security-mcp 1.0.5 → 1.1.1

package/dist/gate/checks/scanners.js

@@ -1,10 +1,21 @@
-import { readFile } from "node:fs/promises";
+/**
+ * Scanner execution module.
+ * Runs real security scanners and parses their JSON output into Finding[].
+ */
+import { readFile, mkdir } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
 import { z } from "zod";
-import { execa } from "execa";
+const execFileAsync = promisify(execFile);
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = resolve(__dirname, "../../..");
+const SECRET_SANITIZE_RE = /\b(AKIA[0-9A-Z]{16}|sk-[A-Za-z0-9]{20,}|AIza[0-9A-Za-z\-_]{35}|xoxb-[0-9A-Za-z-]{20,}|-----BEGIN[^-]*PRIVATE KEY-----)/g;
+function sanitize(s) {
+    return s.replace(SECRET_SANITIZE_RE, "[REDACTED]");
+}
 const ScannerSchema = z.object({
     command: z.string(),
     args: z.array(z.string()).default(["--version"]),
@@ -18,7 +29,12 @@ const ScannerConfigSchema = z.object({
 async function loadScannerConfig() {
     const overridePath = process.env["SECURITY_GATE_SCANNERS"];
     if (overridePath) {
-        const raw = await readFile(join(process.cwd(), overridePath), "utf-8");
+        // CWE-22: resolve to absolute path and ensure it stays within cwd
+        const resolved = resolve(process.cwd(), overridePath);
+        if (!resolved.startsWith(process.cwd() + "/") && resolved !== process.cwd()) {
+            throw new Error(`SECURITY_GATE_SCANNERS path '${overridePath}' escapes the project directory`);
+        }
+        const raw = await readFile(resolved, "utf-8");
         return ScannerConfigSchema.parse(JSON.parse(raw));
     }
     try {
@@ -46,15 +62,306 @@ function scannerApplies(requiredFor, surfaces) {
         return true;
     return false;
 }
-async function commandExists(command, args) {
+async function commandExists(command) {
+    try {
+        await execFileAsync(command, ["--version"], { timeout: 5000 });
+        return true;
+    }
+    catch {
+        try {
+            await execFileAsync(command, ["-version"], { timeout: 5000 });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+function dedupeFindings(findings) {
+    const seen = new Set();
+    return findings.filter((f) => {
+        const key = `${f.id}:${(f.files ?? []).join(",")}:${(f.evidence ?? []).slice(0, 1).join(",")}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/** Run a command and capture JSON output file, with timeout. */
+async function runScannerToFile(command, args, timeoutMs) {
+    await execFileAsync(command, args, {
+        timeout: timeoutMs,
+        maxBuffer: 50 * 1024 * 1024, // 50MB
+        cwd: process.cwd()
+    });
+}
+async function readJsonFile(path) {
+    const raw = await readFile(path, "utf-8");
+    return JSON.parse(raw);
+}
+async function runGitleaks(timeoutMs, changedFiles) {
+    const outFile = join(tmpdir(), `gl-report-${Date.now()}.json`);
+    try {
+        await runScannerToFile("gitleaks", [
+            "detect",
+            "--source",
+            process.cwd(),
+            "--report-format",
+            "json",
+            "--report-path",
+            outFile,
+            "--no-git",
+            "--exit-code",
+            "0"
+        ], timeoutMs);
+    }
+    catch {
+        // gitleaks exits non-zero when it finds leaks — that's expected, try to read output
+    }
+    let data;
+    try {
+        data = await readJsonFile(outFile);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(data))
+        return [];
+    const findings = [];
+    const leaks = data;
+    // Filter to changedFiles if provided
+    const changedSet = new Set(changedFiles.map((f) => f.replace(/^\.\//, "")));
+    for (const leak of leaks) {
+        const file = sanitize(leak.File ?? "");
+        if (changedFiles.length > 0 && !changedSet.has(file) && !changedSet.has(`./${file}`))
+            continue;
+        findings.push({
+            id: "POSSIBLE_SECRET",
+            title: `Secret detected by Gitleaks: ${sanitize(leak.Description ?? leak.RuleID ?? "unknown")}`,
+            severity: "CRITICAL",
+            files: file ? [file] : undefined,
+            evidence: [
+                `Line: ${leak.StartLine ?? "unknown"}`,
+                `Rule: ${sanitize(leak.RuleID ?? "unknown")}`
+            ],
+            requiredActions: [
+                "Remove the secret from source code immediately.",
+                "Rotate any exposed credentials.",
+                "Store secrets only in a dedicated secret manager."
