oauthlint-rules 0.1.0 → 0.2.0

package/rules/py/flow/insecure-random-token.yml

@@ -0,0 +1,51 @@
+rules:
+  - id: auth.py.flow.insecure-random-token
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A security-sensitive value (token, secret, password, OTP, nonce, API key,
+      reset/verification code) is being generated with the `random` module.
+      `random` is a pseudo-random number generator seeded from predictable state
+      and is NOT cryptographically secure — its output can be predicted or
+      reproduced by an attacker, defeating the secret entirely.
+
+      Use the `secrets` module or `os.urandom` instead:
+      `secrets.token_urlsafe(32)`, `secrets.token_hex(16)`,
+      `secrets.choice(alphabet)`, or `os.urandom(32)`. These draw from the
+      operating system's CSPRNG.
+    # Anchored on the NAME of the assigned target (must look like a secret) plus
+    # a value coming from `random.`. This avoids flagging `random.random()` used
+    # for jitter/sampling/colors, and never matches `secrets....` or `os.urandom`.
+    patterns:
+      - pattern-either:
+          - pattern: $VAR = random.random()
+          - pattern: $VAR = random.randint(...)
+          - pattern: $VAR = random.randrange(...)
+          - pattern: $VAR = random.choice(...)
+          - pattern: $VAR = random.choices(...)
+          - pattern: $VAR = random.sample(...)
+          - pattern: $VAR = random.getrandbits(...)
+          - patterns:
+              - pattern: $VAR = "".join($X)
+              - metavariable-pattern:
+                  metavariable: $X
+                  patterns:
+                    - pattern-either:
+                        - pattern: random.choice(...)
+                        - pattern: random.choices(...)
+      - metavariable-regex:
+          metavariable: $VAR
+          regex: (?i).*(token|secret|password|passwd|otp|nonce|api_?key|reset|verification).*
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-insecure-random-token
+      category: security
+      cwe: CWE-330
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - random
+      references:
+        - https://docs.python.org/3/library/secrets.html
+        - https://cwe.mitre.org/data/definitions/330.html

package/rules/py/flow/requests-verify-disabled.yml

@@ -0,0 +1,50 @@
+rules:
+  - id: auth.py.flow.requests-verify-disabled
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A `requests` call disables TLS certificate verification with
+      `verify=False`. This silences the validation of the server's
+      certificate, so an attacker who can intercept the connection can
+      present any certificate and read or tamper with the traffic — a
+      classic man-in-the-middle exposure. For OAuth/OIDC this leaks
+      authorization codes, access tokens and client secrets.
+
+      Never set `verify=False`. Leave verification on (the default) so the
+      system CA bundle is used. In development against a private CA, point
+      `verify` at the CA bundle instead, e.g.
+      `requests.get(url, verify="/path/to/ca-bundle.pem")` or set the
+      `REQUESTS_CA_BUNDLE` env var (certifi).
+    # Scoped to `requests.<method>(...)`, `requests.request(...)` and Session
+    # objects (`$SESSION.<method>(...)`). Fires only on the literal
+    # `verify=False`; `verify=True` and `verify="/path/ca.pem"` are not flagged.
+    pattern-either:
+      - pattern: requests.get(..., verify=False, ...)
+      - pattern: requests.post(..., verify=False, ...)
+      - pattern: requests.put(..., verify=False, ...)
+      - pattern: requests.delete(..., verify=False, ...)
+      - pattern: requests.patch(..., verify=False, ...)
+      - pattern: requests.head(..., verify=False, ...)
+      - pattern: requests.options(..., verify=False, ...)
+      - pattern: requests.request(..., verify=False, ...)
+      - pattern: $SESSION.get(..., verify=False, ...)
+      - pattern: $SESSION.post(..., verify=False, ...)
+      - pattern: $SESSION.put(..., verify=False, ...)
+      - pattern: $SESSION.delete(..., verify=False, ...)
+      - pattern: $SESSION.patch(..., verify=False, ...)
+      - pattern: $SESSION.head(..., verify=False, ...)
+      - pattern: $SESSION.options(..., verify=False, ...)
+      - pattern: $SESSION.request(..., verify=False, ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-requests-verify-disabled
+      category: security
+      cwe: CWE-295
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - requests
+      references:
+        - https://requests.readthedocs.io/en/latest/user/advanced/#ssl-cert-verification
+        - https://cwe.mitre.org/data/definitions/295.html

