thuban 0.3.3 → 0.4.0

package/dist/packages/crucible/seeds/ruby/seed-049 3.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
+
+def load_config_file(config_name)
+  path    = "/etc/app/configs/#{config_name}.yml"
+  content = File.read(path)
+  YAML.load(content)
+end
+
+def parse_pipeline(pipeline_definition)
+  YAML.load(pipeline_definition)
+end
+
+def deserialize_job(job_yaml)
+  job = YAML.load(job_yaml)
+  job.merge(loaded_at: Time.now)
+end

package/dist/packages/crucible/seeds/ruby/seed-049.rb

@@ -0,0 +1,20 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load on file contents from user-supplied path — RCE via Psych gadget
+
+def load_config_file(config_name)
+  path    = "/etc/app/configs/#{config_name}.yml"
+  content = File.read(path)
+  YAML.load(content)
+end
+
+def parse_pipeline(pipeline_definition)
+  YAML.load(pipeline_definition)
+end
+
+def deserialize_job(job_yaml)
+  job = YAML.load(job_yaml)
+  job.merge(loaded_at: Time.now)
+end

package/dist/packages/crucible/seeds/ruby/seed-050 2.rb

@@ -0,0 +1,27 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load used in API endpoint — remote code execution via crafted payload
+
+require 'sinatra'
+require 'yaml'
+
+post '/api/import' do
+  content_type :json
+  raw_body = request.body.read
+  data     = YAML.load(raw_body)
+  process_import(data)
+  { imported: data.keys.count }.to_json
+end
+
+post '/api/config/update' do
+  yaml_config = params[:yaml]
+  config      = YAML.load(yaml_config)
+  config.each { |k, v| CONFIG[k] = v }
+  { updated: true }.to_json
+end
+
+def process_import(data)
+  data.each { |k, v| puts "#{k}: #{v}" }
+end

package/dist/packages/crucible/seeds/ruby/seed-050 3.rb

@@ -0,0 +1,27 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load used in API endpoint — remote code execution via crafted payload
+
+require 'sinatra'
+require 'yaml'
+
+post '/api/import' do
+  content_type :json
+  raw_body = request.body.read
+  data     = YAML.load(raw_body)
+  process_import(data)
+  { imported: data.keys.count }.to_json
+end
+
+post '/api/config/update' do
+  yaml_config = params[:yaml]
+  config      = YAML.load(yaml_config)
+  config.each { |k, v| CONFIG[k] = v }
+  { updated: true }.to_json
+end
+
+def process_import(data)
+  data.each { |k, v| puts "#{k}: #{v}" }
+end

package/dist/packages/crucible/seeds/ruby/seed-050.rb

@@ -0,0 +1,27 @@
+# [CRUCIBLE-SEED]
+# category: yaml_deserialization
+# severity: critical
+# language: ruby
+# expected: YAML.load used in API endpoint — remote code execution via crafted payload
+
+require 'sinatra'
+require 'yaml'
+
+post '/api/import' do
+  content_type :json
+  raw_body = request.body.read
+  data     = YAML.load(raw_body)
+  process_import(data)
+  { imported: data.keys.count }.to_json
+end
+
+post '/api/config/update' do
+  yaml_config = params[:yaml]
+  config      = YAML.load(yaml_config)
+  config.each { |k, v| CONFIG[k] = v }
+  { updated: true }.to_json
+end
+
+def process_import(data)
+  data.each { |k, v| puts "#{k}: #{v}" }
+end

