thuban 0.3.4 → 0.4.0

package/dist/packages/crucible/seeds/python/seed-051.py

@@ -0,0 +1,38 @@
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() with untrusted input — arbitrary code execution via YAML deserialization
+
+import yaml
+from flask import Flask, request, jsonify
+
+app = Flask(__name__)
+
+
+@app.route("/config/upload", methods=["POST"])
+def upload_config():
+    raw_yaml = request.data.decode("utf-8")
+    # yaml.load without Loader= defaults to full deserialization — RCE possible
+    # Attacker payload: "!!python/object/apply:os.system ['id']"
+    config = yaml.load(raw_yaml)
+    return jsonify({"loaded_keys": list(config.keys()) if isinstance(config, dict) else []})
+
+
+@app.route("/workflow/import", methods=["POST"])
+def import_workflow():
+    yaml_content = request.get_json().get("yaml", "")
+    # yaml.load with untrusted string
+    workflow = yaml.load(yaml_content)
+    steps = workflow.get("steps", []) if isinstance(workflow, dict) else []
+    return jsonify({"steps": steps})
+
+
+@app.route("/settings/restore", methods=["POST"])
+def restore_settings():
+    uploaded = request.files.get("settings")
+    if not uploaded:
+        return jsonify({"error": "No file"}), 400
+    content = uploaded.read().decode("utf-8")
+    settings = yaml.load(content)  # unsafe loader
+    return jsonify({"restored": True, "settings": settings})

package/dist/packages/crucible/seeds/python/seed-052 2.py

@@ -0,0 +1,41 @@
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() without safe_load — RCE via !!python/object tags in YAML
+
+import yaml
+import os
+from pathlib import Path
+
+
+def load_pipeline_config(config_path: str) -> dict:
+    """Load a pipeline configuration from a YAML file."""
+    with open(config_path, "r") as f:
+        # yaml.load() without Loader allows arbitrary Python object instantiation
+        # Attacker-controlled config file: !!python/object/apply:subprocess.check_output [['id']]
+        return yaml.load(f)
+
+
+def load_user_preferences(user_id: str) -> dict:
+    prefs_path = Path(f"/var/app/preferences/{user_id}.yaml")
+    if not prefs_path.exists():
+        return {}
+    with prefs_path.open() as f:
+        # User controls their own preference file — YAML injection if file content is user-controlled
+        return yaml.load(f.read())
+
+
+def merge_configs(*config_paths: str) -> dict:
+    merged = {}
+    for path in config_paths:
+        with open(path) as f:
+            data = yaml.load(f)  # unsafe
+            if isinstance(data, dict):
+                merged.update(data)
+    return merged
+
+
+def parse_webhook_payload(yaml_str: str) -> dict:
+    # Webhook body parsed as YAML without safe_load
+    return yaml.load(yaml_str)

package/dist/packages/crucible/seeds/python/seed-052 3.py

@@ -0,0 +1,41 @@
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() without safe_load — RCE via !!python/object tags in YAML
+
+import yaml
+import os
+from pathlib import Path
+
+
+def load_pipeline_config(config_path: str) -> dict:
+    """Load a pipeline configuration from a YAML file."""
+    with open(config_path, "r") as f:
+        # yaml.load() without Loader allows arbitrary Python object instantiation
+        # Attacker-controlled config file: !!python/object/apply:subprocess.check_output [['id']]
+        return yaml.load(f)
+
+
+def load_user_preferences(user_id: str) -> dict:
+    prefs_path = Path(f"/var/app/preferences/{user_id}.yaml")
+    if not prefs_path.exists():
+        return {}
+    with prefs_path.open() as f:
+        # User controls their own preference file — YAML injection if file content is user-controlled
+        return yaml.load(f.read())
+
+
+def merge_configs(*config_paths: str) -> dict:
+    merged = {}
+    for path in config_paths:
+        with open(path) as f:
+            data = yaml.load(f)  # unsafe
+            if isinstance(data, dict):
+                merged.update(data)
+    return merged
+
+
+def parse_webhook_payload(yaml_str: str) -> dict:
+    # Webhook body parsed as YAML without safe_load
+    return yaml.load(yaml_str)

