iamsecure 0.0.0-stage → 0.1.0

package/src/code/rules.js

@@ -0,0 +1,545 @@
+// Code rules. Each rule is a line-level sink pattern plus how much it matters:
+//   when: 'always'  → report any match
+//         'dynamic' → only when the argument is built at runtime (template literal, concatenation, variable)
+//         'tainted' → only when user input flows in (req.query, searchParams, $_GET, request.args, …)
+//   sev / taintedSev: severity score without / with proven user input.
+//   category: vulnerability class (see risk/score.js) — decides how much browser-only code is discounted.
+//   requires: file must match this before the rule is tried.  context: override where the issue "runs".
+
+export const SOURCES = {
+  js: /\b(req|request|ctx|context)\.(query|params|body|headers|cookies|url|path)\b|\b(req|request)\.(json|text|formData)\(\)|\bsearchParams\b|\bparams\.\w+|\bformData\.get\(|\bevent\.(body|queryStringParameters|pathParameters|headers)\b|\b(window\.)?location\.(search|hash|href)\b|\bdocument\.(cookie|referrer|URL)\b|\buseSearchParams\(\)|\brouter\.query\b|\b(e|ev|evt|event|msg|message)\.data\b/,
+  php: /\$_(GET|POST|REQUEST|COOKIE|SERVER|FILES)\b|\$request->(input|get|query|post|all)\(|\bfile_get_contents\(\s*['"]php:\/\/input/,
+  py: /\brequest\.(args|form|values|json|data|files|cookies|headers|GET|POST|body|query_params|path_params)\b|\brequest\.get_json\(\)|\binput\(/,
+};
+
+const JS = [
+  {
+    id: 'js-eval',
+    title: 'Dynamic code execution with eval()',
+    sink: /(?<![\w.$])eval\s*\(/,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-95',
+    fix: 'Never eval strings. Use JSON.parse for data, or a lookup table of allowed operations.',
+  },
+  {
+    id: 'js-new-function',
+    title: 'Dynamic code execution with new Function()',
+    sink: /\bnew\s+Function\s*\(/,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-95',
+    fix: 'Avoid compiling code from strings; restructure to call known functions.',
+  },
+  {
+    id: 'js-command-injection',
+    title: 'Shell command built from variables',
+    requires: /child_process|execa|shelljs/,
+    // Bare exec(…) or child_process.exec(…) — not regex.exec(…).
+    sink: /(?:(?<![\w$.])|\b(?:child_process|childProcess|cp|shell)\.)(exec|execSync|execaCommand|execaCommandSync)\s*\(/,
+    when: 'dynamic',
+    sev: 7,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-78',
+    fix: 'Use execFile/spawn with an argument array (no shell), and validate inputs against an allow-list.',
+  },
+  {
+    id: 'js-spawn-injection',
+    title: 'Process spawned with user-controlled command or arguments',
+    requires: /child_process|execa/,
+    sink: /(?:(?<![\w$.])|\b(?:child_process|childProcess|cp)\.)(spawn|spawnSync|execFile|execFileSync|execa|execaSync|fork)\s*\(/,
+    when: 'tainted',
+    sev: 8.1,
+    category: 'rce',
+    cwe: 'CWE-78',
+    fix: 'Never let users pick the executable; allow-list argument values and keep shell: false.',
+  },
+  {
+    id: 'js-template-injection',
+    title: 'Server-side template compiled from user input',
+    sink: /(?:\b_\.template|\bejs\.render|\bpug\.(?:render|compile)|\bHandlebars\.compile|\bhandlebars\.compile|\bnunjucks\.renderString|\bvm\.(?:runIn\w*Context|Script))\s*\(/,
+    when: 'tainted',
+    sev: 9.3,
+    category: 'rce',
+    cwe: 'CWE-1336',