package/dist/packages/crucible/seeds/rust/seed-001 2.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded AWS access key and secret in string literals
+
+use aws_sdk_s3::Client;
+
+const AWS_ACCESS_KEY_ID: &str = "AKIAIOSFODNN7EXAMPLE1";
+const AWS_SECRET_ACCESS_KEY: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+const AWS_REGION: &str = "us-east-1";
+const S3_BUCKET: &str = "my-production-bucket";
+
+pub async fn create_s3_client() -> Client {
+    std::env::set_var("AWS_ACCESS_KEY_ID", AWS_ACCESS_KEY_ID);
+    std::env::set_var("AWS_SECRET_ACCESS_KEY", AWS_SECRET_ACCESS_KEY);
+    std::env::set_var("AWS_DEFAULT_REGION", AWS_REGION);
+    let config = aws_config::load_from_env().await;
+    Client::new(&config)
+}
+
+pub fn get_bucket() -> &'static str {
+    println!("Using bucket: {} with key: {}", S3_BUCKET, AWS_ACCESS_KEY_ID);
+    S3_BUCKET
+}

package/dist/packages/crucible/seeds/rust/seed-001 3.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded AWS access key and secret in string literals
+
+use aws_sdk_s3::Client;
+
+const AWS_ACCESS_KEY_ID: &str = "AKIAIOSFODNN7EXAMPLE1";
+const AWS_SECRET_ACCESS_KEY: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+const AWS_REGION: &str = "us-east-1";
+const S3_BUCKET: &str = "my-production-bucket";
+
+pub async fn create_s3_client() -> Client {
+    std::env::set_var("AWS_ACCESS_KEY_ID", AWS_ACCESS_KEY_ID);
+    std::env::set_var("AWS_SECRET_ACCESS_KEY", AWS_SECRET_ACCESS_KEY);
+    std::env::set_var("AWS_DEFAULT_REGION", AWS_REGION);
+    let config = aws_config::load_from_env().await;
+    Client::new(&config)
+}
+
+pub fn get_bucket() -> &'static str {
+    println!("Using bucket: {} with key: {}", S3_BUCKET, AWS_ACCESS_KEY_ID);
+    S3_BUCKET
+}

package/dist/packages/crucible/seeds/rust/seed-001.rs

@@ -0,0 +1,25 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded AWS access key and secret in string literals
+
+use aws_sdk_s3::Client;
+
+const AWS_ACCESS_KEY_ID: &str = "AKIAIOSFODNN7EXAMPLE1";
+const AWS_SECRET_ACCESS_KEY: &str = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY";
+const AWS_REGION: &str = "us-east-1";
+const S3_BUCKET: &str = "my-production-bucket";
+
+pub async fn create_s3_client() -> Client {
+    std::env::set_var("AWS_ACCESS_KEY_ID", AWS_ACCESS_KEY_ID);
+    std::env::set_var("AWS_SECRET_ACCESS_KEY", AWS_SECRET_ACCESS_KEY);
+    std::env::set_var("AWS_DEFAULT_REGION", AWS_REGION);
+    let config = aws_config::load_from_env().await;
+    Client::new(&config)
+}
+
+pub fn get_bucket() -> &'static str {
+    println!("Using bucket: {} with key: {}", S3_BUCKET, AWS_ACCESS_KEY_ID);
+    S3_BUCKET
+}

package/dist/packages/crucible/seeds/rust/seed-002 2.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded database password in connection string literal
+
+use sqlx::PgPool;
+
+const DB_URL: &str = "postgresql://appuser:Sup3rS3cr3tP@ssw0rd!@prod-db.example.com:5432/appdb";
+const REDIS_URL: &str = "redis://:myR3d1sS3cret@redis.prod.example.com:6379/0";
+const MONGO_URL: &str = "mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb";
+
+pub async fn connect_db() -> PgPool {
+    PgPool::connect(DB_URL).await.expect("Failed to connect to DB")
+}
+
+pub fn get_db_url() -> &'static str {
+    eprintln!("Connecting to: {}", DB_URL);
+    DB_URL
+}