package/rules/py/flow/weak-password-hash.yml

@@ -0,0 +1,64 @@
+rules:
+  - id: auth.py.flow.weak-password-hash
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A password is being hashed with a fast, general-purpose digest from
+      `hashlib` (MD5, SHA-1, SHA-256, SHA-512). These algorithms are designed
+      to be fast, which makes offline brute-force and rainbow-table attacks
+      cheap — they are NOT suitable for storing passwords.
+
+      Use a dedicated, slow password-hashing function with a per-password salt
+      and a tunable work factor: `bcrypt` (`bcrypt.hashpw`), `argon2`
+      (`argon2.PasswordHasher().hash`), `scrypt`, or a wrapper such as
+      `passlib`. These resist brute-force by design.
+    # Scoped to hashlib digests whose input is named like a password
+    # (metavariable-regex on the argument). `password.encode()` is handled
+    # because the base name `password` still matches. Checksums, file digests
+    # (`hashlib.sha256(file_bytes)`), `hmac.new(...)`, and real password
+    # hashers (bcrypt/argon2/passlib) are NOT matched.
+    pattern-either:
+      - patterns:
+          - pattern-either:
+              - pattern: hashlib.md5($PW)
+              - pattern: hashlib.sha1($PW)
+              - pattern: hashlib.sha256($PW)
+              - pattern: hashlib.sha512($PW)
+          - metavariable-regex:
+              metavariable: $PW
+              regex: (?i)^.*(password|passwd|pwd).*$
+      - patterns:
+          - pattern-either:
+              - pattern: |
+                  $H = hashlib.md5(...)
+                  ...
+                  $H.update($PW)
+              - pattern: |
+                  $H = hashlib.sha1(...)
+                  ...
+                  $H.update($PW)
+              - pattern: |
+                  $H = hashlib.sha256(...)
+                  ...
+                  $H.update($PW)
+              - pattern: |
+                  $H = hashlib.sha512(...)
+                  ...
+                  $H.update($PW)
+          - metavariable-regex:
+              metavariable: $PW
+              regex: (?i)^.*(password|passwd|pwd).*$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLOW-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-weak-password-hash
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - hashlib
+      references:
+        - https://cwe.mitre.org/data/definitions/916.html
+        - https://argon2-cffi.readthedocs.io/en/stable/
+        - https://passlib.readthedocs.io/en/stable/

