safeey-cli 0.1.0 → 0.2.1

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "safeey-cli",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Scan your source code for security vulnerabilities — a Safeey product by Noohra Innovate Ltd.",
   "bin": {
-    "safeey": "./bin/safeey.js"
+    "safeey": "bin/safeey.js"
   },
   "files": [
     "bin",
@@ -29,7 +29,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/davolu/safeey-cli.git"
+    "url": "git+https://github.com/davolu/safeey-cli.git"
   },
   "homepage": "https://safeey.io",
   "bugs": {

package/src/engine/gitignore.js

@@ -0,0 +1,128 @@
+// src/engine/gitignore.js
+// Answers one question: "would git ignore this path?" We use it to decide
+// whether secrets in a .env file matter. A secret in a *properly ignored* .env
+// is that file doing its job. A secret in a .env that ISN'T ignored is a leak
+// waiting to be committed — that's the finding worth raising.
+//
+// Primary strategy: shell out to `git check-ignore`, which implements the full
+// gitignore spec (nesting, negation, anchoring, core.excludesFile) correctly so
+// we don't have to. Fallback: a focused matcher for trees that aren't git repos
+// (where "no .gitignore at all" correctly resolves to "not ignored" -> flag it).
+
+const { execFileSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage"]);
+
+function isGitRepo(root) {
+  try {
+    const out = execFileSync("git", ["-C", root, "rev-parse", "--is-inside-work-tree"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    });
+    return out.trim() === "true";
+  } catch {
+    return false;
+  }
+}
+
+// Returns true (ignored), false (not ignored), or null (couldn't determine).
+function gitCheckIgnore(root, relPath) {
+  try {
+    execFileSync("git", ["-C", root, "check-ignore", "-q", "--", relPath], { stdio: "ignore" });
+    return true; // exit 0 => path is ignored
+  } catch (e) {
+    if (e && e.status === 1) return false; // exit 1 => not ignored
+    return null; // 128 / git missing => unknown
+  }
+}
+
+// ---- Non-git fallback ------------------------------------------------------
+
+// Convert a single gitignore pattern to { re, negate, dirOnly } relative to the
+// directory the .gitignore lives in. Intentionally a pragmatic subset of the
+// spec — enough to resolve the env-file cases the tool cares about.
+function patternToMatcher(raw) {
+  let pat = raw.replace(/\r$/, "");
+  if (!pat || pat.startsWith("#")) return null;
+  // Trim unescaped trailing whitespace.
+  pat = pat.replace(/((?:[^\\ ]|\\ )*?)\s+$/, "$1");
+  if (!pat) return null;
+
+  let negate = false;
+  if (pat.startsWith("!")) { negate = true; pat = pat.slice(1); }
+
+  let dirOnly = false;
+  if (pat.endsWith("/")) { dirOnly = true; pat = pat.slice(0, -1); }
+
+  const anchored = pat.startsWith("/") || pat.includes("/");
+  if (pat.startsWith("/")) pat = pat.slice(1);
+
+  // Escape regex metachars, then re-enable glob semantics.
+  let re = pat.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  re = re.replace(/\*\*/g, "\u0000").replace(/\*/g, "[^/]*").replace(/\u0000/g, ".*").replace(/\?/g, "[^/]");
+
+  const body = anchored ? `^${re}(?:/.*)?$` : `(?:^|/)${re}(?:/.*)?$`;
+  return { re: new RegExp(body), negate, dirOnly };
+}
+
+function readGitignores(root) {
+  const found = []; // { dir, matchers: [...] }
+  (function walk(dir) {
+    let entries = [];
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    const gi = path.join(dir, ".gitignore");
+    if (fs.existsSync(gi)) {
+      try {
+        const matchers = fs.readFileSync(gi, "utf8").split(/\n/).map(patternToMatcher).filter(Boolean);
+        found.push({ dir, matchers });
+      } catch { /* unreadable — skip */ }
+    }
+    for (const e of entries) {
+      if (e.isDirectory() && !IGNORE_DIRS.has(e.name)) walk(path.join(dir, e.name));
+    }
+  })(root);
+  return found;
+}
+
+function buildFallbackMatcher(root) {
+  const gitignores = readGitignores(root);
+  return function isIgnored(absPath) {
+    let decision = false;
+    for (const { dir, matchers } of gitignores) {
+      const rel = path.relative(dir, absPath);
+      if (!rel || rel.startsWith("..")) continue; // file not under this .gitignore
+      for (const m of matchers) {
+        if (m.re.test(rel)) decision = !m.negate;
+      }
+    }
+    return decision;
+  };
+}
+
+// ---- Public API ------------------------------------------------------------
+
+function makeIgnoreChecker(root) {
+  const git = isGitRepo(root);
+  const fallback = git ? null : buildFallbackMatcher(root);
+  const cache = new Map();
+  return {
+    mode: git ? "git" : "fallback",
+    // true | false | null(unknown, git-mode only)
+    isIgnored(absPath) {
+      if (cache.has(absPath)) return cache.get(absPath);
+      let res;
+      if (git) {
+        const rel = path.relative(root, absPath) || path.basename(absPath);
+        res = gitCheckIgnore(root, rel);
+      } else {
+        res = fallback(absPath);
+      }
+      cache.set(absPath, res);
+      return res;
+    },
+  };
+}
+
+module.exports = { makeIgnoreChecker };