package/dist/packages/crucible/seeds/rust/seed-002 3.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded database password in connection string literal
+
+use sqlx::PgPool;
+
+const DB_URL: &str = "postgresql://appuser:Sup3rS3cr3tP@ssw0rd!@prod-db.example.com:5432/appdb";
+const REDIS_URL: &str = "redis://:myR3d1sS3cret@redis.prod.example.com:6379/0";
+const MONGO_URL: &str = "mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb";
+
+pub async fn connect_db() -> PgPool {
+    PgPool::connect(DB_URL).await.expect("Failed to connect to DB")
+}
+
+pub fn get_db_url() -> &'static str {
+    eprintln!("Connecting to: {}", DB_URL);
+    DB_URL
+}

package/dist/packages/crucible/seeds/rust/seed-002.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded database password in connection string literal
+
+use sqlx::PgPool;
+
+const DB_URL: &str = "postgresql://appuser:Sup3rS3cr3tP@ssw0rd!@prod-db.example.com:5432/appdb";
+const REDIS_URL: &str = "redis://:myR3d1sS3cret@redis.prod.example.com:6379/0";
+const MONGO_URL: &str = "mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb";
+
+pub async fn connect_db() -> PgPool {
+    PgPool::connect(DB_URL).await.expect("Failed to connect to DB")
+}
+
+pub fn get_db_url() -> &'static str {
+    eprintln!("Connecting to: {}", DB_URL);
+    DB_URL
+}

package/dist/packages/crucible/seeds/rust/seed-003 2.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded JWT secret key used to sign tokens
+
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+
+const JWT_SECRET: &str = "mySuperSecretJWTSigningKey_2024_doNotCommit";
+const JWT_EXPIRY_HOURS: u64 = 24;
+const ADMIN_API_KEY: &str = "admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+
+pub fn sign_token(payload: &str) -> Vec<u8> {
+    let mut mac = Hmac::<Sha256>::new_from_slice(JWT_SECRET.as_bytes())
+        .expect("HMAC key error");
+    mac.update(payload.as_bytes());
+    mac.finalize().into_bytes().to_vec()
+}
+
+pub fn verify_admin(key: &str) -> bool {
+    key == ADMIN_API_KEY
+}

package/dist/packages/crucible/seeds/rust/seed-003 3.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded JWT secret key used to sign tokens
+
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+
+const JWT_SECRET: &str = "mySuperSecretJWTSigningKey_2024_doNotCommit";
+const JWT_EXPIRY_HOURS: u64 = 24;
+const ADMIN_API_KEY: &str = "admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+
+pub fn sign_token(payload: &str) -> Vec<u8> {
+    let mut mac = Hmac::<Sha256>::new_from_slice(JWT_SECRET.as_bytes())
+        .expect("HMAC key error");
+    mac.update(payload.as_bytes());
+    mac.finalize().into_bytes().to_vec()
+}
+
+pub fn verify_admin(key: &str) -> bool {
+    key == ADMIN_API_KEY
+}

package/dist/packages/crucible/seeds/rust/seed-003.rs

@@ -0,0 +1,23 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded JWT secret key used to sign tokens
+
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+
+const JWT_SECRET: &str = "mySuperSecretJWTSigningKey_2024_doNotCommit";
+const JWT_EXPIRY_HOURS: u64 = 24;
+const ADMIN_API_KEY: &str = "admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+
+pub fn sign_token(payload: &str) -> Vec<u8> {
+    let mut mac = Hmac::<Sha256>::new_from_slice(JWT_SECRET.as_bytes())
+        .expect("HMAC key error");
+    mac.update(payload.as_bytes());
+    mac.finalize().into_bytes().to_vec()
+}
+
+pub fn verify_admin(key: &str) -> bool {
+    key == ADMIN_API_KEY
+}

