guardrail-security 1.0.1 → 2.0.0

package/dist/secrets/index.d.ts

@@ -7,4 +7,8 @@ export * from './patterns';
 export { secretsGuardian, SecretsGuardian } from './guardian';
 export { preCommitHook } from './pre-commit';
 export { vaultIntegration } from './vault-integration';
+export { loadCustomPatterns, ConfigValidationError } from './config-loader';
+export { Allowlist } from './allowlist';
+export { adjustRiskByContext, getContextDescription } from './contextual-risk';
+export { scanGitHistory } from './git-scanner';
 //# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/secrets/index.js

@@ -19,7 +19,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.vaultIntegration = exports.preCommitHook = exports.SecretsGuardian = exports.secretsGuardian = void 0;
+exports.scanGitHistory = exports.getContextDescription = exports.adjustRiskByContext = exports.Allowlist = exports.ConfigValidationError = exports.loadCustomPatterns = exports.vaultIntegration = exports.preCommitHook = exports.SecretsGuardian = exports.secretsGuardian = void 0;
 __exportStar(require("./patterns"), exports);
 var guardian_1 = require("./guardian");
 Object.defineProperty(exports, "secretsGuardian", { enumerable: true, get: function () { return guardian_1.secretsGuardian; } });
@@ -28,3 +28,13 @@ var pre_commit_1 = require("./pre-commit");
 Object.defineProperty(exports, "preCommitHook", { enumerable: true, get: function () { return pre_commit_1.preCommitHook; } });
 var vault_integration_1 = require("./vault-integration");
 Object.defineProperty(exports, "vaultIntegration", { enumerable: true, get: function () { return vault_integration_1.vaultIntegration; } });
+var config_loader_1 = require("./config-loader");
+Object.defineProperty(exports, "loadCustomPatterns", { enumerable: true, get: function () { return config_loader_1.loadCustomPatterns; } });
+Object.defineProperty(exports, "ConfigValidationError", { enumerable: true, get: function () { return config_loader_1.ConfigValidationError; } });
+var allowlist_1 = require("./allowlist");
+Object.defineProperty(exports, "Allowlist", { enumerable: true, get: function () { return allowlist_1.Allowlist; } });
+var contextual_risk_1 = require("./contextual-risk");
+Object.defineProperty(exports, "adjustRiskByContext", { enumerable: true, get: function () { return contextual_risk_1.adjustRiskByContext; } });
+Object.defineProperty(exports, "getContextDescription", { enumerable: true, get: function () { return contextual_risk_1.getContextDescription; } });
+var git_scanner_1 = require("./git-scanner");
+Object.defineProperty(exports, "scanGitHistory", { enumerable: true, get: function () { return git_scanner_1.scanGitHistory; } });