package/dist/packages/crucible/seeds/python/seed-052.py

@@ -0,0 +1,41 @@
+# [CRUCIBLE-SEED]
+# category: yaml_injection
+# severity: critical
+# language: python
+# expected: yaml.load() without safe_load — RCE via !!python/object tags in YAML
+
+import yaml
+import os
+from pathlib import Path
+
+
+def load_pipeline_config(config_path: str) -> dict:
+    """Load a pipeline configuration from a YAML file."""
+    with open(config_path, "r") as f:
+        # yaml.load() without Loader allows arbitrary Python object instantiation
+        # Attacker-controlled config file: !!python/object/apply:subprocess.check_output [['id']]
+        return yaml.load(f)
+
+
+def load_user_preferences(user_id: str) -> dict:
+    prefs_path = Path(f"/var/app/preferences/{user_id}.yaml")
+    if not prefs_path.exists():
+        return {}
+    with prefs_path.open() as f:
+        # User controls their own preference file — YAML injection if file content is user-controlled
+        return yaml.load(f.read())
+
+
+def merge_configs(*config_paths: str) -> dict:
+    merged = {}
+    for path in config_paths:
+        with open(path) as f:
+            data = yaml.load(f)  # unsafe
+            if isinstance(data, dict):
+                merged.update(data)
+    return merged
+
+
+def parse_webhook_payload(yaml_str: str) -> dict:
+    # Webhook body parsed as YAML without safe_load
+    return yaml.load(yaml_str)

package/dist/packages/crucible/seeds/ruby/seed-001 2.rb

@@ -0,0 +1,15 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Rails secret_key_base in source code
+
+module MyApp
+  class Application < Rails::Application
+    config.secret_key_base = "b3f6d9e2a1c4f7a8b9d0e1f2a3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
+
+    config.active_record.encryption.primary_key   = "my_primary_encryption_key_not_secret"
+    config.active_record.encryption.deterministic_key = "my_deterministic_key_not_secret_too"
+    config.active_record.encryption.key_derivation_salt = "my_key_derivation_salt_hardcoded"
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-001 3.rb

@@ -0,0 +1,15 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Rails secret_key_base in source code
+
+module MyApp
+  class Application < Rails::Application
+    config.secret_key_base = "b3f6d9e2a1c4f7a8b9d0e1f2a3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
+
+    config.active_record.encryption.primary_key   = "my_primary_encryption_key_not_secret"
+    config.active_record.encryption.deterministic_key = "my_deterministic_key_not_secret_too"
+    config.active_record.encryption.key_derivation_salt = "my_key_derivation_salt_hardcoded"
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-001.rb

@@ -0,0 +1,15 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Rails secret_key_base in source code
+
+module MyApp
+  class Application < Rails::Application
+    config.secret_key_base = "b3f6d9e2a1c4f7a8b9d0e1f2a3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2"
+
+    config.active_record.encryption.primary_key   = "my_primary_encryption_key_not_secret"
+    config.active_record.encryption.deterministic_key = "my_deterministic_key_not_secret_too"
+    config.active_record.encryption.key_derivation_salt = "my_key_derivation_salt_hardcoded"
+  end
+end

package/dist/packages/crucible/seeds/ruby/seed-002 2.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded database password in database.yml equivalent or initializer
+
+DB_CONFIG = {
+  adapter:  'postgresql',
+  host:     'prod-db.example.com',
+  database: 'production_db',
+  username: 'app_user',
+  password: 'Sup3rS3cr3tP@ssw0rd!2024',
+  port:     5432
+}.freeze
+
+REDIS_URL = 'redis://:myR3d1sS3cret@redis.prod.example.com:6379/0'
+MONGO_URI = 'mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb'
+
+def establish_db_connection
+  puts "Connecting with password: #{DB_CONFIG[:password]}"
+  ActiveRecord::Base.establish_connection(DB_CONFIG)
+end

package/dist/packages/crucible/seeds/ruby/seed-002 3.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded database password in database.yml equivalent or initializer
+
+DB_CONFIG = {
+  adapter:  'postgresql',
+  host:     'prod-db.example.com',
+  database: 'production_db',
+  username: 'app_user',
+  password: 'Sup3rS3cr3tP@ssw0rd!2024',
+  port:     5432
+}.freeze
+
+REDIS_URL = 'redis://:myR3d1sS3cret@redis.prod.example.com:6379/0'
+MONGO_URI = 'mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb'
+
+def establish_db_connection
+  puts "Connecting with password: #{DB_CONFIG[:password]}"
+  ActiveRecord::Base.establish_connection(DB_CONFIG)
+end