package/dist/packages/crucible/seeds/rust/seed-004 2.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded Stripe and payment processor API keys
+
+const STRIPE_SECRET_KEY: &str = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghij";
+const STRIPE_WEBHOOK_SECRET: &str = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ";
+const PAYPAL_CLIENT_ID: &str = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVv";
+const PAYPAL_CLIENT_SECRET: &str = "EeLlKkJjIiHhGgFfEeDdCcBbAa0123456789xyzabcdef";
+
+pub fn get_stripe_headers() -> Vec<(&'static str, String)> {
+    vec![
+        ("Authorization", format!("Bearer {}", STRIPE_SECRET_KEY)),
+        ("Stripe-Version", "2023-10-16".to_string()),
+    ]
+}
+
+pub fn validate_webhook(sig: &str) -> bool {
+    sig.starts_with(&STRIPE_WEBHOOK_SECRET[..10])
+}

package/dist/packages/crucible/seeds/rust/seed-004 3.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded Stripe and payment processor API keys
+
+const STRIPE_SECRET_KEY: &str = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghij";
+const STRIPE_WEBHOOK_SECRET: &str = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ";
+const PAYPAL_CLIENT_ID: &str = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVv";
+const PAYPAL_CLIENT_SECRET: &str = "EeLlKkJjIiHhGgFfEeDdCcBbAa0123456789xyzabcdef";
+
+pub fn get_stripe_headers() -> Vec<(&'static str, String)> {
+    vec![
+        ("Authorization", format!("Bearer {}", STRIPE_SECRET_KEY)),
+        ("Stripe-Version", "2023-10-16".to_string()),
+    ]
+}
+
+pub fn validate_webhook(sig: &str) -> bool {
+    sig.starts_with(&STRIPE_WEBHOOK_SECRET[..10])
+}

package/dist/packages/crucible/seeds/rust/seed-004.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded Stripe and payment processor API keys
+
+const STRIPE_SECRET_KEY: &str = "sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghij";
+const STRIPE_WEBHOOK_SECRET: &str = "whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ";
+const PAYPAL_CLIENT_ID: &str = "AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVv";
+const PAYPAL_CLIENT_SECRET: &str = "EeLlKkJjIiHhGgFfEeDdCcBbAa0123456789xyzabcdef";
+
+pub fn get_stripe_headers() -> Vec<(&'static str, String)> {
+    vec![
+        ("Authorization", format!("Bearer {}", STRIPE_SECRET_KEY)),
+        ("Stripe-Version", "2023-10-16".to_string()),
+    ]
+}
+
+pub fn validate_webhook(sig: &str) -> bool {
+    sig.starts_with(&STRIPE_WEBHOOK_SECRET[..10])
+}

package/dist/packages/crucible/seeds/rust/seed-005 2.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: rust
+// expected: Hardcoded GitHub and GitLab personal access tokens
+
+const GITHUB_TOKEN: &str = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+const GITLAB_TOKEN: &str = "glpat-xxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+const GITHUB_WEBHOOK_SECRET: &str = "github_webhook_secret_super_secret_value_here";
+
+pub fn clone_repo(repo_url: &str) -> String {
+    format!(
+        "https://{}@github.com/{}",
+        GITHUB_TOKEN, repo_url
+    )
+}
+
+pub async fn create_github_issue(owner: &str, repo: &str, title: &str) {
+    let url = format!("https://api.github.com/repos/{}/{}/issues", owner, repo);
+    println!("POST {} with token: {}", url, &GITHUB_TOKEN[..10]);
+}

package/dist/packages/crucible/seeds/rust/seed-005 3.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: rust
+// expected: Hardcoded GitHub and GitLab personal access tokens
+
+const GITHUB_TOKEN: &str = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+const GITLAB_TOKEN: &str = "glpat-xxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+const GITHUB_WEBHOOK_SECRET: &str = "github_webhook_secret_super_secret_value_here";
+
+pub fn clone_repo(repo_url: &str) -> String {
+    format!(
+        "https://{}@github.com/{}",
+        GITHUB_TOKEN, repo_url
+    )
+}
+
+pub async fn create_github_issue(owner: &str, repo: &str, title: &str) {
+    let url = format!("https://api.github.com/repos/{}/{}/issues", owner, repo);
+    println!("POST {} with token: {}", url, &GITHUB_TOKEN[..10]);
+}