+    fix: 'Never compile templates from user input — compile fixed templates and pass user data as variables.',
+  },
+  {
+    id: 'js-sql-injection',
+    inStrings: true,
+    title: 'SQL query built with string interpolation',
+    sink: /\b(query|execute|raw|\$queryRawUnsafe|\$executeRawUnsafe|unsafe)\s*\(\s*(`[^`]*\$\{|['"][^'"]*['"]\s*\+|\w+\s*\+)/,
+    lineHint: /\b(select|insert|update|delete|where|from|order\s+by)\b/i,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'sqli',
+    cwe: 'CWE-89',
+    fix: 'Use parameterised queries (placeholders like $1 / ?) or the ORM\'s tagged-template API (Prisma $queryRaw`…`).',
+  },
+  {
+    id: 'js-nosql-injection',
+    inStrings: true,
+    title: 'Raw request object used as a MongoDB query',
+    sink: /\.(find|findOne|findOneAndUpdate|updateOne|updateMany|deleteOne|deleteMany|countDocuments)\s*\(\s*(req|request)\.(body|query)\b/,
+    when: 'always',
+    sev: 8.1,
+    category: 'sqli',
+    cwe: 'CWE-943',
+    fix: 'Pick and type-check the fields you expect (e.g. String(req.body.email)) so operators like {$ne: null} can\'t be injected.',
+  },
+  {
+    id: 'js-xss-dangerously-set-html',
+    title: 'Unsanitised HTML rendered with dangerouslySetInnerHTML',
+    sink: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:/,
+    exclude: /DOMPurify|sanitize|purify|xss\(|escape/i,
+    when: 'always',
+    sev: 6.1,
+    taintedSev: 8.2,
+    category: 'xss',
+    cwe: 'CWE-79',
+    fix: 'Sanitise first: __html: DOMPurify.sanitize(html) — or render as text/React elements instead.',
+  },
+  {
+    id: 'js-xss-inner-html',
+    inStrings: true,
+    title: 'HTML injected into the DOM',
+    sink: /\.(innerHTML|outerHTML)\s*\+?=(?!=)|\bdocument\.write(ln)?\s*\(|\.insertAdjacentHTML\s*\(/,
+    exclude: /DOMPurify|sanitize|=\s*['"`][^'"`$]*['"`]\s*;?\s*$/,
+    when: 'dynamic',
+    sev: 5.4,
+    taintedSev: 8.2,
+    category: 'xss',
+    cwe: 'CWE-79',
+    fix: 'Use textContent, or sanitise with DOMPurify before assigning HTML.',
+  },
+  {
+    id: 'js-ssrf',
+    title: 'Server-side request to a user-controlled URL',
+    sink: /\b(fetch|axios(?:\.(?:get|post|put|patch|delete|request|head))?|got(?:\.\w+)?|needle|superagent\.\w+|https?\.(?:get|request)|undici\.request)\s*\(/,
+    when: 'tainted',
+    sev: 8.6,
+    category: 'ssrf',
+    cwe: 'CWE-918',
+    fix: 'Validate the URL against an allow-list of hosts and block private/link-local IPs (169.254.169.254, 10.0.0.0/8, …).',
+  },
+  {
+    id: 'js-path-traversal',
+    title: 'File path built from user input',
+    sink: /\b(fs\.\w+|fsp\.\w+|readFile(Sync)?|writeFile(Sync)?|createReadStream|createWriteStream|unlink(Sync)?|res\.sendFile|res\.download|path\.(join|resolve))\s*\(/,
+    when: 'tainted',
+    sev: 8.1,
+    category: 'path',
+    cwe: 'CWE-22',
+    fix: 'Resolve the path, then check it starts with your base directory; reject "..", absolute paths and null bytes.',
+  },
+  {
+    id: 'js-open-redirect',
+    title: 'Redirect to a user-controlled URL',
+    sink: /\b(res\.redirect|redirect|NextResponse\.redirect|location\.assign|location\.replace)\s*\(|\b(window\.)?location(\.href)?\s*=(?!=)/,
+    when: 'tainted',
+    sev: 6.1,
+    category: 'redirect',
+    cwe: 'CWE-601',
+    fix: 'Only redirect to relative paths or an allow-list of hosts.',
+  },
+  {
