ./src --show-sol` |
-| `scan-history`| Scans Git commit history for leaked secrets (Time Travel). | `--id <hash>` (Scan a specific commit)<br>`--since="<time>"` (Scan from a time)<br>`--all` (Scan entire history)<br>`--show-sol` (Shows solutions) | `npx git-cli-scanner scan-history`<br>`npx git-cli-scanner scan-history --id 3a4b5c6`<br>`npx git-cli-scanner scan-history --since="30 days ago"`<br>`npx git-cli-scanner scan-history --all` |
-| `explore` | Launches an interactive Terminal User Interface (TUI) to navigate and scan files. | None | `npx git-cli-scanner explore` |
-
-### 6. Interactive File Explorer (TUI)
-
-Launch an interactive Terminal User Interface (TUI) to navigate your project directory and manually select files to scan.
+| `scan` | Manually scans the currently staged files (files added via `git add`). | `--show-sol` — Show suggested fixes for each finding | `npx git-cli-scanner scan`<br>`npx git-cli-scanner scan --show-sol` |
+| `scan-all` | Recursively scans an entire directory for secrets. | `<dir>` — The directory to scan<br>`--show-sol` — Show suggested fixes | `npx git-cli-scanner scan-all .`<br>`npx git-cli-scanner scan-all ./src --show-sol` |
+| `scan-history` | Scans Git commit history for leaked secrets (Time Travel). Defaults to the last commit. | `--id <hash>` — Scan a specific commit<br>`--since="<time>"` — Scan commits from a time range<br>`--all` — Scan entire history across all branches<br>`--show-sol` — Show fixes | `npx git-cli-scanner scan-history`<br>`npx git-cli-scanner scan-history --id 3a4b5c6`<br>`npx git-cli-scanner scan-history --since="30 days ago"`<br>`npx git-cli-scanner scan-history --all --show-sol` |
+| `explore` | Launches an interactive Terminal User Interface (TUI) to browse and scan files. | None | `npx git-cli-scanner explore` |
 
-```bash
-git-cli-scanner explore
-```
+### Interactive Explorer Keys
 
 | Key | Action |
 |-----|--------|
@@ -60,41 +38,98 @@ git-cli-scanner explore
 
 ---
 
-## Severity Levels
+## 🔍 What Does It Scan For?
+
+### Scanners & Detection Rules
+
+| Category | Rule ID | What It Detects | Severity |
+|----------|---------|-----------------|----------|
+| ☁️ Cloud Providers | `aws-access-key` | AWS Access Key IDs (`AKIA...`) | High |
+| ☁️ Cloud Providers | `aws-secret-key` | AWS Secret Access Keys (heuristics) | High |
+| ☁️ Cloud Providers | `gcp-api-key` | Google Cloud API Keys (`AIza...`) | High |
+| 🔥 Firebase | `firebase-secret` | Firebase API Keys / Secrets | High |
+| 🔥 Firebase | `firebase-service-account` | Firebase Service Account JSON (`"type": "service_account"`) | Critical |
+| 🪪 Authentication | `jwt-secret` | JWT Secret Keys (quoted or unquoted) | High |
+| 🪪 Authentication | `oauth-client-secret` | OAuth Client Secrets | High |
+| 🪪 Authentication | `session-secret` | Session Cookie Secrets | High |
+| 🔑 API Keys & Tokens | `generic-api-key` | Generic `api_key`, `api-key`, `API_KEY` patterns | High |
+| 🔑 API Keys & Tokens | `stripe-key` | Stripe API Keys (`sk_live_...`, `rk_live_...`) | High |
+| 🔑 API Keys & Tokens | `github-pat` | GitHub Personal Access Tokens | High |
+| 🔑 API Keys & Tokens | `slack-token` | Slack Bot/User Tokens (`xoxb-...`, `xoxp-...`) | High |
+| 🔑 API Keys & Tokens | `slack-webhook` | Slack Incoming Webhook URLs | High |
+| 🔑 API Keys & Tokens | `discord-webhook` | Discord Webhook URLs | High |
+| 📦 Package Registries | `npm-token` | NPM Access Tokens (`npm_...`) | High |
+| 📦 Package Registries | `pypi-token` | PyPI Access Tokens (`pypi-...`) | High |
+| 📦 Package Registries | `maven-gradle-password` | Maven/Gradle/Nexus/Artifactory Repository Passwords | High |
+| 🧰 CI/CD | `gitlab-ci-token` | GitLab Personal Access Tokens (`glpat-...`) | Critical |
+| 🧰 CI/CD | `github-actions-token` | GitHub Actions Runner Tokens (`ghp_...`, `ghs_...`) | Critical |
+| 🧰 CI/CD | `jenkins-token` | Jenkins API Tokens / Secrets | High |
+| 🏠 Infrastructure | `docker-hub-token` | Docker Hub Personal Access Tokens (`dckr_pat_...`) | High |
+| 🏠 Infrastructure | `database-connection-string` | Database Connection Strings (MongoDB, PostgreSQL, MySQL, Redis with credentials) | High |
+| 🏠 Infrastructure | `smtp-credentials` | SMTP / SendGrid / Mailgun email passwords | High |
+| 🏠 Infrastructure | `terraform-helm-secret` | Terraform (`tf_var_...`) and Helm (`helm_var_...`) variable secrets | High |
+| 🔌 Webhooks | `stripe-secret` | Stripe Secret Keys and Webhook Secrets (`sk_live_`, `whsec_`) | High |
+| 🔌 Webhooks | `paypal-secret` | PayPal Client Secrets | High |
+| 🔌 Webhooks | `generic-webhook` | Generic Webhook URLs (Slack, Discord, IFTTT) | High |
+| 🔒 Private Keys | `rsa-private-key` | RSA Private Key blocks (`-----BEGIN RSA PRIVATE KEY-----`) | High |
+| 🔒 Private Keys | `dsa-private-key` | DSA Private Key blocks | High |
+| 🔒 Private Keys | `ec-private-key` | EC Private Key blocks | High |
+| 🔒 Private Keys | `openssh-private-key` | OpenSSH Private Key blocks | High |
+| 🔒 Private Keys | `pgp-private-key` | PGP Private Key blocks | High |
+| 🔒 Certificates | `banned-file-type` | Banned file extensions: `.pem`, `.key`, `.p12`, `.pfx`, `.crt`, `.cer`, `.keystore`, `.sqlite`, `.db`, `.log`, `.env` | Medium |
+
+---
+
+## 🛡️ Intelligent Dummy Detection
+
+The scanner features an **Intelligent Ignore System** that automatically downgrades the severity of fake, dummy, or test secrets commonly used in unit tests and example files. This avoids blocking your commits with false positives.
+
+**Patterns recognized as dummy:**
+- Sequential characters: `1234567890abcdef`, `abcdefghijklmnop`
+- Common placeholders: `EXAMPLE`, `dummy`, `test`, `fake`, `placeholder`
+- Repetitive patterns: `aaaa`, `0000`
 