package/rules/py/jwt/alg-none.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.py.jwt.alg-none
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A JWT is decoded or signed with the `none` algorithm. The `none`
+      algorithm means the token is NOT cryptographically signed, so any
+      attacker can forge a token with arbitrary claims and have it accepted —
+      a complete authentication bypass (CVE-class JWT alg=none vulnerability).
+
+      Never allow `none`. Pin a strong signing algorithm explicitly:
+      `jwt.decode(token, key, algorithms=["RS256"])` for verification, or
+      `jwt.encode(claims, key, algorithm="RS256")` (also ES256 / HS256) when
+      issuing tokens. Never include `"none"` in the `algorithms` allowlist.
+    # Scoped to PyJWT's `jwt.decode(...)` / `jwt.encode(...)`. Uses a
+    # case-insensitive metavariable-regex so "none", "None", and "NONE" all
+    # match, while strong algs like RS256/ES256/HS256 are left untouched.
+    pattern-either:
+      - patterns:
+          - pattern: jwt.decode(..., algorithms=$ALGS, ...)
+          - metavariable-regex:
+              metavariable: $ALGS
+              regex: (?i).*['"]none['"].*
+      - patterns:
+          - pattern: jwt.encode(..., algorithm=$ALG, ...)
+          - metavariable-regex:
+              metavariable: $ALG
+              regex: (?i)^['"]none['"]$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-alg-none
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - pyjwt
+      references:
+        - https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/py/jwt/hardcoded-secret.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.py.jwt.hardcoded-secret
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A JWT signing/verification key is hardcoded as a string literal in the
+      call to PyJWT. Anyone who can read the source or git history can forge or
+      tamper with tokens, which is a complete authentication bypass.
+
+      Load the secret from the environment or a secret manager instead, e.g.
+      `key = os.environ["JWT_SECRET"]` and `jwt.encode(payload, key, ...)`.
+      Never commit signing keys to source control.
+    # Scoped to PyJWT's `jwt.encode(...)` / `jwt.decode(...)`. The key argument
+    # is the second positional argument; we only flag it when it is a string
+    # literal (metavariable-regex requires it to start/end with a quote), so
+    # `os.environ[...]`, `settings.SECRET_KEY`, and plain variables are ignored.
+    pattern-either:
+      - patterns:
+          - pattern: jwt.encode($PAYLOAD, $KEY, ...)
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: ^["'].*["']$
+      - patterns:
+          - pattern: jwt.decode($TOKEN, $KEY, ...)
+          - metavariable-regex:
+              metavariable: $KEY
+              regex: ^["'].*["']$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-hardcoded-secret
+      category: security
+      cwe: CWE-798
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - pyjwt
+      references:
+        - https://pyjwt.readthedocs.io/en/stable/api.html#jwt.encode
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/py/jwt/no-algorithms.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.py.jwt.no-algorithms
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      A JWT is decoded with a verification key but WITHOUT an explicit
+      `algorithms` allowlist. Without pinning the accepted algorithms, PyJWT
+      may accept a token signed with an unexpected algorithm, enabling
+      algorithm-confusion attacks (e.g. an RS256 verifier tricked into
+      treating an attacker-supplied HS256 token as valid by using the public
+      key as an HMAC secret).
+
+      Always pass an explicit allowlist: `jwt.decode(token, key,
+      algorithms=["RS256"])` (or the exact algorithm you expect). List only the
+      algorithms your application actually uses.
+    # Scoped to PyJWT's `jwt.decode(token, key, ...)` with a verification key
+    # and NO `algorithms=` kwarg. The `verify_signature: False` /
+    # `verify=False` cases are intentionally excluded here — those are reported
+    # by auth.py.jwt.no-verify, so we avoid a duplicate finding.
+    #
+    # The `import jwt` guard pins this to PyJWT. Other libraries expose a
+    # `jwt.decode(token, key)` that DOES verify and takes no `algorithms`
+    # kwarg — notably joserfc (`from joserfc import jwt`), used by Authlib.
+    # Requiring the bare `import jwt` excludes those (real-world FP on Authlib).
+    patterns:
+      - pattern: jwt.decode($T, $K, ...)
+      - pattern-not: jwt.decode($T, $K, ..., algorithms=$A, ...)
+      - pattern-not: jwt.decode($T, ..., verify=False, ...)
+      - pattern-not: jwt.decode($T, ..., options=$OPTS, ...)
+      - pattern-inside: |
+          import jwt
+          ...
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-004
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-no-algorithms
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - pyjwt
+      references:
+        - https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/py/jwt/no-verify.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.py.jwt.no-verify
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A JWT is decoded with signature verification disabled. PyJWT's
+      `jwt.decode(token, verify=False)` (legacy) or
+      `options={"verify_signature": False}` parses the token WITHOUT checking
+      the signature, so any attacker-forged token is accepted — a complete
+      authentication bypass.
+
+      Always verify: `jwt.decode(token, key, algorithms=["RS256"])`. If you
+      only need to read an unverified header (e.g. the `kid` before fetching
+      the key), use `jwt.get_unverified_header(token)` and treat the claims
+      as untrusted.
+    # Scoped to PyJWT's `jwt.decode(...)`. Matches both the legacy
+    # `verify=False` keyword and the modern `options={"verify_signature": False}`.
+    pattern-either:
+      - pattern: jwt.decode(..., verify=False, ...)
+      - patterns:
+          - pattern: jwt.decode(..., options=$OPTS, ...)
+          - metavariable-pattern:
+              metavariable: $OPTS
+              pattern: '{..., "verify_signature": False, ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-no-verify
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: HIGH
+      technology:
+        - pyjwt
+      references:
+        - https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/py/secret/django-hardcoded-key.yml

@@ -0,0 +1,32 @@
+rules:
+  - id: auth.py.secret.django-hardcoded-key
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      The Django `SECRET_KEY` is set to a hard-coded string literal in
+      settings. This is typically the auto-generated `django-insecure-...`
+      value committed by mistake. `SECRET_KEY` signs sessions, CSRF tokens
+      and password-reset tokens — anyone who reads the source or a leaked
+      repo can forge them and bypass authentication entirely (CWE-798).
+
+      Load it from the environment or a secret manager instead, e.g.
+      `SECRET_KEY = os.environ["SECRET_KEY"]`, `django-environ`
+      (`env("SECRET_KEY")`), or `config("SECRET_KEY")`. Generate the value
+      with a CSPRNG and never commit it.
+    # Scoped to a module-level `SECRET_KEY = "<literal>"` assignment. The
+    # `"..."` pattern matches ONLY a string-literal value, so secrets loaded
+    # from os.environ / env() / config() / a variable are NOT flagged.
+    pattern: SECRET_KEY = "..."
+    metadata:
+      oauthlint-rule-id: AUTH-PY-SECRET-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-secret-django-hardcoded-key
+      category: security
+      cwe: CWE-798
+      owasp: A07:2021
+      llm-prevalence: HIGH
+      technology:
+        - django
+      references:
+        - https://docs.djangoproject.com/en/stable/ref/settings/#secret-key
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/py/secret/flask-hardcoded-key.yml