+    id: 'js-regex-injection',
+    title: 'Regular expression built from user input (ReDoS)',
+    sink: /\bnew\s+RegExp\s*\(/,
+    when: 'tainted',
+    sev: 5.3,
+    category: 'dos',
+    cwe: 'CWE-1333',
+    fix: 'Escape user input before building a RegExp (e.g. lodash.escapeRegExp) or avoid dynamic patterns.',
+  },
+  {
+    id: 'js-prototype-pollution',
+    title: 'Deep merge of request data (prototype pollution)',
+    sink: /\b(_\.merge|_\.mergeWith|_\.defaultsDeep|_\.set|merge|deepmerge|deepMerge|extend)\s*\(/,
+    when: 'tainted',
+    sev: 7.3,
+    category: 'proto',
+    cwe: 'CWE-1321',
+    fix: 'Validate input with a schema (zod/joi) and strip __proto__/constructor keys before merging.',
+  },
+  {
+    id: 'js-mass-assignment',
+    title: 'Request body written straight to the database (mass assignment)',
+    sink: /\b(data\s*:\s*(req|request)\.body\b|\.(create|update|insert\w*|save|findByIdAndUpdate)\s*\(\s*(req|request)\.body\s*[,)])/,
+    when: 'always',
+    sev: 6.5,
+    category: 'auth',
+    cwe: 'CWE-915',
+    fix: 'Whitelist fields: build the object from the specific properties you allow users to set.',
+  },
+  {
+    id: 'js-tls-verification-disabled',
+    inStrings: true,
+    title: 'TLS certificate verification disabled',
+    sink: /rejectUnauthorized\s*:\s*false|NODE_TLS_REJECT_UNAUTHORIZED['"]?\]?\s*=\s*['"]?0|strictSSL\s*:\s*false/,
+    when: 'always',
+    sev: 7.4,
+    category: 'crypto',
+    cwe: 'CWE-295',
+    fix: 'Keep certificate verification on; trust a custom CA via the `ca` option if you need one.',
+  },
+  {
+    id: 'js-jwt-none-alg',
+    inStrings: true,
+    title: 'JWT verification accepts the "none" algorithm',
+    sink: /algorithms\s*:\s*\[[^\]]*['"]none['"]/i,
+    when: 'always',
+    sev: 9.1,
+    category: 'auth',
+    cwe: 'CWE-347',
+    fix: 'Pin algorithms to the one you sign with, e.g. { algorithms: ["HS256"] }.',
+  },
+  {
+    id: 'js-jwt-decode-auth',
+    title: 'JWT decoded without verifying its signature',
+    sink: /\bjwt\.decode\s*\(|\bjwtDecode\s*\(/,
+    when: 'always',
+    sev: 5.9,
+    category: 'auth',
+    cwe: 'CWE-347',
+    fix: 'Use jwt.verify() with your secret/public key before trusting any claim (decode is fine for display only).',
+  },
+  {
+    id: 'js-jwt-hardcoded-secret',
+    inStrings: true,
+    title: 'JWT signed/verified with a hard-coded secret',
+    sink: /\bjwt\.(sign|verify)\s*\(.*,\s*['"][^'"]{3,}['"]\s*[,)]/,
+    when: 'always',
+    sev: 8.1,
+    category: 'secret',
+    cwe: 'CWE-798',
+    fix: 'Load the secret from an environment variable / secret manager and rotate the leaked one.',
+  },
+  {
+    id: 'js-weak-hash',
+    inStrings: true,
+    title: 'Weak hash algorithm (MD5/SHA-1)',
+    sink: /createHash\s*\(\s*['"](md5|sha1)['"]/i,
+    when: 'always',
+    sev: 4.3,
+    category: 'crypto',
+    cwe: 'CWE-328',
+    fix: 'Use SHA-256+ for integrity, and bcrypt/scrypt/argon2 for passwords.',
+  },
+  {
+    id: 'js-insecure-random',
+    title: 'Math.random() used for a security value',
+    sink: /Math\.random\s*\(\)/,
+    lineHint: /token|secret|password|passwd|nonce|otp|salt|session|apikey|api_key|reset|verify|csrf/i,
+    when: 'always',
+    sev: 5.3,
+    category: 'crypto',
+    cwe: 'CWE-338',
+    fix: 'Use crypto.randomBytes / crypto.randomUUID / crypto.getRandomValues.',