+            ]
+        });
+    }
+    return dedupeFindings(findings);
+}
+function semgrepSeverity(sev) {
+    switch ((sev ?? "").toUpperCase()) {
+        case "ERROR":
+        case "CRITICAL":
+            return "CRITICAL";
+        case "WARNING":
+        case "HIGH":
+            return "HIGH";
+        case "INFO":
+        case "LOW":
+            return "LOW";
+        default:
+            return "MEDIUM";
+    }
+}
+async function runSemgrep(timeoutMs, changedFiles) {
+    const outFile = join(tmpdir(), `semgrep-${Date.now()}.json`);
     try {
-        const result = await execa(command, args, { reject: false });
-        return result.exitCode === 0;
+        const args = [
+            "--config=p/owasp-top-ten",
+            "--config=p/secrets",
+            "--json",
+            `--output=${outFile}`,
+            "."
+        ];
+        await runScannerToFile("semgrep", args, timeoutMs);
     }
     catch {
-        return false;
+        // non-zero exit is fine
+    }
+    let data;
+    try {
+        data = await readJsonFile(outFile);
+    }
+    catch {
+        return [];
+    }
+    const parsed = data;
+    const results = parsed.results ?? [];
+    const changedSet = new Set(changedFiles.map((f) => f.replace(/^\.\//, "")));
+    const findings = [];
+    for (const r of results) {
+        const file = r.path ?? "";
+        if (changedFiles.length > 0 && !changedSet.has(file) && !changedSet.has(`./${file}`))
+            continue;
+        const sev = semgrepSeverity(r.extra?.severity);
+        findings.push({
+            id: `SEMGREP_${(r.check_id ?? "FINDING").replace(/[^A-Z0-9_]/gi, "_").toUpperCase()}`,
+            title: sanitize(r.extra?.message ?? r.check_id ?? "Semgrep finding"),
+            severity: sev,
+            files: file ? [sanitize(file)] : undefined,
+            evidence: [
+                `Line: ${r.start?.line ?? "unknown"}`,
+                ...(r.extra?.metadata?.cwe ?? []),
+                ...(r.extra?.metadata?.owasp ?? [])
+            ],
+            requiredActions: [
+                "Review the semgrep finding and apply the recommended fix.",
+                "See semgrep documentation for the rule for remediation guidance."
+            ]
+        });
     }
+    return dedupeFindings(findings);
 }
+function trivyGetCvss(vuln) {
+    const cvss = vuln.CVSS ?? {};
+    let max = 0;
+    for (const source of Object.values(cvss)) {
+        if (source.V3Score && source.V3Score > max)
+            max = source.V3Score;
+    }
+    return max;
+}
+async function runTrivy(timeoutMs) {
+    const outFile = join(tmpdir(), `trivy-${Date.now()}.json`);
+    try {
+        await runScannerToFile("trivy", ["fs", "--format", "json", "--output", outFile, "."], timeoutMs);
+    }
+    catch {
+        // non-zero is fine
+    }
+    let data;
+    try {
+        data = await readJsonFile(outFile);
+    }
+    catch {
+        return [];
+    }
+    const parsed = data;
+    const findings = [];
+    for (const result of parsed.Results ?? []) {
+        for (const vuln of result.Vulnerabilities ?? []) {
+            const cvss = trivyGetCvss(vuln);
+            const sev = (vuln.Severity ?? "").toUpperCase();
+            let severity;
+            let findingId;
+            if (cvss >= 9.0 || sev === "CRITICAL") {
+                severity = "CRITICAL";
+                findingId = "SCANNER_CRITICAL_CVE";
+            }
+            else if (cvss >= 7.0 || sev === "HIGH") {
+                severity = "HIGH";
+                findingId = "SCANNER_HIGH_CVE";
+            }
+            else {
+                continue; // skip MEDIUM/LOW from scanner results
+            }
+            findings.push({
+                id: findingId,
+                title: `Trivy: ${sanitize(vuln.Title ?? vuln.VulnerabilityID ?? "CVE")} in ${vuln.PkgName ?? "unknown"}`,
+                severity,
+                evidence: [
+                    `CVE: ${vuln.VulnerabilityID ?? "unknown"}`,
+                    `Package: ${vuln.PkgName ?? "unknown"}@${vuln.InstalledVersion ?? "unknown"}`,
+                    `CVSS: ${cvss}`,
+                    `Target: ${sanitize(result.Target ?? "")}`
+                ],
+                requiredActions: [
+                    "Update the affected package to a patched version.",
+                    "If no patch is available, apply mitigations and add a security exception with justification."