@@ -0,0 +1,33 @@
+rules:
+  - id: auth.py.secret.flask-hardcoded-key
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      The Flask `SECRET_KEY` (used to sign session cookies and CSRF tokens) is
+      set to a hard-coded string literal. Anyone who reads the source — or a
+      leaked repo — can forge session cookies and impersonate any user, a
+      complete authentication bypass (CWE-798).
+
+      Load the secret from the environment or a secret manager instead, e.g.
+      `app.secret_key = os.environ["SECRET_KEY"]`, and generate it with a CSPRNG
+      such as `secrets.token_hex(32)` / `os.urandom(32)`. Never commit the value.
+    # Scoped to Flask's secret-key assignment. `$APP` matches any app variable
+    # name. The `"..."` pattern matches ONLY a string-literal value, so secrets
+    # loaded from os.environ / config refs / os.urandom() are NOT flagged.
+    pattern-either:
+      - pattern: $APP.secret_key = "..."
+      - pattern: $APP.config["SECRET_KEY"] = "..."
+      - pattern: $APP.config.update(..., SECRET_KEY="...", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-SECRET-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-secret-flask-hardcoded-key
+      category: security
+      cwe: CWE-798
+      owasp: A07:2021
+      llm-prevalence: HIGH
+      technology:
+        - flask
+      references:
+        - https://flask.palletsprojects.com/en/stable/config/#SECRET_KEY
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/rust/cookie/insecure.yml

@@ -0,0 +1,35 @@
+rules:
+  - id: auth.rust.cookie.insecure
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      A session/auth cookie is built with a security attribute explicitly
+      disabled (`secure(false)` or `http_only(false)`). With `secure(false)`
+      the cookie is sent over plain HTTP, so a network attacker can read the
+      session token. With `http_only(false)` the cookie is readable from
+      JavaScript, so any XSS can steal it. For OAuth/OIDC this exposes session
+      and token cookies to theft and hijacking.
+
+      Set `secure(true)` and `http_only(true)` on auth cookies, and add an
+      appropriate `SameSite` mode (for example
+      `same_site(SameSite::Lax)`).
+    # Matches only the literal `false`. `secure(true)`, `http_only(true)`, and
+    # the absence of the call are not flagged. `$C` is any cookie builder
+    # expression (for example `Cookie::build(...)`).
+    patterns:
+      - pattern-either:
+          - pattern: $C.secure(false)
+          - pattern: $C.http_only(false)
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-COOKIE-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: HIGH
+      technology:
+        - cookie
+      references:
+        - https://docs.rs/cookie/latest/cookie/struct.CookieBuilder.html
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/rust/cors/permissive.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.rust.cors.permissive
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      A wide-open CORS policy is configured. `Cors::permissive()` (actix-web),
+      `CorsLayer::permissive()` / `CorsLayer::very_permissive()` (tower-http),
+      and `CorsLayer::new().allow_origin(Any)` all allow requests from any
+      origin. Combined with credentialed requests this lets any website read
+      authenticated responses — including OAuth/OIDC tokens, session data, and
+      user info exposed by your API.
+
+      Restrict CORS to an explicit allowlist of trusted origins instead, e.g.
+      `allow_origin("https://app.example.com".parse().unwrap())` or
+      `allow_origin(["https://app.example.com".parse().unwrap()])`.
+    # Targets only the fully-open helpers and `allow_origin(Any)`. An explicit
+    # origin or a list of origins is not flagged.
+    patterns:
+      - pattern-either:
+          - pattern: Cors::permissive()
+          - pattern: CorsLayer::permissive()
+          - pattern: CorsLayer::very_permissive()
+          - pattern: $B.allow_origin(Any)
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-CORS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-cors-permissive
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - actix-web
+        - tower-http
+      references:
+        - https://docs.rs/actix-cors/latest/actix_cors/struct.Cors.html#method.permissive
+        - https://docs.rs/tower-http/latest/tower_http/cors/struct.CorsLayer.html
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/rust/crypto/bcrypt-low-cost.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.rust.crypto.bcrypt-low-cost
+    languages:
+      - rust
+    severity: WARNING
+    message: |
+      `bcrypt::hash` (or `bcrypt::hash_with_result`) is called with a cost
+      factor below 10. A low work factor makes each hash cheap to compute,
+      which lets an attacker brute-force stolen password hashes far too
+      quickly. OWASP recommends a bcrypt cost of at least 10, and ≥ 12 for new
+      applications, tuned so a single hash takes roughly 250ms on your
+      hardware.
+
+      Common LLM-generated mistake: `bcrypt::hash(password, 8)` because the
+      literal "looks fast enough". Use `bcrypt::DEFAULT_COST` (12) or raise the
+      cost factor to 12 or higher.
+    # Matches only a numeric literal cost < 10 passed to `bcrypt::hash` /
+    # `bcrypt::hash_with_result`. `metavariable-comparison` constrains $N to
+    # numeric literals only, so `bcrypt::DEFAULT_COST`, a cost ≥ 10, or a
+    # variable (`bcrypt::hash(password, cost)`) are NOT flagged.
+    patterns:
+      - pattern-either:
+          - pattern: bcrypt::hash($PW, $N)
+          - pattern: bcrypt::hash_with_result($PW, $N)
+      - metavariable-comparison:
+          metavariable: $N
+          comparison: $N < 10
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-CRYPTO-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-crypto-bcrypt-low-cost
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - bcrypt
+      references:
+        - https://docs.rs/bcrypt/latest/bcrypt/fn.hash.html
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/916.html