+  },
+  {
+    id: 'js-cors-credentials-any-origin',
+    inStrings: true,
+    title: 'CORS reflects any origin with credentials',
+    requires: /credentials\s*:\s*true/,
+    sink: /\borigin\s*:\s*(true|['"]\*['"]|\(\s*\w*\s*,\s*\w+\s*\)\s*=>\s*\w+\(null,\s*true\))/,
+    when: 'always',
+    sev: 7.1,
+    category: 'leak',
+    cwe: 'CWE-942',
+    fix: 'List the exact origins allowed to make credentialed requests.',
+    context: 'server',
+  },
+  {
+    id: 'js-public-env-secret',
+    title: 'Secret-looking env var exposed to the browser bundle',
+    sink: /\b(NEXT_PUBLIC|VITE|REACT_APP|PUBLIC|NUXT_PUBLIC|EXPO_PUBLIC)_\w*(SECRET|PRIVATE|PASSWORD|PASSWD|SERVICE_ROLE|ACCESS_TOKEN|AUTH_TOKEN|API_SECRET|CLIENT_SECRET)\w*/,
+    when: 'always',
+    sev: 7.5,
+    category: 'secret',
+    cwe: 'CWE-200',
+    fix: 'Variables with this prefix are inlined into client JS. Drop the prefix and only read the value on the server.',
+    context: 'client',
+  },
+  {
+    id: 'js-postmessage-no-origin-check',
+    inStrings: true,
+    title: 'postMessage handler without origin check',
+    requires: /addEventListener\(\s*['"]message['"]/,
+    exclude: /\.origin/,
+    sink: /addEventListener\(\s*['"]message['"]/,
+    fileExclude: /\.origin\b/,
+    when: 'always',
+    sev: 5.4,
+    category: 'xss',
+    cwe: 'CWE-346',
+    fix: 'Check event.origin against the origins you expect before using event.data.',
+  },
+  {
+    id: 'js-cookie-no-httponly',
+    title: 'Cookie set without HttpOnly',
+    sink: /httpOnly\s*:\s*false/,
+    lineHint: /session|token|auth|sid|jwt/i,
+    when: 'always',
+    sev: 4.3,
+    category: 'leak',
+    cwe: 'CWE-1004',
+    fix: 'Set httpOnly: true (and secure, sameSite) on session/auth cookies.',
+  },
+  {
+    id: 'next-svg-images',
+    title: 'Next.js image optimizer allows SVG',
+    sink: /dangerouslyAllowSVG\s*:\s*true/,
+    when: 'always',
+    sev: 6.1,
+    category: 'xss',
+    cwe: 'CWE-79',
+    fix: 'Remove dangerouslyAllowSVG, or also set contentSecurityPolicy and contentDispositionType: "attachment".',
+    context: 'server',
+  },
+  {
+    id: 'next-wildcard-remote-images',
+    inStrings: true,
+    title: 'Next.js image optimizer proxies any remote host',
+    sink: /hostname\s*:\s*['"]\*\*?['"]/,
+    when: 'always',
+    sev: 5.3,
+    category: 'ssrf',
+    cwe: 'CWE-918',
+    fix: 'List the specific image hosts in images.remotePatterns.',
+    context: 'server',
+  },
+];
+
+const PHP = [
+  {
+    id: 'php-code-exec',
+    title: 'PHP code execution (eval/assert/create_function)',
+    sink: /\b(eval|assert|create_function)\s*\(/,
+    when: 'dynamic',
+    sev: 8,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-95',
+    fix: 'Remove eval; map inputs to known functions instead.',
+  },
+  {
+    id: 'php-command-injection',
+    inStrings: true,
+    title: 'Shell command built from variables',
+    sink: /\b(system|exec|shell_exec|passthru|popen|proc_open|pcntl_exec)\s*\(|`[^`]*\$[^`]*`/,
+    exclude: /escapeshellarg/,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-78',
+    fix: 'Wrap every argument in escapeshellarg(), or avoid the shell entirely.',
+  },
+  {
+    id: 'php-unserialize',
+    title: 'unserialize() on untrusted data (object injection)',
+    sink: /\bunserialize\s*\(/,