package/dist/secrets/patterns.d.ts

@@ -7,36 +7,65 @@ export declare enum SecretType {
     DATABASE_URL = "database_url",
     JWT_SECRET = "jwt_secret",
     AWS_ACCESS_KEY = "aws_access_key",
-    OTHER = "other",
     AWS_SECRET_KEY = "aws_secret_key",
     GITHUB_TOKEN = "github_token",
     GOOGLE_API_KEY = "google_api_key",
     STRIPE_KEY = "stripe_key",
-    JWT_TOKEN = "jwt_token",
     SLACK_TOKEN = "slack_token",
-    API_KEY_GENERIC = "api_key_generic"
+    JWT_TOKEN = "jwt_token",
+    API_KEY_GENERIC = "api_key_generic",
+    PASSWORD_GENERIC = "password_generic",
+    OTHER = "other"
 }
-/**
- * Secret detection pattern
- */
+export type RiskLevel = 'high' | 'medium' | 'low';
 export interface SecretPattern {
     type: SecretType;
     name: string;
+    /**
+     * IMPORTANT:
+     * - Store patterns WITHOUT the `g` flag (we clone to global during scanning).
+     * - Keep needed flags like `i` on this regex; the scanner preserves them.
+     */
     pattern: RegExp;
+    /**
+     * Which capture group contains the actual secret value.
+     * If omitted, scanner will use group 1 if present, else group 0.
+     */
+    valueGroup?: number;
+    /**
+     * Entropy threshold (Shannon). Used to reduce false positives.
+     */
     minEntropy?: number;
+    /**
+     * Risk drives recommendations & severity.
+     */
+    risk: RiskLevel;
     description: string;
     examples: string[];
+    /**
+     * Optional custom redaction for display (safe logging/UI).
+     * If omitted, the scanner uses a default masking strategy.
+     */
+    redact?: (value: string, match: RegExpMatchArray) => string;
 }
 /**
  * Comprehensive secret detection patterns
+ * Notes:
+ * - Examples are clearly fake.
+ * - Patterns are designed to be high-signal; add more vendors as needed.
+ */
+export declare const SECRET_PATTERNS: ReadonlyArray<SecretPattern>;
+/**
+ * Test/example value patterns (used for down-weighting confidence, optional exclusion).
  */
-export declare const SECRET_PATTERNS: SecretPattern[];
+export declare const TEST_PATTERNS: ReadonlyArray<RegExp>;
 /**
- * Test/example value patterns (to exclude false positives)
+ * Context patterns that are strongly associated with false positives (schemas/validators/etc).
+ * Scanner uses these to skip matches in certain code lines.
  */
-export declare const TEST_PATTERNS: RegExp[];
+export declare const CONTEXT_EXCLUSION_PATTERNS: ReadonlyArray<RegExp>;
 /**
- * Common false positive values
+ * Common false positive literal values
  */
 export declare const FALSE_POSITIVE_VALUES: Set<string>;
 //# sourceMappingURL=patterns.d.ts.map

package/dist/secrets/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/secrets/patterns.ts"],"names":[],"mappings":"AACA,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IACzB,cAAc,mBAAmB;IACjC,KAAK,UAAU;IACf,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,eAAe,oBAAoB;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,EAyG1C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,UAkBzB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAiBhC,CAAC"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/secrets/patterns.ts"],"names":[],"mappings":"AAIA,oBAAY,UAAU;IACpB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,UAAU,eAAe;IAEzB,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IAEjC,YAAY,iBAAiB;IAC7B,cAAc,mBAAmB;IACjC,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAE3B,SAAS,cAAc;IACvB,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IAErC,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IAEb;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,IAAI,EAAE,SAAS,CAAC;IAEhB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,KAAK,MAAM,CAAC;CAC7D;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,aAAa,CAwIxD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,MAAM,CAY/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,MAAM,CA2B5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAiBhC,CAAC"}