+                ]
+            });
+        }
+    }
+    return dedupeFindings(findings);
+}
+async function runCheckov(timeoutMs) {
+    const outFile = join(tmpdir(), `checkov-${Date.now()}.json`);
+    try {
+        await runScannerToFile("checkov", ["-d", ".", "--output", "json", "--output-file", outFile, "--quiet"], timeoutMs);
+    }
+    catch {
+        // non-zero exit is expected when findings exist
+    }
+    let data;
+    try {
+        data = await readJsonFile(outFile);
+    }
+    catch {
+        return [];
+    }
+    // Checkov can return array or object
+    const parsed = Array.isArray(data)
+        ? { results: { failed_checks: data.flatMap((d) => d.results?.failed_checks ?? []) } }
+        : data;
+    const failed = parsed.results?.failed_checks ?? [];
+    const findings = [];
+    for (const check of failed) {
+        const sev = (check.severity ?? "").toUpperCase();
+        const severity = sev === "CRITICAL" ? "CRITICAL" : sev === "HIGH" ? "HIGH" : "MEDIUM";
+        findings.push({
+            id: `CHECKOV_${(check.check_id ?? "FINDING").replace(/[^A-Z0-9_]/gi, "_").toUpperCase()}`,
+            title: sanitize(`Checkov: ${check.check?.name ?? check.check_id ?? "IaC misconfiguration"} in ${check.resource ?? ""}`),
+            severity,
+            files: check.file_path ? [sanitize(check.file_path)] : undefined,
+            evidence: [
+                `Check: ${check.check_id ?? "unknown"}`,
+                `Type: ${check.check_type ?? "unknown"}`
+            ],
+            requiredActions: [
+                "Fix the IaC misconfiguration identified by Checkov.",
+                "See Checkov documentation for the check rule for remediation guidance."
+            ]
+        });
+    }
+    return dedupeFindings(findings);
+}
+async function runOsvScanner(timeoutMs) {
+    const outFile = join(tmpdir(), `osv-${Date.now()}.json`);
+    try {
+        await runScannerToFile("osv-scanner", ["--format", "json", "--output", outFile, "."], timeoutMs);
+    }
+    catch {
+        // non-zero when vulns found
+    }
+    let data;
+    try {
+        data = await readJsonFile(outFile);
+    }
+    catch {
+        return [];
+    }
+    const parsed = data;
+    const findings = [];
+    for (const result of parsed.results ?? []) {
+        for (const pkg of result.packages ?? []) {
+            for (const group of pkg.groups ?? []) {
+                const ids = group.ids ?? [];
+                const pkgName = group.packages?.[0]?.package?.name ?? "unknown";
+                const pkgVer = group.packages?.[0]?.package?.version ?? "unknown";
+                // Assume HIGH severity for OSV findings (no CVSS in basic output)
+                findings.push({
+                    id: "SCANNER_HIGH_CVE",
+                    title: `OSV-Scanner: vulnerability in ${pkgName}@${pkgVer}`,
+                    severity: "HIGH",
+                    evidence: ids.slice(0, 5),
+                    requiredActions: [
+                        "Update the affected package to a non-vulnerable version.",
+                        "Check OSV.dev for patch availability and workarounds."