+    exclude: /allowed_classes\s*=>\s*false/,
+    when: 'dynamic',
+    sev: 7,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-502',
+    fix: 'Use json_decode, or pass ["allowed_classes" => false].',
+  },
+  {
+    id: 'php-file-inclusion',
+    title: 'include/require with a variable path (file inclusion)',
+    sink: /\b(include|include_once|require|require_once)\b\s*\(?[^;]*\$\w+/,
+    when: 'dynamic',
+    sev: 7,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-98',
+    fix: 'Map user choices to a fixed list of files; never include paths built from input.',
+  },
+  {
+    id: 'php-sql-injection',
+    title: 'SQL query built with variables',
+    sink: /\b(mysqli_query|mysql_query|pg_query|->query|->exec|->prepare|DB::(select|statement|raw|unprepared)|->whereRaw|->selectRaw|->orderByRaw)\s*\(/,
+    lineHint: /\$\w+|\.\s*\$|\{\$/,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'sqli',
+    cwe: 'CWE-89',
+    fix: 'Use prepared statements with bound parameters (PDO::prepare + execute([...])).',
+  },
+  {
+    id: 'php-xss-echo',
+    title: 'Request data echoed without escaping',
+    sink: /\b(echo|print)\b[^;]*\$_(GET|POST|REQUEST|COOKIE)/,
+    exclude: /htmlspecialchars|htmlentities|e\(|esc_html|esc_attr|intval|\(int\)/,
+    when: 'always',
+    sev: 6.1,
+    taintedSev: 8.2,
+    category: 'xss',
+    cwe: 'CWE-79',
+    fix: 'Escape output with htmlspecialchars($v, ENT_QUOTES, "UTF-8").',
+  },
+  {
+    id: 'php-path-traversal',
+    title: 'File access with a user-controlled path',
+    sink: /\b(file_get_contents|fopen|readfile|file|unlink|file_put_contents|move_uploaded_file)\s*\(/,
+    exclude: /\[\s*['"]tmp_name['"]\s*\]|is_uploaded_file/, // PHP chooses tmp_name, not the user
+    when: 'tainted',
+    sev: 8.1,
+    category: 'path',
+    cwe: 'CWE-22',
+    fix: 'Use basename() / realpath() and verify the result is inside the allowed directory.',
+  },
+  {
+    id: 'php-ssrf',
+    title: 'Request to a user-controlled URL',
+    sink: /\b(curl_init|curl_setopt|file_get_contents|fopen)\s*\(/,
+    lineHint: /CURLOPT_URL|https?:|\$url|\$_(GET|POST|REQUEST)/i,
+    exclude: /\[\s*['"]tmp_name['"]\s*\]|is_uploaded_file/, // PHP chooses tmp_name, not the user
+    when: 'tainted',
+    sev: 8.6,
+    category: 'ssrf',
+    cwe: 'CWE-918',
+    fix: 'Allow-list hosts and block internal IP ranges before fetching.',
+  },
+  {
+    id: 'php-weak-hash-password',
+    title: 'Password hashed with MD5/SHA-1',
+    sink: /\b(md5|sha1)\s*\(/,
+    lineHint: /pass|pwd/i,
+    when: 'always',
+    sev: 7.5,
+    category: 'crypto',
+    cwe: 'CWE-916',
+    fix: 'Use password_hash() / password_verify().',
+  },
+  {
+    id: 'php-extract-input',
+    title: 'extract() on request data (variable overwrite)',
+    sink: /\b(extract|parse_str)\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)/,
+    when: 'always',
+    sev: 8.1,
+    category: 'auth',
+    cwe: 'CWE-621',
+    fix: 'Read the specific keys you need instead of extracting the whole array.',
+  },
+];
+
+const PY = [
+  {
+    id: 'py-code-exec',
+    title: 'Dynamic code execution (eval/exec)',
+    sink: /(?<![\w.])(eval|exec)\s*\(/,
+    exclude: /literal_eval/,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-95',
+    fix: 'Use ast.literal_eval for data, or a dispatch dict of allowed operations.',