package/src/engine/patterns.js

@@ -0,0 +1,69 @@
+// src/engine/patterns.js — run line-based regex rules against a file.
+// Complements the AST engine: covers languages we don't parse, and cheap
+// breadth for JS/TS. Precision is lower, so callers can filter by confidence.
+
+const { normalizeAll } = require("../rules/schema");
+const { PATTERN_RULES } = require("../rules/patterns");
+
+const RULES = normalizeAll(PATTERN_RULES, "pattern");
+
+// Map file extension -> language tag used in rule.languages.
+const EXT_LANG = {
+  ".js": "js", ".jsx": "js", ".mjs": "js", ".cjs": "js",
+  ".ts": "ts", ".tsx": "ts",
+  ".py": "py", ".go": "go", ".php": "php", ".rb": "rb", ".java": "java",
+};
+
+function langForExt(ext) {
+  return EXT_LANG[ext] || null;
+}
+
+function ruleAppliesTo(rule, lang) {
+  if (rule.languages.includes("*")) return true;
+  return lang != null && rule.languages.includes(lang);
+}
+
+// Skip lines that are clearly comments in common languages, to cut noise on
+// rules that would otherwise match documentation/examples. Cheap heuristic.
+function isCommentLine(line) {
+  const t = line.trimStart();
+  return t.startsWith("//") || t.startsWith("#") || t.startsWith("*") || t.startsWith("/*");
+}
+
+function analyzePatterns(code, file, ext) {
+  const lang = langForExt(ext);
+  const applicable = RULES.filter((r) => ruleAppliesTo(r, lang));
+  if (applicable.length === 0) return [];
+
+  const findings = [];
+  const lines = code.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length > 1000) continue;
+    const comment = isCommentLine(line);
+    for (const rule of applicable) {
+      // Let a rule opt into scanning comment lines (e.g. secrets); default skip.
+      if (comment && !rule.scanComments) continue;
+      const m = rule.re.exec(line);
+      if (!m) continue;
+      if (rule.unless && rule.unless.test(line)) continue;
+      findings.push({
+        ruleId: rule.id,
+        title: rule.title,
+        severity: rule.severity,
+        confidence: rule.confidence,
+        category: rule.category,
+        cwe: rule.cwe,
+        owasp: rule.owasp,
+        file,
+        line: i + 1,
+        column: (m.index ?? 0) + 1,
+        message: rule.message,
+        fix: rule.fix,
+      });
+    }
+  }
+  return findings;
+}
+
+module.exports = { analyzePatterns, langForExt, PATTERN_RULE_COUNT: RULES.length };

package/src/engine/secrets.js

@@ -1,31 +1,75 @@
 // src/engine/secrets.js — regex-based secret detection, language-agnostic.
+//
+// Secret patterns are the one tier where breadth scales cleanly: provider key
+// formats are specific enough that adding a pattern rarely adds false positives.
+// Each rule is pure data — append to PROVIDER_SECRETS to grow coverage.
+//
+// Every finding is masked in output; we never echo a full secret back.
 