+                    ]
+                });
+            }
+        }
+    }
+    return dedupeFindings(findings);
+}
+// ---------------------------------------------------------------------------
+// Main export: checkScannerReadiness (backwards compatible) + runScanners
+// ---------------------------------------------------------------------------
 export async function checkScannerReadiness(opts) {
     const config = await loadScannerConfig();
     const configured = [];
@@ -64,7 +371,7 @@ export async function checkScannerReadiness(opts) {
         if (!scannerApplies(scanner.required_for, opts.surfaces))
             continue;
         configured.push(scannerId);
-        if (!(await commandExists(scanner.command, scanner.args))) {
+        if (!(await commandExists(scanner.command))) {
             missing.push(scannerId);
         }
     }
@@ -82,3 +389,67 @@ export async function checkScannerReadiness(opts) {
     }
     return { findings, configured, missing };
 }
+/**
+ * Actually execute scanners and parse their output into Finding[].
+ * Uses Promise.allSettled so one scanner failure doesn't kill others.
+ */
+export async function runScanners(opts) {
+    const config = await loadScannerConfig();
+    const timeout = opts.timeoutMs ?? 120_000;
+    // Ensure tmp dir exists for output files
+    try {
+        await mkdir(tmpdir(), { recursive: true });
+    }
+    catch {
+        // already exists
+    }
+    const tasks = [];
+    if (config.scanners["gitleaks"] && scannerApplies(config.scanners["gitleaks"].required_for, opts.surfaces)) {
+        if (await commandExists("gitleaks")) {
+            tasks.push({ id: "gitleaks", task: () => runGitleaks(timeout, opts.changedFiles) });
+        }
+    }
+    if (config.scanners["semgrep"] && scannerApplies(config.scanners["semgrep"].required_for, opts.surfaces)) {
+        if (await commandExists("semgrep")) {
+            tasks.push({ id: "semgrep", task: () => runSemgrep(timeout, opts.changedFiles) });
+        }
+    }
+    if (config.scanners["trivy"] && scannerApplies(config.scanners["trivy"].required_for, opts.surfaces)) {
+        if (await commandExists("trivy")) {
+            tasks.push({ id: "trivy", task: () => runTrivy(timeout) });
+        }
+    }
+    if (config.scanners["checkov"] && scannerApplies(config.scanners["checkov"].required_for, opts.surfaces)) {
+        if (await commandExists("checkov")) {
+            tasks.push({ id: "checkov", task: () => runCheckov(timeout) });
+        }
+    }
+    if (config.scanners["osv-scanner"] && scannerApplies(config.scanners["osv-scanner"].required_for, opts.surfaces)) {
+        if (await commandExists("osv-scanner")) {
+            tasks.push({ id: "osv-scanner", task: () => runOsvScanner(timeout) });
+        }
+    }
+    const results = await Promise.allSettled(tasks.map((t) => t.task()));
+    const allFindings = [];
+    for (let i = 0; i < results.length; i++) {
+        const res = results[i];
+        const taskId = tasks[i]?.id ?? "unknown";
+        if (res.status === "fulfilled") {
+            allFindings.push(...res.value);
+        }
+        else {
+            console.warn(`[scanners] Scanner ${taskId} failed: ${String(res.reason)}`);
+            allFindings.push({
+                id: "SCANNER_EXECUTION_ERROR",
+                title: `Security scanner '${taskId}' failed unexpectedly`,
+                severity: "MEDIUM",
+                evidence: [sanitize(String(res.reason))],
+                requiredActions: [
+                    `Investigate why scanner '${taskId}' failed.`,
+                    "Check scanner installation and permissions."