package/dist/secrets/patterns.js

@@ -1,7 +1,9 @@
 "use strict";
+/* patterns.ts
+ * Enterprise-grade secret patterns & false-positive controls
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FALSE_POSITIVE_VALUES = exports.TEST_PATTERNS = exports.SECRET_PATTERNS = exports.SecretType = void 0;
-// Define SecretType locally since it's not exported from database
+exports.FALSE_POSITIVE_VALUES = exports.CONTEXT_EXCLUSION_PATTERNS = exports.TEST_PATTERNS = exports.SECRET_PATTERNS = exports.SecretType = void 0;
 var SecretType;
 (function (SecretType) {
     SecretType["API_KEY"] = "api_key";
@@ -12,116 +14,148 @@ var SecretType;
     SecretType["DATABASE_URL"] = "database_url";
     SecretType["JWT_SECRET"] = "jwt_secret";
     SecretType["AWS_ACCESS_KEY"] = "aws_access_key";
-    SecretType["OTHER"] = "other";
     SecretType["AWS_SECRET_KEY"] = "aws_secret_key";
     SecretType["GITHUB_TOKEN"] = "github_token";
     SecretType["GOOGLE_API_KEY"] = "google_api_key";
     SecretType["STRIPE_KEY"] = "stripe_key";
-    SecretType["JWT_TOKEN"] = "jwt_token";
     SecretType["SLACK_TOKEN"] = "slack_token";
+    SecretType["JWT_TOKEN"] = "jwt_token";
     SecretType["API_KEY_GENERIC"] = "api_key_generic";
+    SecretType["PASSWORD_GENERIC"] = "password_generic";
+    SecretType["OTHER"] = "other";
 })(SecretType || (exports.SecretType = SecretType = {}));
 /**
  * Comprehensive secret detection patterns
+ * Notes:
+ * - Examples are clearly fake.
+ * - Patterns are designed to be high-signal; add more vendors as needed.
  */
 exports.SECRET_PATTERNS = [
-    // AWS Access Keys
+    // ---------- AWS ----------
     {
-        type: 'AWS_ACCESS_KEY',
+        type: SecretType.AWS_ACCESS_KEY,
         name: 'AWS Access Key ID',
-        pattern: /(AKIA[0-9A-Z]{16})/,
+        pattern: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/,
+        valueGroup: 0,
         minEntropy: 3.5,
-        description: 'AWS Access Key ID (starts with AKIA)',
-        examples: ['AKIAIOSFODNN7EXAMPLE'],
+        risk: 'high',
+        description: 'AWS Access Key ID (AKIA/ASIA + 16 chars)',
+        examples: ['AKIAIOSFODNN7EXAMPLE', 'ASIAIOSFODNN7EXAMPLE'],
     },
-    // AWS Secret Keys
     {
-        type: 'AWS_SECRET_KEY',
+        type: SecretType.AWS_SECRET_KEY,
         name: 'AWS Secret Access Key',
-        pattern: /aws[_\s]*secret[_\s]*access[_\s]*key[_\s]*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/i,
+        pattern: /\baws[_\s-]*secret[_\s-]*access[_\s-]*key\b\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/i,
+        valueGroup: 1,
         minEntropy: 4.5,
-        description: 'AWS Secret Access Key (40 characters)',
+        risk: 'high',
+        description: 'AWS Secret Access Key assigned in config (40 chars)',
         examples: ['aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'],
     },
-    // GitHub Personal Access Tokens
+    // ---------- GitHub ----------
     {
-        type: 'GITHUB_TOKEN',
-        name: 'GitHub Personal Access Token',
-        pattern: /(ghp_[a-zA-Z0-9]{36}|gho_[a-zA-Z0-9]{36}|ghu_[a-zA-Z0-9]{36}|ghs_[a-zA-Z0-9]{36}|ghr_[a-zA-Z0-9]{36})/,
-        description: 'GitHub Personal Access Token (ghp_, gho_, ghu_, ghs_, ghr_)',
+        type: SecretType.GITHUB_TOKEN,
+        name: 'GitHub Token',
+        pattern: /\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/,
+        valueGroup: 0,
+        risk: 'high',
+        description: 'GitHub personal/app tokens (ghp_/gho_/...)',
         examples: ['ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'],
     },
-    // Google API Keys
+    // ---------- Google ----------
     {