-const SECRET_RULES = [
-  { id: "secret/aws-access-key", title: "AWS access key ID", severity: "high", re: /\bAKIA[0-9A-Z]{16}\b/ },
+// Well-known, high-specificity provider formats. High confidence: the shape is
+// distinctive enough that a match is almost always a real key.
+const PROVIDER_SECRETS = [
+  { id: "secret/aws-access-key", title: "AWS access key ID", severity: "high", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
   { id: "secret/aws-secret", title: "AWS secret access key", severity: "critical", re: /aws.{0,20}['"][0-9a-zA-Z/+]{40}['"]/i },
-  { id: "secret/private-key", title: "Private key", severity: "critical", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
-  { id: "secret/stripe-live", title: "Stripe live secret key", severity: "critical", re: /\bsk_live_[0-9a-zA-Z]{20,}\b/ },
-  { id: "secret/stripe-test", title: "Stripe test secret key", severity: "medium", re: /\bsk_test_[0-9a-zA-Z]{20,}\b/ },
+  { id: "secret/gcp-service-account", title: "GCP service account key", severity: "critical", re: /"type"\s*:\s*"service_account"/ },
   { id: "secret/google-api", title: "Google API key", severity: "high", re: /\bAIza[0-9A-Za-z_\-]{35}\b/ },
+  { id: "secret/google-oauth", title: "Google OAuth client secret", severity: "high", re: /\bGOCSPX-[0-9A-Za-z_\-]{28}\b/ },
+  { id: "secret/private-key", title: "Private key", severity: "critical", re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
+  { id: "secret/stripe-live", title: "Stripe live secret key", severity: "critical", re: /\b[rs]k_live_[0-9a-zA-Z]{20,}\b/ },
+  { id: "secret/stripe-test", title: "Stripe test secret key", severity: "medium", re: /\b[rs]k_test_[0-9a-zA-Z]{20,}\b/ },
   { id: "secret/github-token", title: "GitHub token", severity: "high", re: /\bgh[pousr]_[0-9A-Za-z]{36,}\b/ },
+  { id: "secret/github-fine-grained", title: "GitHub fine-grained PAT", severity: "high", re: /\bgithub_pat_[0-9A-Za-z_]{22,}\b/ },
+  { id: "secret/gitlab-token", title: "GitLab personal access token", severity: "high", re: /\bglpat-[0-9A-Za-z_\-]{20,}\b/ },
   { id: "secret/slack-token", title: "Slack token", severity: "high", re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/ },
-  { id: "secret/openai", title: "OpenAI API key", severity: "high", re: /\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/ },
+  { id: "secret/slack-webhook", title: "Slack webhook URL", severity: "medium", re: /https:\/\/hooks\.slack\.com\/services\/T[0-9A-Za-z_]+\/B[0-9A-Za-z_]+\/[0-9A-Za-z_]+/ },
+  { id: "secret/openai", title: "OpenAI API key", severity: "high", re: /\bsk-(?:proj-)?[A-Za-z0-9_\-]{20,}T3BlbkFJ[A-Za-z0-9_\-]{20,}\b/ },
+  { id: "secret/anthropic", title: "Anthropic API key", severity: "high", re: /\bsk-ant-[0-9A-Za-z_\-]{20,}\b/ },
+  { id: "secret/sendgrid", title: "SendGrid API key", severity: "high", re: /\bSG\.[0-9A-Za-z_\-]{22}\.[0-9A-Za-z_\-]{43}\b/ },
+  { id: "secret/twilio", title: "Twilio API key", severity: "high", re: /\bSK[0-9a-fA-F]{32}\b/ },
+  { id: "secret/twilio-account-sid", title: "Twilio account SID", severity: "medium", re: /\bAC[0-9a-fA-F]{32}\b/ },
+  { id: "secret/mailgun", title: "Mailgun API key", severity: "high", re: /\bkey-[0-9a-fA-F]{32}\b/ },
+  { id: "secret/npm-token", title: "npm access token", severity: "high", re: /\bnpm_[0-9A-Za-z]{36}\b/ },
+  { id: "secret/pypi-token", title: "PyPI upload token", severity: "high", re: /\bpypi-AgEIcHlwaS5vcmc[0-9A-Za-z_\-]{50,}\b/ },
+  { id: "secret/digitalocean", title: "DigitalOcean personal token", severity: "high", re: /\bdop_v1_[0-9a-f]{64}\b/ },
+  { id: "secret/square", title: "Square access token", severity: "high", re: /\b(?:sq0atp|EAAA)[0-9A-Za-z_\-]{22,}\b/ },
+  { id: "secret/shopify", title: "Shopify access token", severity: "high", re: /\bshp(?:at|ca|pa|ss)_[0-9a-fA-F]{32}\b/ },
+  { id: "secret/db-url-password", title: "Database URL with inline password", severity: "high", re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^:@\s]+:[^@\s]+@/ },
   { id: "secret/jwt", title: "Hardcoded JWT", severity: "medium", re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ },
-  {
-    id: "secret/generic-assignment",
-    title: "Hardcoded credential",
-    severity: "high",
-    re: /(?:api[_-]?key|secret|passwd|password|token|client[_-]?secret|access[_-]?token|private[_-]?key)\s*[:=]\s*['"][A-Za-z0-9_\-./+=]{12,}['"]/i,
-  },
 ];
 