+                ]
+            });
+        }
+    }
+    return dedupeFindings(allFindings);
+}

package/dist/gate/checks/secrets.js

@@ -1,13 +1,66 @@
 import fg from "fast-glob";
 import { readFileSafe } from "../../repo/fs.js";
 const SECRET_PATTERNS = [
-    { name: "private_key_pem", regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/ },
-    { name: "aws_access_key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
-    { name: "google_api_key", regex: /\bAIza[0-9A-Za-z\-_]{35}\b/ },
-    { name: "slack_bot_token", regex: /\bxoxb-[0-9A-Za-z-]{20,}\b/ },
-    { name: "llm_api_key", regex: /\bsk-[A-Za-z0-9]{20,}\b/ },
-    { name: "secret_key_assignment", regex: /\bSECRET_KEY\s*[:=]\s*["'][^"'\n]{8,}["']/ },
-    { name: "private_key_assignment", regex: /\bPRIVATE_KEY\s*[:=]\s*["'][^"'\n]{16,}["']/ }
+    // Private keys
+    { name: "private_key_pem", regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/, description: "PEM private key" },
+    { name: "private_key_pkcs8", regex: /-----BEGIN ENCRYPTED PRIVATE KEY-----/, description: "Encrypted PKCS8 private key" },
+    // AWS
+    { name: "aws_access_key_id", regex: /\bAKIA[0-9A-Z]{16}\b/, description: "AWS access key ID" },
+    { name: "aws_secret_access_key", regex: /\bAWS_SECRET(?:_ACCESS)?_KEY\s*[:=]\s*["']?[A-Za-z0-9/+]{40}["']?/, description: "AWS secret access key" },
+    { name: "aws_session_token", regex: /\bAWS_SESSION_TOKEN\s*[:=]\s*["'][A-Za-z0-9/+]{100,}["']/, description: "AWS session token" },
+    { name: "aws_mws_key", regex: /\bamzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/, description: "AWS MWS key" },
+    // GCP
+    { name: "google_api_key", regex: /\bAIza[0-9A-Za-z\-_]{35}\b/, description: "Google API key" },
+    { name: "gcp_service_account", regex: /"type"\s*:\s*"service_account"/, description: "GCP service account JSON" },
+    { name: "gcp_oauth_client", regex: /\d+-\w{32}\.apps\.googleusercontent\.com/, description: "GCP OAuth client ID" },
+    // Azure
+    { name: "azure_connection_string", regex: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/]{86}==/, description: "Azure storage connection string" },
+    { name: "azure_sas_token", regex: /\bsig=[A-Za-z0-9%+/]{43,}%3D/, description: "Azure SAS token" },
+    { name: "azure_client_secret", regex: /\bAZURE_CLIENT_SECRET\s*[:=]\s*["'][^"'\n]{20,}["']/, description: "Azure client secret" },
+    { name: "azure_subscription_key", regex: /\bOcp-Apim-Subscription-Key\s*[:=]\s*["'][0-9a-f]{32}["']/, description: "Azure APIM subscription key" },
+    // GitHub / GitLab / Bitbucket
+    { name: "github_personal_token", regex: /\bghp_[A-Za-z0-9]{36}\b/, description: "GitHub personal access token" },
+    { name: "github_oauth_token", regex: /\bgho_[A-Za-z0-9]{36}\b/, description: "GitHub OAuth token" },
+    { name: "github_actions_token", regex: /\bghs_[A-Za-z0-9]{36}\b/, description: "GitHub Actions token" },
+    { name: "github_refresh_token", regex: /\bghr_[A-Za-z0-9]{76}\b/, description: "GitHub refresh token" },
+    { name: "gitlab_token", regex: /\bglpat-[A-Za-z0-9\-_]{20}\b/, description: "GitLab personal access token" },
+    { name: "bitbucket_token", regex: /\bATBB[A-Za-z0-9]{28}\b/, description: "Bitbucket access token" },
+    // Slack
+    { name: "slack_bot_token", regex: /\bxoxb-[0-9A-Za-z-]{20,}\b/, description: "Slack bot token" },
+    { name: "slack_user_token", regex: /\bxoxp-[0-9A-Za-z-]{20,}\b/, description: "Slack user token" },
+    { name: "slack_workspace_token", regex: /\bxoxa-[0-9A-Za-z-]{20,}\b/, description: "Slack workspace token" },