-        type: 'GOOGLE_API_KEY',
+        type: SecretType.GOOGLE_API_KEY,
         name: 'Google API Key',
-        pattern: /(AIza[0-9A-Za-z\-_]{35})/,
-        description: 'Google API Key (starts with AIza)',
+        pattern: /\bAIza[0-9A-Za-z\-_]{35}\b/,
+        valueGroup: 0,
+        risk: 'medium',
+        description: 'Google API Key (AIzA...)',
         examples: ['AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe'],
     },
-    // Stripe API Keys
+    // ---------- Stripe ----------
     {
-        type: 'STRIPE_KEY',
-        name: 'Stripe API Key',
-        pattern: /(sk_live_[0-9a-zA-Z]{24,}|pk_live_[0-9a-zA-Z]{24,}|rk_live_[0-9a-zA-Z]{24,})/,
-        description: 'Stripe Live API Key',
+        type: SecretType.STRIPE_KEY,
+        name: 'Stripe Live Secret/Public/Restricted Key',
+        pattern: /\b(sk_live|pk_live|rk_live)_[0-9A-Za-z]{24,}\b/,
+        valueGroup: 0,
+        risk: 'high',
+        description: 'Stripe live keys (sk_live / pk_live / rk_live)',
         examples: ['sk_live_1234567890abcdefghijklmn'],
     },
-    // JWT Tokens
+    // ---------- Slack ----------
     {
-        type: 'JWT_TOKEN',
+        type: SecretType.SLACK_TOKEN,
+        name: 'Slack Token',
+        pattern: /\b(xox[pboa]-\d{10,13}-\d{10,13}-\d{10,13}-[a-z0-9]{32})\b/,
+        valueGroup: 1,
+        risk: 'high',
+        description: 'Slack bot/user/app tokens (xoxb/xoxp/xoxa/xoxo)',
+        examples: ['xoxb-0000000000-0000000000-0000000000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'],
+    },
+    // ---------- JWT ----------
+    {
+        type: SecretType.JWT_TOKEN,
         name: 'JWT Token',
-        pattern: /(eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]+)/,
+        pattern: /\b(eyJ[0-9A-Za-z_-]*\.[0-9A-Za-z_-]*\.[0-9A-Za-z_-]+)\b/,
+        valueGroup: 1,
         minEntropy: 4.0,
-        description: 'JSON Web Token (JWT)',
-        examples: ['eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U'],
+        risk: 'medium',
+        description: 'JSON Web Token (header.payload.signature)',
+        examples: [
+            'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U',
+        ],
     },
-    // Private Keys
+    // ---------- Private keys / certs ----------
     {
-        type: 'PRIVATE_KEY',
-        name: 'Private Key',
-        pattern: /(-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----)/,
-        description: 'Private Key (RSA, EC, OpenSSH, DSA)',
+        type: SecretType.PRIVATE_KEY,
+        name: 'Private Key Block',
+        pattern: /(-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----)/,
+        valueGroup: 1,
+        risk: 'high',
+        description: 'PEM private key blocks (RSA/EC/OpenSSH/DSA)',
         examples: ['-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgk...\\n-----END PRIVATE KEY-----'],
     },
-    // Database URLs with credentials
+    // ---------- Database URLs (credentials embedded) ----------
     {
-        type: 'DATABASE_URL',
-        name: 'Database URL with Password',
-        pattern: /(postgres|mysql|mongodb|redis):\/\/[a-zA-Z0-9_-]+:([a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]+)@[a-zA-Z0-9.-]+:[0-9]+/,
-        minEntropy: 3.0,
-        description: 'Database connection string with embedded password',
+        type: SecretType.DATABASE_URL,
+        name: 'Database URL with Embedded Credentials',
+        pattern: /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/([^:\s\/]+):([^@\s\/]+)@([A-Za-z0-9.-]+)(?::(\d{2,5}))?(\/[^\s'"]*)?/i,
+        valueGroup: 0,
+        risk: 'high',
+        description: 'Connection string contains username:password@host',