package/dist/packages/crucible/seeds/ruby/seed-002.rb

@@ -0,0 +1,22 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded database password in database.yml equivalent or initializer
+
+DB_CONFIG = {
+  adapter:  'postgresql',
+  host:     'prod-db.example.com',
+  database: 'production_db',
+  username: 'app_user',
+  password: 'Sup3rS3cr3tP@ssw0rd!2024',
+  port:     5432
+}.freeze
+
+REDIS_URL = 'redis://:myR3d1sS3cret@redis.prod.example.com:6379/0'
+MONGO_URI = 'mongodb://admin:M0ng0P@ssw0rd@mongo.example.com:27017/proddb'
+
+def establish_db_connection
+  puts "Connecting with password: #{DB_CONFIG[:password]}"
+  ActiveRecord::Base.establish_connection(DB_CONFIG)
+end

package/dist/packages/crucible/seeds/ruby/seed-003 2.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded AWS credentials in Ruby initializer
+
+require 'aws-sdk-s3'
+
+AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1'
+AWS_SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+AWS_REGION     = 'us-east-1'
+S3_BUCKET      = 'my-production-bucket'
+
+Aws.config.update(
+  region:      AWS_REGION,
+  credentials: Aws::Credentials.new(AWS_ACCESS_KEY, AWS_SECRET_KEY)
+)
+
+def s3_client
+  Aws::S3::Client.new(
+    access_key_id:     AWS_ACCESS_KEY,
+    secret_access_key: AWS_SECRET_KEY,
+    region:            AWS_REGION
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-003 3.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded AWS credentials in Ruby initializer
+
+require 'aws-sdk-s3'
+
+AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1'
+AWS_SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+AWS_REGION     = 'us-east-1'
+S3_BUCKET      = 'my-production-bucket'
+
+Aws.config.update(
+  region:      AWS_REGION,
+  credentials: Aws::Credentials.new(AWS_ACCESS_KEY, AWS_SECRET_KEY)
+)
+
+def s3_client
+  Aws::S3::Client.new(
+    access_key_id:     AWS_ACCESS_KEY,
+    secret_access_key: AWS_SECRET_KEY,
+    region:            AWS_REGION
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-003.rb

@@ -0,0 +1,25 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded AWS credentials in Ruby initializer
+
+require 'aws-sdk-s3'
+
+AWS_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE1'
+AWS_SECRET_KEY = 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+AWS_REGION     = 'us-east-1'
+S3_BUCKET      = 'my-production-bucket'
+
+Aws.config.update(
+  region:      AWS_REGION,
+  credentials: Aws::Credentials.new(AWS_ACCESS_KEY, AWS_SECRET_KEY)
+)
+
+def s3_client
+  Aws::S3::Client.new(
+    access_key_id:     AWS_ACCESS_KEY,
+    secret_access_key: AWS_SECRET_KEY,
+    region:            AWS_REGION
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-004 2.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Stripe API keys in Rails initializer
+
+Stripe.api_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
+
+STRIPE_CONFIG = {
+  publishable_key: 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu',
+  webhook_secret:  'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ',
+  api_key:         'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
+}.freeze
+
+def charge_customer(amount, token)
+  Stripe::Charge.create(amount: amount, currency: 'usd', source: token)
+end

package/dist/packages/crucible/seeds/ruby/seed-004 3.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Stripe API keys in Rails initializer
+
+Stripe.api_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
+
+STRIPE_CONFIG = {
+  publishable_key: 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu',
+  webhook_secret:  'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ',
+  api_key:         'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
+}.freeze
+
+def charge_customer(amount, token)
+  Stripe::Charge.create(amount: amount, currency: 'usd', source: token)
+end

package/dist/packages/crucible/seeds/ruby/seed-004.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Stripe API keys in Rails initializer
+
+Stripe.api_key = 'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
+
+STRIPE_CONFIG = {
+  publishable_key: 'pk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321zyxwvu',
+  webhook_secret:  'whsec_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ',
+  api_key:         'sk_live_51HxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefgh'
+}.freeze
+
+def charge_customer(amount, token)
+  Stripe::Charge.create(amount: amount, currency: 'usd', source: token)
+end

package/dist/packages/crucible/seeds/ruby/seed-005 2.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: ruby
+# expected: Hardcoded JWT secret and admin API token
+
+JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
+ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'
+
+def generate_jwt(payload)
+  JWT.encode(payload, JWT_SECRET, 'HS256')
+end
+
+def verify_admin(token)
+  token == ADMIN_TOKEN
+end
+
+def sign_request(body)
+  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
+end

package/dist/packages/crucible/seeds/ruby/seed-005 3.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: ruby
+# expected: Hardcoded JWT secret and admin API token
+
+JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
+ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'
+
+def generate_jwt(payload)
+  JWT.encode(payload, JWT_SECRET, 'HS256')
+end
+
+def verify_admin(token)
+  token == ADMIN_TOKEN
+end
+
+def sign_request(body)
+  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
+end