-// Lines we shouldn't flag: obvious placeholders and env-var references.
-const IGNORE = /(process\.env|import\.meta\.env|example|placeholder|your[_-]?(key|token|secret)|xxxx|<[^>]+>|\$\{)/i;
+// Generic, lower-confidence catch-all. Guarded by IGNORE to reduce noise.
+const GENERIC_SECRET = {
+  id: "secret/generic-assignment",
+  title: "Hardcoded credential",
+  severity: "high",
+  confidence: "low",
+  re: /(?:api[_-]?key|secret|passwd|password|token|client[_-]?secret|access[_-]?token|private[_-]?key|auth)\s*[:=]\s*['"][A-Za-z0-9_\-.\/+=]{12,}['"]/i,
+};
+
+// Lines we shouldn't flag for the generic rule: placeholders and env references.
+const IGNORE = /(process\.env|import\.meta\.env|os\.environ|getenv|example|placeholder|dummy|your[_-]?(key|token|secret)|xxxx+|<[^>]+>|\$\{|\{\{)/i;
 
 function mask(s) {
   const t = s.replace(/['"]/g, "");
   if (t.length <= 10) return t.slice(0, 3) + "****";
-  return t.slice(0, 4) + "…" + t.slice(-3);
+  return t.slice(0, 4) + "\u2026" + t.slice(-3);
+}
+
+function makeFinding(rule, file, lineNo, m) {
+  return {
+    ruleId: rule.id,
+    title: rule.title,
+    severity: rule.severity,
+    confidence: rule.confidence || "high",
+    category: "secrets",
+    cwe: "CWE-798",
+    owasp: "A07:2021 Identification and Authentication Failures",
+    file,
+    line: lineNo,
+    column: (m.index ?? 0) + 1,
+    message: `A ${rule.title.toLowerCase()} appears to be hardcoded in source (${mask(m[0])}). Anything committed to code is effectively public.`,
+    fix: "Move the value to an environment variable or secret manager, remove it from code and git history, and rotate the credential.",
+  };
 }
 
 function analyzeSecrets(code, file) {
@@ -33,25 +77,23 @@ function analyzeSecrets(code, file) {
   const lines = code.split(/\r?\n/);
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
-    if (line.length > 500) continue;
-    for (const rule of SECRET_RULES) {
+    if (line.length > 1000) continue;
+
+    let matchedProvider = false;
+    for (const rule of PROVIDER_SECRETS) {
       const m = rule.re.exec(line);
       if (!m) continue;
-      if (IGNORE.test(line) && rule.id === "secret/generic-assignment") continue;
-      findings.push({
-        ruleId: rule.id,
-        title: rule.title,
-        severity: rule.severity,
-        file,
-        line: i + 1,
-        column: (m.index ?? 0) + 1,
-        message: `A ${rule.title.toLowerCase()} appears to be hardcoded in source (${mask(m[0])}). Anything committed to code is effectively public.`,
-        fix: "Move the value to an environment variable or secret manager, remove it from the code and git history, and rotate the credential.",
-      });
-      break; // one secret finding per line is enough
+      findings.push(makeFinding(rule, file, i + 1, m));
+      matchedProvider = true;
+      break; // one high-confidence provider hit per line is enough
+    }
+
+    if (!matchedProvider) {
+      const m = GENERIC_SECRET.re.exec(line);
+      if (m && !IGNORE.test(line)) findings.push(makeFinding(GENERIC_SECRET, file, i + 1, m));
     }
   }
   return findings;
 }
 
-module.exports = { analyzeSecrets };
+module.exports = { analyzeSecrets, SECRET_RULE_COUNT: PROVIDER_SECRETS.length + 1 };