         examples: ['postgresql://user:password123@localhost:5432/dbname'],
+        redact: (_value, match) => {
+            const scheme = match[1] ?? 'db';
+            const host = match[4] ?? 'host';
+            const port = match[5] ? `:${match[5]}` : '';
+            return `${scheme}://***:***@${host}${port}/***`;
+        },
     },
-    // Slack Tokens
+    // ---------- Generic high-entropy API keys ----------
     {
-        type: 'SLACK_TOKEN',
-        name: 'Slack Token',
-        pattern: /(xox[pboa]-[0-9]{10,13}-[0-9]{10,13}-[0-9]{10,13}-[a-z0-9]{32})/,
-        description: 'Slack Bot/User/App Token',
-        examples: ['xoxb-0000000000-0000000000-0000000000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'],
-    },
-    // Generic API Keys (high entropy)
-    {
-        type: 'API_KEY_GENERIC',
-        name: 'Generic API Key',
-        pattern: /(?:api[_\s-]?key|apikey|access[_\s-]?token|auth[_\s-]?token|secret[_\s-]?key)[_\s]*[=:]\s*['"]?([a-zA-Z0-9_\-]{32,})['"]?/i,
+        type: SecretType.API_KEY_GENERIC,
+        name: 'Generic API Key / Token Assignment',
+        pattern: /\b(?:api[_\s-]?key|apikey|access[_\s-]?token|auth[_\s-]?token|secret[_\s-]?key)\b[_\s]*[=:]\s*['"]?([A-Za-z0-9_\-]{32,})['"]?/i,
+        valueGroup: 1,
         minEntropy: 4.0,
-        description: 'Generic API key or access token (high entropy)',
+        risk: 'medium',
+        description: 'Generic API key/token (assignment + long value)',
         examples: ['api_key = abcdef1234567890abcdef1234567890'],
     },
-    // Generic Passwords
+    // ---------- Generic password assignment ----------
     {
-        type: 'PASSWORD_GENERIC',
-        name: 'Generic Password',
-        pattern: /(?:password|passwd|pwd)[_\s]*[=:]\s*['"]([^'"]{8,})['"]|(?:password|passwd|pwd)[_\s]*[=:]\s*([^\s]{8,})/i,
-        minEntropy: 3.0,
-        description: 'Generic password in configuration',
+        type: SecretType.PASSWORD_GENERIC,
+        name: 'Generic Password Assignment',
+        pattern: /\b(?:password|passwd|pwd)\b\s*[=:]\s*['"]([^'"]{8,128})['"]/i,
+        valueGroup: 1,
+        minEntropy: 3.5,
+        risk: 'medium',
+        description: 'Password-like assignment (quoted, 8–128 chars)',
         examples: ['password = "MySecretP@ssw0rd"'],
     },
 ];
 /**
- * Test/example value patterns (to exclude false positives)
+ * Test/example value patterns (used for down-weighting confidence, optional exclusion).
  */
 exports.TEST_PATTERNS = [
     /test/i,
@@ -131,19 +165,43 @@ exports.TEST_PATTERNS = [
     /fake/i,
     /dummy/i,
     /placeholder/i,
-    /\*{3,}/,
-    /x{3,}/i,
-    /0{5,}/,
-    /1{5,}/,
-    /abc{3,}/i,
-    /qwerty/i,
-    /password123/i,
     /changeme/i,
     /your[_-]?key/i,
     /your[_-]?secret/i,
+    /password123/i,
+];
+/**
+ * Context patterns that are strongly associated with false positives (schemas/validators/etc).
+ * Scanner uses these to skip matches in certain code lines.
+ */
+exports.CONTEXT_EXCLUSION_PATTERNS = [
+    /\.min\s*\(/i,
+    /\.max\s*\(/i,
+    /\.length\b/i,
+    /\bschema\b/i,
+    /\bvalidation\b/i,
+    /\bvalidator\b/i,
+    /\.string\s*\(/i,
+    /\.required\b/i,
+    /\.optional\b/i,
+    /\bzod\./i,
+    /\byup\./i,
+    /\bjoi\./i,
+    /__tests__/i,
+    /__mocks__/i,
+    /\bmock\b/i,
+    /\bstub\b/i,
+    /\bfixture\b/i,
+    /\bprocess\.env\b/i,
+    /\benv\./i,
+    /\bconfig\./i,
+    /\bsettings\./i,
+    /\boptions\./i,
+    /\bparams\./i,
+    /\bprops\./i,
 ];
 /**
- * Common false positive values
+ * Common false positive literal values
  */
 exports.FALSE_POSITIVE_VALUES = new Set([
     'example',