+    { name: "slack_webhook", regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/, description: "Slack webhook URL" },
+    // Stripe / Payment
+    { name: "stripe_secret_key", regex: /\bsk_live_[A-Za-z0-9]{24,}\b/, description: "Stripe live secret key" },
+    { name: "stripe_restricted_key", regex: /\brk_live_[A-Za-z0-9]{24,}\b/, description: "Stripe restricted key" },
+    { name: "stripe_webhook_secret", regex: /\bwhsec_[A-Za-z0-9]{32,}\b/, description: "Stripe webhook secret" },
+    { name: "paypal_braintree_key", regex: /\baccess_token\$production\$[A-Za-z0-9]{16}\$[A-Za-z0-9]{32}\b/, description: "PayPal/Braintree access token" },
+    { name: "square_access_token", regex: /\bEAAAE[A-Za-z0-9\-_]{60,}\b/, description: "Square access token" },
+    // Communication
+    { name: "twilio_account_sid", regex: /\bAC[a-fA-F0-9]{32}\b/, description: "Twilio account SID" },
+    { name: "twilio_auth_token", regex: /\bTWILIO_AUTH_TOKEN\s*[:=]\s*["'][a-fA-F0-9]{32}["']/, description: "Twilio auth token" },
+    { name: "sendgrid_api_key", regex: /\bSG\.[A-Za-z0-9\-_]{22}\.[A-Za-z0-9\-_]{43}\b/, description: "SendGrid API key" },
+    { name: "mailgun_api_key", regex: /\bkey-[A-Za-z0-9]{32}\b/, description: "Mailgun API key" },
+    // LLM / AI providers
+    { name: "openai_api_key", regex: /\bsk-[A-Za-z0-9]{20,}\b/, description: "OpenAI API key" },
+    { name: "anthropic_api_key", regex: /\bsk-ant-[A-Za-z0-9\-_]{40,}\b/, description: "Anthropic API key" },
+    { name: "huggingface_token", regex: /\bhf_[A-Za-z0-9]{34}\b/, description: "HuggingFace token" },
+    { name: "cohere_api_key", regex: /\bCOHERE_API_KEY\s*[:=]\s*["'][A-Za-z0-9]{40}["']/, description: "Cohere API key" },
+    // Database connection strings with embedded credentials
+    { name: "db_connection_string", regex: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|mssql):\/\/[^:]+:[^@\s]{6,}@/, description: "Database connection string with embedded credentials" },
+    { name: "jdbc_credentials", regex: /jdbc:[a-z]+:\/\/[^;]+;?[Pp]assword=[^;\s"']{6,}/, description: "JDBC connection string with password" },
+    // Infrastructure tokens
+    { name: "hashicorp_vault_token", regex: /\bhvs\.[A-Za-z0-9]{24,}\b/, description: "HashiCorp Vault service token" },
+    { name: "npm_token", regex: /\bnpm_[A-Za-z0-9]{36}\b/, description: "npm access token" },
+    { name: "docker_hub_pat", regex: /\bdckr_pat_[A-Za-z0-9\-_]{27}\b/, description: "Docker Hub personal access token" },
+    { name: "terraform_cloud_token", regex: /\b[A-Za-z0-9]{14}\.atlasv1\.[A-Za-z0-9]{60,}\b/, description: "Terraform Cloud token" },
+    { name: "datadog_api_key", regex: /\bDD_API_KEY\s*[:=]\s*["'][a-fA-F0-9]{32}["']/, description: "Datadog API key" },
+    { name: "new_relic_key", regex: /\bNEW_RELIC_LICENSE_KEY\s*[:=]\s*["'][A-Za-z0-9]{40}["']/, description: "New Relic license key" },
+    // Generic high-confidence patterns
+    { name: "secret_key_assignment", regex: /\b(?:SECRET|API)_KEY\s*[:=]\s*["'][^"'\n]{16,}["']/, description: "Generic secret/API key assignment" },
+    { name: "password_assignment", regex: /\b(?:PASSWORD|PASSWD|PWD)\s*[:=]\s*["'][^"'\n]{8,}["']/, description: "Hardcoded password assignment" },
+    { name: "private_key_assignment", regex: /\bPRIVATE_KEY\s*[:=]\s*["'][^"'\n]{16,}["']/, description: "Private key value assignment" },
+    { name: "bearer_token_literal", regex: /Authorization['"]?\s*[:=]\s*['"]Bearer [A-Za-z0-9\-_=.]{20,}['"]/, description: "Hardcoded Bearer token" },
 ];
 function previewLine(text, index) {
     const lineStart = text.lastIndexOf("\n", index);
@@ -25,10 +78,14 @@ export async function checkSecrets(_) {