package/src/rules/patterns.js

@@ -0,0 +1,164 @@
+// src/rules/patterns.js
+// Regex/source-pattern rules. These are line-based and language-tagged. They're
+// deliberately the "cheap" tier: lower precision than AST rules, but each one is
+// pure data, so this is where breadth grows fastest. Keep each rule tight and
+// give it an `unless` guard where obvious false positives exist.
+//
+// Precision guidance for anyone adding rules here:
+//   - Prefer specific, anchored patterns over vague ones.
+//   - Set confidence:"low" for heuristic rules so they can be down-weighted.
+//   - Add an `unless` regex to skip comments/placeholders/test files where you can.
+
+const PATTERN_RULES = [
+  // ---- Injection ----------------------------------------------------------
+  {
+    id: "pattern/python-os-system", title: "Command execution via os.system()",
+    severity: "high", confidence: "medium", category: "injection", cwe: "CWE-78",
+    languages: ["py"], re: /\bos\.system\s*\(/,
+    message: "os.system() runs a string through the shell; dynamic input here allows command injection.",
+    fix: "Use subprocess.run([...], shell=False) with an argument list, never a shell string built from input.",
+  },
+  {
+    id: "pattern/python-subprocess-shell", title: "subprocess with shell=True",
+    severity: "high", confidence: "medium", category: "injection", cwe: "CWE-78",
+    languages: ["py"], re: /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\([^)]*shell\s*=\s*True/,
+    message: "shell=True runs the command through a shell; combined with dynamic input this is command injection.",
+    fix: "Drop shell=True and pass args as a list. If you must use a shell, never interpolate untrusted input.",
+  },
+  {
+    id: "pattern/python-yaml-load", title: "Unsafe yaml.load()",
+    severity: "high", confidence: "high", category: "deserialization", cwe: "CWE-502",
+    languages: ["py"], re: /\byaml\.load\s*\((?![^)]*Loader\s*=\s*yaml\.SafeLoader)/,
+    message: "yaml.load() without SafeLoader can construct arbitrary Python objects from input.",
+    fix: "Use yaml.safe_load(), or pass Loader=yaml.SafeLoader explicitly.",
+  },
+  {
+    id: "pattern/python-pickle-loads", title: "Unsafe pickle deserialization",
+    severity: "high", confidence: "medium", category: "deserialization", cwe: "CWE-502",
+    languages: ["py"], re: /\bpickle\.(?:load|loads)\s*\(/,
+    message: "pickle can execute arbitrary code during deserialization of untrusted data.",
+    fix: "Never unpickle untrusted data. Use JSON or a safe schema-validated format.",
+  },
+  {
+    id: "pattern/python-eval-exec", title: "Dynamic code execution (eval/exec)",
+    severity: "critical", confidence: "medium", category: "injection", cwe: "CWE-95",
+    languages: ["py"], re: /\b(?:eval|exec)\s*\(/, unless: /#.*\b(eval|exec)\b/,
+    message: "eval()/exec() run arbitrary Python; any user-controlled part is remote code execution.",
+    fix: "Remove eval/exec. Use ast.literal_eval for data, or an explicit dispatch table.",
+  },
+  {
+    id: "pattern/go-exec-command", title: "os/exec with dynamic command",
+    severity: "medium", confidence: "low", category: "injection", cwe: "CWE-78",
+    languages: ["go"], re: /exec\.Command\s*\(\s*"(?:sh|bash|cmd|powershell)"/,
+    message: "Spawning a shell via exec.Command lets any interpolated input become a shell command.",
+    fix: "Call the target binary directly with separate args; avoid invoking a shell.",
+  },
+  {
+    id: "pattern/php-system-exec", title: "PHP shell execution",
+    severity: "high", confidence: "medium", category: "injection", cwe: "CWE-78",
+    languages: ["php"], re: /\b(?:system|exec|shell_exec|passthru|popen|proc_open)\s*\(/,
+    message: "PHP shell-execution functions run OS commands; dynamic input is command injection.",
+    fix: "Avoid shell calls. If unavoidable, use escapeshellarg() on every argument.",
+  },
+
+  // ---- Crypto / randomness ------------------------------------------------
+  {
+    id: "pattern/math-random-token", title: "Insecure randomness for security value",
+    severity: "medium", confidence: "low", category: "crypto", cwe: "CWE-338",
+    languages: ["js", "ts"], re: /Math\.random\s*\(\s*\).{0,40}(token|secret|password|otp|nonce|salt|session|api[_-]?key)/i,
+    message: "Math.random() is not cryptographically secure and must not be used to generate secrets/tokens.",
+    fix: "Use crypto.randomBytes()/crypto.randomUUID() (Node) or crypto.getRandomValues() (browser).",
+  },
+  {
+    id: "pattern/python-random-token", title: "Insecure randomness for security value",
+    severity: "medium", confidence: "low", category: "crypto", cwe: "CWE-338",
+    languages: ["py"], re: /\brandom\.(?:random|randint|choice|choices)\s*\(.{0,40}(token|secret|password|otp|nonce|salt|session)/i,
+    message: "The `random` module is not cryptographically secure; don't use it for secrets or tokens.",
+    fix: "Use the `secrets` module (secrets.token_hex, secrets.choice) for security-sensitive values.",
+  },
+  {