-The scanner categorizes findings into different severity levels:
+When a dummy value is detected, the finding is downgraded from `● HIGH` to `○ IGNORED (DUMMY)` and **will not block** your commit.
+
+---
+
+## Severity Levels
 
 | Indicator | Level | Color | Meaning |
 |-----------|-------|-------|---------|
-| `●` | HIGH | Red | Hardcoded secrets that pose a critical risk and must be removed. |
-| `●` | MEDIUM | Yellow | Risky files or configurations not safely ignored in `.gitignore`. |
-| `○` | IGNORED | Dim | Test/example values (auto-detected dummy values that pose no risk). |
+| `●` | CRITICAL | Red | CI/CD and service account secrets that grant admin-level access |
+| `●` | HIGH | Red | Hardcoded secrets that pose a critical risk and must be removed |
+| `●` | MEDIUM | Yellow | Risky files or configurations not safely ignored in `.gitignore` |
+| `○` | IGNORED | Dim | Test/example values (auto-detected dummy values that pose no risk) |
 
 ---
 
 ## Example Output
 
 ```
-✖ Found 2 vulnerabilities! (2 blockers)
+✖ Found 3 potential vulnerabilities! (3 blockers)
 
 Scan Results:
 
-  ● HIGH · aws-secret-key
-    File:  src/config/aws.ts:12
-    Match: aws_secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEX...
-    Risk:  Compromised AWS Secret Keys grant direct access to your entire cloud infrastructure.
+  ● HIGH · jwt-secret
+    File:  src/config/auth.ts:5
+    Match: JWT_SECRET=xJk9Lp2Rm5Qw8Yz1Xv4Bn7Cm...
+    Risk:  An attacker can forge JWT tokens to impersonate any user, including admins.
 
   ● HIGH · database-connection-string
-    File:  src/db/connection.ts:5
-    Match: mongodb+srv://admin:supersecret123@cluster0.mongo...
-    Risk:  An attacker can directly connect to your database instance, allowing them to steal user data.
+    File:  src/db/connection.ts:3
+    Match: mongodb+srv://admin:supersecret@cluster0.mongo...
+    Risk:  An attacker can directly connect to your database instance.
+
+  ○ IGNORED (DUMMY) · aws-access-key
+    File:  tests/mock.ts:10
+    Match: AKIAIOSFODNN7EXAMPLE...
+    Risk:  (auto-downgraded — recognized as a test/example value)
 ```
 
 ---
 
-## Running Tests Locally
-
-If you are contributing to the project, you can run the test suite using Vitest:
+## Running Tests
 
 ```bash
 npm test