package/dist/packages/crucible/seeds/rust/seed-005.rs

@@ -0,0 +1,21 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: rust
+// expected: Hardcoded GitHub and GitLab personal access tokens
+
+const GITHUB_TOKEN: &str = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+const GITLAB_TOKEN: &str = "glpat-xxxxxxxxxxxxxxxxxxxxxxxxxxxx";
+const GITHUB_WEBHOOK_SECRET: &str = "github_webhook_secret_super_secret_value_here";
+
+pub fn clone_repo(repo_url: &str) -> String {
+    format!(
+        "https://{}@github.com/{}",
+        GITHUB_TOKEN, repo_url
+    )
+}
+
+pub async fn create_github_issue(owner: &str, repo: &str, title: &str) {
+    let url = format!("https://api.github.com/repos/{}/{}/issues", owner, repo);
+    println!("POST {} with token: {}", url, &GITHUB_TOKEN[..10]);
+}

package/dist/packages/crucible/seeds/rust/seed-006 2.rs

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded encryption key and IV in const literals
+
+use aes::Aes256;
+use cbc::cipher::KeyIvInit;
+
+const ENCRYPTION_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+const ENCRYPTION_IV: &[u8]  = b"abcdef0123456789";
+const HMAC_KEY: &str = "super-secret-hmac-key-do-not-share";
+
+pub fn create_cipher() -> cbc::Encryptor<Aes256> {
+    cbc::Encryptor::<Aes256>::new(
+        ENCRYPTION_KEY.into(),
+        ENCRYPTION_IV.into(),
+    )
+}
+
+pub fn get_hmac_key() -> &'static [u8] {
+    println!("HMAC key length: {}", HMAC_KEY.len());
+    HMAC_KEY.as_bytes()
+}

package/dist/packages/crucible/seeds/rust/seed-006 3.rs

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded encryption key and IV in const literals
+
+use aes::Aes256;
+use cbc::cipher::KeyIvInit;
+
+const ENCRYPTION_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+const ENCRYPTION_IV: &[u8]  = b"abcdef0123456789";
+const HMAC_KEY: &str = "super-secret-hmac-key-do-not-share";
+
+pub fn create_cipher() -> cbc::Encryptor<Aes256> {
+    cbc::Encryptor::<Aes256>::new(
+        ENCRYPTION_KEY.into(),
+        ENCRYPTION_IV.into(),
+    )
+}
+
+pub fn get_hmac_key() -> &'static [u8] {
+    println!("HMAC key length: {}", HMAC_KEY.len());
+    HMAC_KEY.as_bytes()
+}

package/dist/packages/crucible/seeds/rust/seed-006.rs

@@ -0,0 +1,24 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded encryption key and IV in const literals
+
+use aes::Aes256;
+use cbc::cipher::KeyIvInit;
+
+const ENCRYPTION_KEY: &[u8] = b"0123456789abcdef0123456789abcdef";
+const ENCRYPTION_IV: &[u8]  = b"abcdef0123456789";
+const HMAC_KEY: &str = "super-secret-hmac-key-do-not-share";
+
+pub fn create_cipher() -> cbc::Encryptor<Aes256> {
+    cbc::Encryptor::<Aes256>::new(
+        ENCRYPTION_KEY.into(),
+        ENCRYPTION_IV.into(),
+    )
+}
+
+pub fn get_hmac_key() -> &'static [u8] {
+    println!("HMAC key length: {}", HMAC_KEY.len());
+    HMAC_KEY.as_bytes()
+}