+  },
+  {
+    id: 'py-command-injection',
+    title: 'Shell command built from variables',
+    sink: /\b(os\.system|os\.popen|subprocess\.\w+\([^)]*shell\s*=\s*True|commands\.getoutput)\s*\(?/,
+    when: 'dynamic',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-78',
+    fix: 'Call subprocess.run([...args]) without shell=True; use shlex.quote if a shell is unavoidable.',
+  },
+  {
+    id: 'py-unsafe-deserialization',
+    title: 'Unsafe deserialization (pickle / yaml.load / marshal)',
+    sink: /\b(pickle|cPickle|dill|marshal|shelve)\.loads?\s*\(|\byaml\.(load|load_all)\s*\((?![^)]*SafeLoader)/,
+    when: 'always',
+    sev: 7,
+    taintedSev: 9.8,
+    category: 'rce',
+    cwe: 'CWE-502',
+    fix: 'Use json, or yaml.safe_load; never unpickle data from users.',
+  },
+  {
+    id: 'py-sql-injection',
+    inStrings: true,
+    title: 'SQL query built with string formatting',
+    sink: /\.(execute|executemany|raw|extra)\s*\(\s*(f['"]|['"][^'"]*['"]\s*(%|\.format|\+))/,
+    when: 'always',
+    sev: 7.5,
+    taintedSev: 9.8,
+    category: 'sqli',
+    cwe: 'CWE-89',
+    fix: 'Pass parameters separately: cursor.execute("… WHERE id = %s", (user_id,)).',
+  },
+  {
+    id: 'py-ssti',
+    title: 'Template rendered from a user-controlled string (SSTI)',
+    sink: /\b(render_template_string|Template)\s*\(/,
+    when: 'tainted',
+    sev: 9.3,
+    category: 'rce',
+    cwe: 'CWE-1336',
+    fix: 'Render fixed templates and pass user values as context variables.',
+  },
+  {
+    id: 'py-ssrf',
+    title: 'Request to a user-controlled URL',
+    sink: /\b(requests|httpx|urllib\.request|urllib3)\.\w+\s*\(|\burlopen\s*\(/,
+    when: 'tainted',
+    sev: 8.6,
+    category: 'ssrf',
+    cwe: 'CWE-918',
+    fix: 'Allow-list hosts and block internal IP ranges before fetching.',
+  },
+  {
+    id: 'py-path-traversal',
+    title: 'File opened with a user-controlled path',
+    sink: /\b(open|send_file|send_from_directory|os\.remove|shutil\.\w+)\s*\(/,
+    when: 'tainted',
+    sev: 8.1,
+    category: 'path',
+    cwe: 'CWE-22',
+    fix: 'Use werkzeug.utils.secure_filename and confirm the resolved path stays inside the base directory.',
+  },
+  {
+    id: 'py-debug-enabled',
+    title: 'Debug mode enabled',
+    sink: /\bDEBUG\s*=\s*True\b|\.run\([^)]*debug\s*=\s*True/,
+    when: 'always',
+    sev: 7.5,
+    category: 'rce',
+    cwe: 'CWE-489',
+    fix: 'Read DEBUG from the environment and keep it off in production (the Werkzeug debugger allows code execution).',
+    context: 'server',
+  },
+  {
+    id: 'py-tls-verification-disabled',
+    title: 'TLS certificate verification disabled',
+    sink: /verify\s*=\s*False/,
+    when: 'always',
+    sev: 7.4,
+    category: 'crypto',
+    cwe: 'CWE-295',
+    fix: 'Keep verify=True; point it at a CA bundle if you need a custom CA.',
+  },
+];
+
+export const RULES = { js: JS, php: PHP, py: PY };
+
+export function langOf(file) {
+  if (/\.php$/.test(file)) return 'php';
+  if (/\.py$/.test(file)) return 'py';
+  if (/\.([cm]?[jt]sx?|vue|svelte|astro)$/.test(file)) return 'js';
+  return null;
+}

package/src/code/secrets.js

@@ -0,0 +1,123 @@
+import { spawnSync } from 'node:child_process';
+import { levelFromScore } from '../deps/cvss.js';
+
+const PATTERNS = [