package/rules/rust/crypto/weak-cipher.yml

@@ -0,0 +1,41 @@
+rules:
+  - id: auth.rust.crypto.weak-cipher
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      A broken or deprecated cipher from the RustCrypto ecosystem is used to
+      protect data. DES (`Des::new`, crate `des`) and 3DES (`TdesEde3::new` /
+      `TdesEde2::new`) have a 64-bit block and are considered insecure
+      (Sweet32, brute-force), while RC4 (`Rc4::new`, crate `rc4`) has
+      well-known keystream biases and is forbidden by RFC 7465. For OAuth/OIDC
+      this means tokens, client secrets, and other sensitive material are not
+      adequately protected and may be recovered by an attacker.
+
+      Use an authenticated AEAD cipher instead: AES-GCM via the `aes-gcm`
+      crate (`Aes256Gcm::new(key)`) or ChaCha20-Poly1305
+      (`ChaCha20Poly1305::new(key)`), both of which provide confidentiality
+      and integrity.
+    # Flags only the broken ciphers DES, 3DES, and RC4. Modern AEAD
+    # constructors such as `Aes256Gcm::new`, `Aes128::new`, and
+    # `ChaCha20Poly1305::new` are intentionally not matched.
+    patterns:
+      - pattern-either:
+          - pattern: Des::new(...)
+          - pattern: TdesEde3::new(...)
+          - pattern: TdesEde2::new(...)
+          - pattern: Rc4::new(...)
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-CRYPTO-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-crypto-weak-cipher
+      category: security
+      cwe: CWE-327
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - des
+        - rc4
+      references:
+        - https://cwe.mitre.org/data/definitions/327.html
+        - https://docs.rs/aes-gcm/latest/aes_gcm/
+        - https://datatracker.ietf.org/doc/html/rfc7465

package/rules/rust/crypto/weak-password-hash.yml

@@ -0,0 +1,46 @@
+rules:
+  - id: auth.rust.crypto.weak-password-hash
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      A password is being hashed with a fast, general-purpose digest (MD5 via
+      the `md5` crate, or SHA-1/SHA-256/SHA-512 via the RustCrypto `sha1`/`sha2`
+      crates). These algorithms are designed to be fast, which makes offline
+      brute-force and rainbow-table attacks cheap — they are NOT suitable for
+      storing passwords (CWE-916).
+
+      Use a dedicated, slow password-hashing function with a per-password salt
+      and a tunable work factor: Argon2 (`argon2` crate,
+      `Argon2::default().hash_password(...)`), bcrypt (`bcrypt::hash(...)`), or
+      scrypt (`scrypt` crate). These resist brute-force by design.
+    # Anchored to the *password* character of the input: the digested/updated
+    # argument must be named like a password (metavariable-regex on $PW). This
+    # avoids flagging `Sha256::digest(file_bytes)` used for file checksums or
+    # non-password fingerprints, and does not touch real password hashers
+    # (argon2 / bcrypt / scrypt).
+    patterns:
+      - pattern-either:
+          - pattern: md5::compute($PW)
+          - pattern: Md5::digest($PW)
+          - pattern: Sha1::digest($PW)
+          - pattern: Sha256::digest($PW)
+          - pattern: Sha512::digest($PW)
+          - pattern: $H.update($PW)
+      - metavariable-regex:
+          metavariable: $PW
+          regex: (?i).*(password|passwd|pwd).*
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-CRYPTO-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-crypto-weak-password-hash
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - sha2
+        - md5
+      references:
+        - https://cwe.mitre.org/data/definitions/916.html
+        - https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
+        - https://docs.rs/argon2/latest/argon2/