+    id: "pattern/insecure-cipher-des", title: "Weak cipher (DES/RC4/3DES)",
+    severity: "medium", confidence: "medium", category: "crypto", cwe: "CWE-327",
+    languages: ["*"], re: /\b(?:DES|DES-EDE3|RC4|3DES|Blowfish)\b/,
+    message: "DES, 3DES, RC4 and Blowfish are considered broken or weak for modern use.",
+    fix: "Use AES-256-GCM (or ChaCha20-Poly1305) for symmetric encryption.",
+  },
+  {
+    id: "pattern/jwt-alg-none", title: "JWT 'none' algorithm accepted",
+    severity: "high", confidence: "medium", category: "auth", cwe: "CWE-347",
+    languages: ["*"], re: /(?:algorithms?|alg)\s*[:=]\s*\[?\s*['"]none['"]/i,
+    message: "Accepting the 'none' JWT algorithm lets attackers forge tokens with no signature.",
+    fix: "Pin an explicit allow-list of signing algorithms (e.g. ['HS256'] or ['RS256']); never allow 'none'.",
+  },
+
+  // ---- Auth / cookies / config -------------------------------------------
+  {
+    id: "pattern/cookie-insecure-flags", title: "Cookie without httpOnly/secure",
+    severity: "low", confidence: "low", category: "auth", cwe: "CWE-1004",
+    languages: ["js", "ts"], re: /httpOnly\s*:\s*false/i,
+    message: "httpOnly:false lets client-side JS read the cookie, exposing it to XSS token theft.",
+    fix: "Set httpOnly:true and secure:true on session/auth cookies; add sameSite where appropriate.",
+  },
+  {
+    id: "pattern/csrf-disabled", title: "CSRF protection disabled",
+    severity: "medium", confidence: "low", category: "auth", cwe: "CWE-352",
+    languages: ["*"], re: /csrf\s*[:=]\s*(?:false|off|None)|@csrf_exempt/i,
+    message: "CSRF protection appears to be turned off on a state-changing endpoint.",
+    fix: "Keep CSRF protection on for cookie-authenticated state-changing routes; exempt only pure APIs using tokens.",
+  },
+  {
+    id: "pattern/debug-true-prod", title: "Debug mode enabled",
+    severity: "low", confidence: "low", category: "config", cwe: "CWE-489",
+    languages: ["py"], re: /DEBUG\s*=\s*True/,
+    message: "DEBUG=True leaks stack traces, settings and source to users in production.",
+    fix: "Drive DEBUG from an environment variable and default it to False.",
+  },
+  {
+    id: "pattern/flask-run-debug", title: "Flask running with debug=True",
+    severity: "medium", confidence: "medium", category: "config", cwe: "CWE-489",
+    languages: ["py"], re: /\.run\s*\([^)]*debug\s*=\s*True/,
+    message: "Flask debug mode exposes the interactive Werkzeug debugger, which can run code.",
+    fix: "Never run with debug=True in production; gate it behind an env var.",
+  },
+  {
+    id: "pattern/bind-all-interfaces", title: "Service bound to 0.0.0.0",
+    severity: "info", confidence: "low", category: "config", cwe: "CWE-668",
+    languages: ["*"], re: /['"]0\.0\.0\.0['"]/,
+    message: "Binding to 0.0.0.0 exposes the service on all network interfaces — intentional for containers, risky on hosts.",
+    fix: "Bind to 127.0.0.1 for local-only services; only use 0.0.0.0 when you mean to expose the port.",
+  },
+
+  // ---- Path traversal / SSRF ---------------------------------------------
+  {
+    id: "pattern/path-join-userinput", title: "Possible path traversal",
+    severity: "medium", confidence: "low", category: "path", cwe: "CWE-22",
+    languages: ["js", "ts"], re: /path\.join\s*\([^)]*\b(req|request|params|query|body|input)\b/,
+    message: "A filesystem path is built from request data; '../' sequences can escape the intended directory.",
+    fix: "Resolve the path and verify it stays within an allowed base dir (path.resolve + startsWith check); reject '..'.",
+  },
+  {
+    id: "pattern/open-userinput", title: "File opened from user input",
+    severity: "medium", confidence: "low", category: "path", cwe: "CWE-22",
+    languages: ["py"], re: /\bopen\s*\(\s*(?:request|req|input|params|args)\b/,
+    message: "Opening a file whose path comes from user input allows arbitrary file read/write via traversal.",
+    fix: "Validate against an allow-list and confirm the resolved path stays under an intended base directory.",
+  },
+
+  // ---- Misc dangerous shapes ---------------------------------------------
+  {
+    id: "pattern/document-write", title: "document.write with dynamic content",
+    severity: "medium", confidence: "low", category: "xss", cwe: "CWE-79",
+    languages: ["js", "ts"], re: /document\.write(?:ln)?\s*\(\s*(?!['"`]\s*<)/,
+    message: "document.write can inject unescaped markup; with dynamic input it's an XSS sink.",
+    fix: "Build DOM nodes and set textContent, or sanitise HTML before insertion.",
+  },
+  {
+    id: "pattern/http-url", title: "Cleartext HTTP endpoint",
+    severity: "low", confidence: "low", category: "config", cwe: "CWE-319",
+    languages: ["*"], re: /['"]http:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0)[a-z0-9.-]+/i,
+    message: "A cleartext http:// endpoint transmits data unencrypted and is open to interception/tampering.",
+    fix: "Use https:// for anything leaving the machine.",
+  },
+];
+
+module.exports = { PATTERN_RULES };