package/dist/packages/crucible/seeds/ruby/seed-005.rb

@@ -0,0 +1,21 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: high
+# language: ruby
+# expected: Hardcoded JWT secret and admin API token
+
+JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
+ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'
+
+def generate_jwt(payload)
+  JWT.encode(payload, JWT_SECRET, 'HS256')
+end
+
+def verify_admin(token)
+  token == ADMIN_TOKEN
+end
+
+def sign_request(body)
+  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
+end

package/dist/packages/crucible/seeds/ruby/seed-006 2.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded OAuth client secret and social login credentials
+
+GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
+GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
+GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
+
+OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
+end

package/dist/packages/crucible/seeds/ruby/seed-006 3.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded OAuth client secret and social login credentials
+
+GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
+GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
+GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
+
+OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
+end

package/dist/packages/crucible/seeds/ruby/seed-006.rb

@@ -0,0 +1,17 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded OAuth client secret and social login credentials
+
+GOOGLE_CLIENT_ID     = '1234567890-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com'
+GOOGLE_CLIENT_SECRET = 'GOCSPX-abcdefghijklmnopqrstuvwxyz123456'
+GITHUB_CLIENT_SECRET = 'ghsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+FACEBOOK_APP_SECRET  = 'abcdef0123456789abcdef0123456789'
+
+OmniAuth.config.on_failure = proc { |env| OmniAuth::FailureEndpoint.call(env) }
+
+Rails.application.config.middleware.use OmniAuth::Builder do
+  provider :google_oauth2, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET
+  provider :github,        'github_client_id_xxxxx', GITHUB_CLIENT_SECRET
+end

package/dist/packages/crucible/seeds/ruby/seed-007 2.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Twilio credentials and SendGrid API key
+
+TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
+TWILIO_PHONE       = '+15005550006'
+SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
+
+def send_sms(to, message)
+  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
+  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
+  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
+end

package/dist/packages/crucible/seeds/ruby/seed-007 3.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Twilio credentials and SendGrid API key
+
+TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
+TWILIO_PHONE       = '+15005550006'
+SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
+
+def send_sms(to, message)
+  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
+  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
+  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
+end

package/dist/packages/crucible/seeds/ruby/seed-007.rb

@@ -0,0 +1,16 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Twilio credentials and SendGrid API key
+
+TWILIO_ACCOUNT_SID = 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+TWILIO_AUTH_TOKEN  = 'your_auth_token_here_32chars_long!!'
+TWILIO_PHONE       = '+15005550006'
+SENDGRID_API_KEY   = 'SG.xxxxxxxxxxxxxxxxxxxxxxxxxxxx.yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'
+
+def send_sms(to, message)
+  puts "Using SID: #{TWILIO_ACCOUNT_SID}, Token: #{TWILIO_AUTH_TOKEN}"
+  client = Twilio::REST::Client.new(TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN)
+  client.messages.create(from: TWILIO_PHONE, to: to, body: message)
+end

package/dist/packages/crucible/seeds/ruby/seed-008 2.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Slack webhook URL and signing secret
+
+SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
+SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
+SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
+
+def post_to_slack(message)
+  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
+  Net::HTTP.post(
+    URI(SLACK_WEBHOOK_URL),
+    { text: message }.to_json,
+    'Content-Type' => 'application/json'
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-008 3.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Slack webhook URL and signing secret
+
+SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
+SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
+SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
+
+def post_to_slack(message)
+  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
+  Net::HTTP.post(
+    URI(SLACK_WEBHOOK_URL),
+    { text: message }.to_json,
+    'Content-Type' => 'application/json'
+  )
+end

package/dist/packages/crucible/seeds/ruby/seed-008.rb

@@ -0,0 +1,18 @@
+# [CRUCIBLE-SEED]
+# category: hardcoded_secret
+# severity: critical
+# language: ruby
+# expected: Hardcoded Slack webhook URL and signing secret
+
+SLACK_BOT_TOKEN     = 'xoxb-1234567890-1234567890123-abcdefghijklmnopqrstuvwx'
+SLACK_SIGNING_SECRET = 'abcdef0123456789abcdef0123456789'
+SLACK_WEBHOOK_URL   = 'https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'
+
+def post_to_slack(message)
+  puts "Posting with token: #{SLACK_BOT_TOKEN[0..14]}..."
+  Net::HTTP.post(
+    URI(SLACK_WEBHOOK_URL),
+    { text: message }.to_json,
+    'Content-Type' => 'application/json'
+  )
+end