             "**/dist/**",
             "**/fixtures/**",
             "**/.mcp/reviews/**",
-            "**/.mcp/reports/**"
+            "**/.mcp/reports/**",
+            "**/.claude/**",
+            // Exclude detection source — contains regex patterns that match their own rules
+            "src/gate/checks/secrets.ts"
         ]
     });
-    const evidence = [];
+    // Track hits per pattern so each type gets its own finding with specific guidance
+    const hitsByPattern = new Map();
     for (const file of files) {
         let text = "";
         try {
@@ -41,23 +98,31 @@ export async function checkSecrets(_) {
             const match = pattern.regex.exec(text);
             if (!match || match.index === undefined)
                 continue;
-            evidence.push(`${file}:${pattern.name}:${previewLine(text, match.index)}`);
-            if (evidence.length >= 25)
-                break;
+            const preview = previewLine(text, match.index);
+            // Redact the matched value itself — only expose location and pattern name
+            const redacted = preview.replace(pattern.regex, "[REDACTED]");
+            const hit = `${file}: ${redacted}`;
+            const existing = hitsByPattern.get(pattern.name) ?? [];
+            if (existing.length < 5) {
+                existing.push(hit);
+                hitsByPattern.set(pattern.name, existing);
+            }
         }
-        if (evidence.length >= 25)
-            break;
     }
-    if (evidence.length > 0) {
+    for (const [patternName, hits] of hitsByPattern) {
+        const pattern = SECRET_PATTERNS.find((p) => p.name === patternName);
+        const description = pattern?.description ?? patternName;
         findings.push({
             id: "POSSIBLE_SECRET",
-            title: "Potential secret material detected by whole-repo heuristic scan",
+            title: `Hardcoded secret detected: ${description}`,
             severity: "CRITICAL",
-            evidence,
+            files: hits.map((h) => h.split(":")[0]).filter(Boolean),
+            evidence: hits,
             requiredActions: [
-                "Remove secrets from the affected files immediately.",
-                "Rotate any exposed credentials.",
-                "Store secrets only in a dedicated secret manager and keep them out of logs."
+                `Remove the ${description} from source code immediately.`,
+                "Rotate the exposed credential — treat it as compromised.",
+                "Store the secret in your cloud secret manager (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault, Doppler, or 1Password Secrets Automation).",
+                "Add a pre-commit hook or CI check with gitleaks to prevent future secret commits."
             ]
         });
     }

package/dist/gate/exceptions.js

@@ -22,7 +22,12 @@ const ExceptionFileSchema = z.object({
 async function readExceptionsJson() {
     const overridePath = process.env["SECURITY_GATE_EXCEPTIONS"];
     if (overridePath) {
-        return await readFile(join(process.cwd(), overridePath), "utf-8");
+        // CWE-22: ensure path stays within the project directory
+        const resolved = resolve(process.cwd(), overridePath);
+        if (!resolved.startsWith(process.cwd() + "/") && resolved !== process.cwd()) {
+            throw new Error(`SECURITY_GATE_EXCEPTIONS path '${overridePath}' escapes the project directory`);
+        }
+        return await readFile(resolved, "utf-8");
     }
     try {
         return await readFile(join(process.cwd(), ".mcp", "exceptions", "security-exceptions.json"), "utf-8");