package/src/rules/schema.js

@@ -0,0 +1,111 @@
+// src/rules/schema.js
+// A single, richer rule shape shared by every rule source (AST rules, regex
+// pattern rules, secret rules). Normalizing here means the engines and the
+// report renderer only ever deal with one consistent object, and adding a rule
+// is mostly filling in *data*.
+//
+// This is what lets us scale coverage "little by little" without the code
+// sprawling: new rules are entries, not new engine logic.
+
+const SEVERITIES = ["critical", "high", "medium", "low", "info"];
+
+// Detection confidence. Lower-confidence rules can be surfaced separately or
+// down-weighted so we can add broad/heuristic rules without wrecking signal.
+const CONFIDENCE = ["high", "medium", "low"];
+
+// Coarse categories keep the growing rule set browsable and let us ship/skip
+// whole packs (e.g. --only injection, or --skip style).
+const CATEGORIES = [
+  "injection",       // SQL/command/code/template/LDAP/NoSQL injection
+  "xss",             // cross-site scripting sinks
+  "crypto",          // weak hashing, ciphers, insecure randomness
+  "secrets",         // hardcoded credentials / keys / tokens
+  "auth",            // authn/authz mistakes, session/cookie flags
+  "deserialization", // unsafe deserialization / prototype pollution
+  "ssrf",            // server-side request forgery
+  "path",            // path traversal / arbitrary file access
+  "config",          // insecure config, TLS off, permissive CORS
+  "dos",             // ReDoS, unbounded work
+  "dependencies",    // vulnerable / unpinned packages
+  "supply-chain",    // install scripts, typosquat shapes
+];
+
+// Map every category to a sensible default OWASP Top 10 (2021) bucket so users
+// get standards mapping for free even before we tag rules individually.
+const OWASP_BY_CATEGORY = {
+  injection: "A03:2021 Injection",
+  xss: "A03:2021 Injection",
+  crypto: "A02:2021 Cryptographic Failures",
+  secrets: "A07:2021 Identification and Authentication Failures",
+  auth: "A07:2021 Identification and Authentication Failures",
+  deserialization: "A08:2021 Software and Data Integrity Failures",
+  ssrf: "A10:2021 Server-Side Request Forgery",
+  path: "A01:2021 Broken Access Control",
+  config: "A05:2021 Security Misconfiguration",
+  dos: "A05:2021 Security Misconfiguration",
+  dependencies: "A06:2021 Vulnerable and Outdated Components",
+  "supply-chain": "A08:2021 Software and Data Integrity Failures",
+};
+
+function assert(cond, msg) {
+  if (!cond) throw new Error(`Invalid rule: ${msg}`);
+}
+
+// Fill in defaults and validate. Called once per rule at load time, so a
+// malformed rule fails loudly during development rather than silently at scan
+// time. Returns a frozen, fully-populated rule.
+function normalizeRule(rule, sourceKind) {
+  assert(rule && typeof rule === "object", "not an object");
+  assert(typeof rule.id === "string" && rule.id, `missing id (${JSON.stringify(rule)})`);
+  assert(SEVERITIES.includes(rule.severity), `${rule.id}: bad severity "${rule.severity}"`);
+  assert(typeof rule.title === "string" && rule.title, `${rule.id}: missing title`);
+
+  const category = rule.category || inferCategory(rule.id);
+  assert(CATEGORIES.includes(category), `${rule.id}: unknown category "${category}"`);
+
+  return Object.freeze({
+    id: rule.id,
+    title: rule.title,
+    severity: rule.severity,
+    confidence: rule.confidence && CONFIDENCE.includes(rule.confidence) ? rule.confidence : "medium",
+    category,
+    // engine kind: how this rule is evaluated ("ast" | "pattern" | "secret" | "deps")
+    kind: rule.kind || sourceKind || "pattern",
+    cwe: rule.cwe || null,                                   // e.g. "CWE-89"
+    owasp: rule.owasp || OWASP_BY_CATEGORY[category] || null,
+    languages: rule.languages || ["*"],                     // ["js","ts"] or ["*"]
+    message: rule.message || rule.title,
+    fix: rule.fix || "Review this finding and remediate per your security guidelines.",
+    references: rule.references || [],
+    // engine-specific payload, passed through untouched:
+    nodeTypes: rule.nodeTypes,   // AST rules
+    test: rule.test,             // AST rules
+    re: rule.re,                 // pattern/secret rules
+    unless: rule.unless,         // optional regex: skip line if it also matches
+  });
+}
+
+function inferCategory(id) {
+  const head = String(id).split("/")[0];
+  if (CATEGORIES.includes(head)) return head;
+  // common prefixes we actually use
+  if (head === "js" || head === "py" || head === "go") return "injection"; // fallback; real rules should set category
+  if (head === "secret") return "secrets";
+  if (head === "deps") return "dependencies";
+  return "config";
+}
+
+// Normalize a whole array, surfacing the first bad rule with a clear message.
+function normalizeAll(rules, sourceKind) {
+  const out = [];
+  const seen = new Set();
+  for (const r of rules) {
+    const n = normalizeRule(r, sourceKind);
+    if (seen.has(n.id)) throw new Error(`Duplicate rule id: ${n.id}`);
+    seen.add(n.id);
+    out.push(n);
+  }
+  return out;
+}
+
+module.exports = { SEVERITIES, CONFIDENCE, CATEGORIES, OWASP_BY_CATEGORY, normalizeRule, normalizeAll };