+  { id: 'aws-access-key', title: 'AWS access key ID', re: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/, sev: 9 },
+  { id: 'aws-secret-key', title: 'AWS secret access key', re: /aws_?secret_?access_?key['"]?\s*[:=]\s*['"]?([A-Za-z0-9/+=]{40})\b/i, sev: 9.5 },
+  { id: 'github-token', title: 'GitHub token', re: /\b(gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,})\b/, sev: 9 },
+  { id: 'gitlab-token', title: 'GitLab personal access token', re: /\bglpat-[A-Za-z0-9_-]{20,}\b/, sev: 9 },
+  { id: 'npm-token', title: 'npm access token (can publish packages!)', re: /\bnpm_[A-Za-z0-9]{36}\b/, sev: 9.5 },
+  { id: 'slack-token', title: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, sev: 8 },
+  { id: 'slack-webhook', title: 'Slack webhook URL', re: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/, sev: 6.5 },
+  { id: 'stripe-secret', title: 'Stripe live secret key', re: /\b(sk|rk)_live_[A-Za-z0-9]{20,}\b/, sev: 9.5 },
+  { id: 'openai-key', title: 'OpenAI API key', re: /\bsk-(proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b|\bsk-(proj|svcacct|admin)-[A-Za-z0-9_-]{40,}\b/, sev: 8.5 },
+  { id: 'anthropic-key', title: 'Anthropic API key', re: /\bsk-ant-(api|admin)\d{2}-[A-Za-z0-9_-]{60,}\b/, sev: 8.5 },
+  { id: 'google-api-key', title: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/, sev: 5.5 },
+  { id: 'sendgrid-key', title: 'SendGrid API key', re: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/, sev: 8 },
+  { id: 'twilio-key', title: 'Twilio API key', re: /\bSK[0-9a-f]{32}\b/, sev: 7 },
+  { id: 'private-key', title: 'Private key', re: /-----BEGIN (RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY( BLOCK)?-----/, sev: 9 },
+  { id: 'db-url-password', title: 'Database URL with password', re: /\b(postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss|amqps?):\/\/[^:\s'"/@]+:([^@\s'"]{3,})@[^\s'"]+/, sev: 8, group: 2 },
+  { id: 'jwt-literal', title: 'Hard-coded JWT', re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/, sev: 5 },
+];
+
+const GENERIC =
+  /\b([A-Za-z0-9_]*(?:secret|password|passwd|pwd|api[_-]?key|apikey|access[_-]?token|auth[_-]?token|private[_-]?key|client[_-]?secret)[A-Za-z0-9_]*)['"]?\s*[:=]\s*['"]([^'"\s]{8,})['"]/i;
+
+const PLACEHOLDER =
+  /^(\$\{|<|\{\{|%|process\.env|env\(|xxx|\*{3}|changeme|change_me|your[_-]|example|sample|dummy|placeholder|password|secret|test|todo|null|undefined|none|redacted|replace)|(xxx|\.\.\.|example|your_|_here|placeholder)$/i;
+
+function entropy(s) {
+  const freq = {};
+  for (const ch of s) freq[ch] = (freq[ch] ?? 0) + 1;
+  return -Object.values(freq).reduce((h, n) => h + (n / s.length) * Math.log2(n / s.length), 0);
+}
+
+const mask = (s) => (s.length <= 8 ? '****' : `${s.slice(0, 4)}…${s.slice(-2)} (${s.length} chars)`);
+
+function trackedFiles(root) {
+  const r = spawnSync('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8' });
+  if (r.status !== 0) return null;
+  return new Set(r.stdout.split('\0').filter(Boolean));
+}
+
+function gitIgnored(root, files) {
+  if (!files.length) return new Set();
+  const r = spawnSync('git', ['check-ignore', '--stdin'], { cwd: root, input: files.join('\n'), encoding: 'utf8' });
+  return new Set((r.stdout ?? '').split('\n').filter(Boolean));
+}
+
+/**
+ * Hard-coded credentials in source/config, and .env files that are (or could easily be) committed.