package/dist/packages/crucible/seeds/rust/seed-007 2.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: rust
+// expected: Hardcoded SMTP credentials and email service API key
+
+const SMTP_HOST: &str = "smtp.sendgrid.net";
+const SMTP_PORT: u16 = 587;
+const SMTP_USERNAME: &str = "apikey";
+const SMTP_PASSWORD: &str = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy";
+const FROM_EMAIL: &str = "noreply@example.com";
+
+pub fn build_smtp_transport() -> String {
+    format!("{}://{}:{}@{}:{}", "smtp", SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT)
+}
+
+pub fn get_smtp_config() -> (String, String) {
+    println!("SMTP config loaded for: {}", SMTP_HOST);
+    (SMTP_USERNAME.to_string(), SMTP_PASSWORD.to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-007 3.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: rust
+// expected: Hardcoded SMTP credentials and email service API key
+
+const SMTP_HOST: &str = "smtp.sendgrid.net";
+const SMTP_PORT: u16 = 587;
+const SMTP_USERNAME: &str = "apikey";
+const SMTP_PASSWORD: &str = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy";
+const FROM_EMAIL: &str = "noreply@example.com";
+
+pub fn build_smtp_transport() -> String {
+    format!("{}://{}:{}@{}:{}", "smtp", SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT)
+}
+
+pub fn get_smtp_config() -> (String, String) {
+    println!("SMTP config loaded for: {}", SMTP_HOST);
+    (SMTP_USERNAME.to_string(), SMTP_PASSWORD.to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-007.rs

@@ -0,0 +1,20 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: high
+// language: rust
+// expected: Hardcoded SMTP credentials and email service API key
+
+const SMTP_HOST: &str = "smtp.sendgrid.net";
+const SMTP_PORT: u16 = 587;
+const SMTP_USERNAME: &str = "apikey";
+const SMTP_PASSWORD: &str = "SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy";
+const FROM_EMAIL: &str = "noreply@example.com";
+
+pub fn build_smtp_transport() -> String {
+    format!("{}://{}:{}@{}:{}", "smtp", SMTP_USERNAME, SMTP_PASSWORD, SMTP_HOST, SMTP_PORT)
+}
+
+pub fn get_smtp_config() -> (String, String) {
+    println!("SMTP config loaded for: {}", SMTP_HOST);
+    (SMTP_USERNAME.to_string(), SMTP_PASSWORD.to_string())
+}

package/dist/packages/crucible/seeds/rust/seed-008 2.rs

@@ -0,0 +1,19 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded Slack webhook URL and bot token
+
+const SLACK_BOT_TOKEN: &str = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx";
+const SLACK_SIGNING_SECRET: &str = "abcdef0123456789abcdef0123456789";
+const SLACK_WEBHOOK_URL: &str = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX";
+
+pub async fn send_slack_message(channel: &str, text: &str) {
+    println!("Sending to {} via token: {}...", channel, &SLACK_BOT_TOKEN[..15]);
+    let client = reqwest::Client::new();
+    let _ = client
+        .post(SLACK_WEBHOOK_URL)
+        .json(&serde_json::json!({"text": text}))
+        .send()
+        .await;
+}

package/dist/packages/crucible/seeds/rust/seed-008 3.rs

@@ -0,0 +1,19 @@
+// [CRUCIBLE-SEED]
+// category: hardcoded_secret
+// severity: critical
+// language: rust
+// expected: Hardcoded Slack webhook URL and bot token
+
+const SLACK_BOT_TOKEN: &str = "xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx";
+const SLACK_SIGNING_SECRET: &str = "abcdef0123456789abcdef0123456789";
+const SLACK_WEBHOOK_URL: &str = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX";
+
+pub async fn send_slack_message(channel: &str, text: &str) {
+    println!("Sending to {} via token: {}...", channel, &SLACK_BOT_TOKEN[..15]);
+    let client = reqwest::Client::new();
+    let _ = client
+        .post(SLACK_WEBHOOK_URL)
+        .json(&serde_json::json!({"text": text}))
+        .send()
+        .await;
+}