package/dist/secrets/pre-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre-commit.d.ts","sourceRoot":"","sources":["../../src/secrets/pre-commit.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,kBAAkB,IAAI,MAAM;IAoB5B;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA+CpE;;OAEG;IACH,OAAO,CAAC,cAAc;IAqCtB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAWnC;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC"}
+{"version":3,"file":"pre-commit.d.ts","sourceRoot":"","sources":["../../src/secrets/pre-commit.ts"],"names":[],"mappings":"AAKA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACH,kBAAkB,IAAI,MAAM;IAoB5B;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgDpE;;OAEG;IACH,OAAO,CAAC,cAAc;IAqCtB;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAWnC;AAGD,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/secrets/pre-commit.js

@@ -49,7 +49,7 @@ exit 0
             // Scan each staged file
             const allDetections = [];
             for (const file of stagedFiles) {
-                const detections = await guardian_1.secretsGuardian.scanContent(file.content, file.path, {
+                const detections = await guardian_1.secretsGuardian.scanContent(file.content, file.path, 'pre-commit', {
                     excludeTests: true,
                     minConfidence: 0.7,
                 });

package/dist/secrets/vault-integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-integration.d.ts","sourceRoot":"","sources":["../../src/secrets/vault-integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAyC;IAE9D;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAY/F;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA2DlC;;OAEG;IACG,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKrF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK9D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM;IA4BtD;;OAEG;IACH,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAyDzE;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM;IA0B/D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACvE,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAoDnC;AAGD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}
+{"version":3,"file":"vault-integration.d.ts","sourceRoot":"","sources":["../../src/secrets/vault-integration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI7C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAyC;IAE9D;;OAEG;IACH,OAAO,CAAC,WAAW;IAuBnB;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAY/F;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IA2DlC;;OAEG;IACG,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKrF;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAK9D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM;IA6BtD;;OAEG;IACH,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAyDzE;;OAEG;IACH,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM;IA0B/D;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlF;;OAEG;IACG,mBAAmB,CACvB,UAAU,EAAE,eAAe,EAAE,EAC7B,WAAW,EAAE,WAAW,EACxB,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACvE,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAoDnC;AAGD,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}

package/dist/secrets/vault-integration.js

@@ -147,6 +147,7 @@ class VaultIntegration {
             [patterns_1.SecretType.CERTIFICATE]: 'CERTIFICATE',
             [patterns_1.SecretType.JWT_SECRET]: 'JWT_SECRET',
             [patterns_1.SecretType.PASSWORD]: 'PASSWORD',
+            [patterns_1.SecretType.PASSWORD_GENERIC]: 'PASSWORD',
             [patterns_1.SecretType.OTHER]: 'SECRET'
         };
         const baseName = typeMap[detection.secretType] || 'SECRET';

package/dist/supply-chain/detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/supply-chain/detector.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,eAAe,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAkB,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAIzE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIxE;;OAEG;IACG,yBAAyB,CAC7B,YAAY,EAAE,MAAM,EACpB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QAAE,qBAAqB,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB9D;;OAEG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAiFjC;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA2D1E;AAGD,eAAO,MAAM,mBAAmB,qBAA4B,CAAC"}
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/supply-chain/detector.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,eAAe,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAkB,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAIzE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,cAAc,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,WAAW,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIxE;;OAEG;IACG,yBAAyB,CAC7B,YAAY,EAAE,MAAM,EACpB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC;QAAE,qBAAqB,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB9D;;OAEG;IACG,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;IAiFjC;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA2D1E;AAGD,eAAO,MAAM,mBAAmB,qBAA4B,CAAC"}

package/dist/supply-chain/detector.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.supplyChainDetector = exports.SupplyChainDetector = void 0;
-const database_1 = require("@guardrail/database");
+// Stub prisma for standalone use
+const prisma = null;
 const typosquat_1 = require("./typosquat");
 const malicious_db_1 = require("./malicious-db");
 const script_analyzer_1 = require("./script-analyzer");
@@ -79,7 +80,7 @@ class SupplyChainDetector {
             }
         }
         // Save to database
-        await database_1.prisma.dependencyAnalysis.create({
+        await prisma.dependencyAnalysis.create({
             data: {
                 projectId,
                 packageName,
@@ -141,7 +142,7 @@ class SupplyChainDetector {
             generatedAt: new Date(),
         };
         // @ts-ignore - SBOM model exists in schema, Prisma client may need regeneration
-        const savedSBOM = await database_1.prisma.sBOM.create({
+        const savedSBOM = await prisma.sBOM.create({
             data: {
                 id: sbom.id,
                 projectId,