package/src/scan.js

@@ -4,6 +4,45 @@ const path = require("path");
 const { analyzeJs } = require("./engine/js");
 const { analyzeSecrets } = require("./engine/secrets");
 const { analyzeDeps } = require("./engine/deps");
+const { analyzePatterns } = require("./engine/patterns");
+const { makeIgnoreChecker } = require("./engine/gitignore");
+
+// Any .env-style file. `.env.example` / `.env.sample` / `.env.template` / .dist
+// are meant to be committed and hold placeholders, so they're scanned normally
+// (a *real* secret in one of those IS a finding). The bare/real env files are
+// the ones whose secrets we suppress-if-ignored, flag-if-not.
+const ENV_RE = /^\.env(\.|$)/;
+const ENV_EXAMPLE_RE = /(example|sample|template|dist|defaults)/i;
+
+function classifyEnvFile(base) {
+  if (!ENV_RE.test(base)) return null;
+  return ENV_EXAMPLE_RE.test(base) ? "example" : "real";
+}
+
+// Does the file actually contain KEY=value assignments with a value? Keeps us
+// from flagging an empty/placeholder .env.
+function hasEnvAssignment(code) {
+  return /^\s*[A-Za-z_][A-Za-z0-9_]*\s*=\s*\S/m.test(code);
+}
+
+function envNotIgnoredFinding(rel, hasSecret, unknown) {
+  return {
+    ruleId: "config/env-not-ignored",
+    title: "Environment file not covered by .gitignore",
+    severity: hasSecret ? "high" : "medium",
+    confidence: "medium",
+    category: "secrets",
+    cwe: "CWE-538",
+    owasp: "A05:2021 Security Misconfiguration",
+    file: rel,
+    line: 0,
+    column: 0,
+    message: unknown
+      ? `${rel} holds environment values and no .gitignore was found to protect it. If this directory is (or becomes) a git repo, the file will be committed and any credentials in it leaked.`
+      : `${rel} holds environment values but isn't matched by any .gitignore rule, so it can be committed to version control and its credentials leaked.`,
+    fix: "Add a matching rule to .gitignore (e.g. `.env` or `.env*`, keeping an explicit `!.env.example`). If the file was already committed, rotate the credentials and purge it from git history (e.g. git filter-repo).",
+  };
+}
 
 const IGNORE_DIRS = new Set(["node_modules", ".git", "dist", "build", ".next", "out", "vendor", "coverage", ".turbo", ".cache"]);
 const JS_EXT = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs"]);
@@ -43,22 +82,43 @@ function scan(target, opts = {}) {
   const findings = [];
   let scanned = 0;
 
+  // Used to decide whether a .env's secrets are safely ignored or exposed.
+  const ignore = makeIgnoreChecker(root);
+
   for (const file of files) {
     const ext = path.extname(file).toLowerCase();
     const base = path.basename(file);
     let size = 0;
     try { size = fs.statSync(file).size; } catch { continue; }
     if (size > MAX_FILE_BYTES) continue;
-    if (!TEXT_EXT.has(ext) && base !== "package.json" && base !== ".env") continue;
+    const envClass = classifyEnvFile(base);
+    if (!TEXT_EXT.has(ext) && base !== "package.json" && !envClass) continue;
 
     let code = "";
     try { code = fs.readFileSync(file, "utf8"); } catch { continue; }
     scanned++;
     const rel = path.relative(root, file) || base;
 
+    // A real .env file is *meant* to hold secrets. The question isn't "are
+    // there secrets in it" but "is it protected from being committed". So we
+    // suppress its secret findings when it's properly ignored, and raise a
+    // single clear finding when it isn't.
+    if (envClass === "real") {
+      const secretFindings = opts.secrets !== false ? analyzeSecrets(code, rel) : [];
+      const ignored = ignore.isIgnored(file); // true | false | null(unknown)
+      if (ignored !== true && hasEnvAssignment(code)) {
+        findings.push(envNotIgnoredFinding(rel, secretFindings.length > 0, ignored === null));
+        for (const f of secretFindings) findings.push(f); // exposure is real — show what's inside
+      }
+      // ignored === true -> secrets stay local and protected; report nothing.
+      continue;
+    }
+
     if (JS_EXT.has(ext)) for (const f of analyzeJs(code, rel)) findings.push(f);
     if (base === "package.json") for (const f of analyzeDeps(code, rel)) findings.push(f);
     if (opts.secrets !== false) for (const f of analyzeSecrets(code, rel)) findings.push(f);
+    // Regex/source-pattern rules run on every text file, gated by language tag.
+    for (const f of analyzePatterns(code, rel, ext)) findings.push(f);
   }
 
   // De-duplicate identical findings (same rule at the same spot).