+ * @param {{files:any[], texts:Map<string,string>, contexts:Map<string,string>}} src
+ * @param {string} root
+ */
+export function scanSecrets(src, root) {
+  const findings = [];
+  const tracked = trackedFiles(root);
+  const envFiles = src.files.filter((f) => f.kind === 'env').map((f) => f.rel);
+  const ignored = tracked ? gitIgnored(root, envFiles) : new Set();
+
+  for (const f of src.files) {
+    const text = src.texts.get(f.rel);
+    if (!text || /(^|\/)(test|tests|__tests__|fixtures?|__mocks__)\//.test(f.rel) && f.kind !== 'env') continue;
+    const context = src.contexts.get(f.rel) ?? (f.kind === 'env' ? 'server' : 'build');
+
+    let envState = null;
+    if (f.kind === 'env') {
+      if (tracked?.has(f.rel)) envState = 'committed';
+      else if (tracked && !ignored.has(f.rel)) envState = 'not-ignored';
+      else continue; // gitignored local .env (or not a git repo) is the expected setup
+    }
+
+    const lines = text.split('\n');
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (line.length > 500) continue;
+      let hit = null;
+      for (const p of PATTERNS) {
+        const m = p.re.exec(line);
+        if (m) {
+          hit = { id: p.id, title: p.title, sev: p.sev, value: m[p.group ?? 0] };
+          break;
+        }
+      }
+      if (!hit) {
+        const m = GENERIC.exec(line) ?? (f.kind === 'env' ? /^\s*([A-Z0-9_]*(?:SECRET|PASSWORD|PASSWD|TOKEN|API_KEY|PRIVATE_KEY|CLIENT_SECRET)[A-Z0-9_]*)\s*=\s*['"]?([^'"\s#]{8,})/i.exec(line) : null);
+        if (m && !PLACEHOLDER.test(m[2]) && entropy(m[2]) >= 3 && !/^[a-z]+([._-][a-z]+)*$/i.test(m[2])) {
+          hit = { id: 'generic-secret', title: `Hard-coded secret in "${m[1]}"`, sev: 6.5, value: m[2] };
+        }
+      }
+      if (!hit || PLACEHOLDER.test(hit.value) || seen.has(hit.value)) continue;
+      seen.add(hit.value);
+
+      let sev = hit.sev;
+      let title = hit.title;
+      if (envState === 'committed') {
+        sev = Math.max(sev, 8);
+        title = `${hit.title} in committed ${f.rel}`;
+      } else if (envState === 'not-ignored') {
+        sev = Math.min(sev, 6);
+        title = `${hit.title} in ${f.rel}, which is not gitignored`;
+      }
+      findings.push({
+        id: `secret:${hit.id}:${f.rel}:${i + 1}`,
+        kind: 'secret',
+        title,
+        ruleId: `secret-${hit.id}`,
+        category: 'secret',
+        cwe: 'CWE-798',
+        severityScore: sev,
+        severity: levelFromScore(sev),
+        confidence: hit.id === 'generic-secret' ? 'medium' : 'high',
+        context,
+        location: { file: f.rel, line: i + 1, snippet: line.replace(hit.value, mask(hit.value)).trim().slice(0, 200) },
+        fix:
+          envState === 'not-ignored'
+            ? `Add ${f.rel} to .gitignore before it gets committed.`
+            : `Rotate this credential now (assume it is compromised), move it to an env var / secret manager${envState === 'committed' ? `, untrack the file (git rm --cached ${f.rel}) and purge it from history` : ''}.`,
+      });
+    }
+  }
+  return findings;
+}