thuban 0.4.3 → 0.4.6

package/dist/packages/crucible/mutation-engine.js

@@ -1 +1 @@
-"use strict";const fs=require("fs"),path=require("path"),os=require("os"),crypto=require("crypto"),MUTATIONS=[{name:"operator_flip_eq",description:"Replace === with == (loose equality — security bypass risk)",apply:e=>e.replace(/===/g,"==").replace(/!==/g,"!=")},{name:"operator_flip_and",description:"Replace && with & (bitwise — can bypass auth checks)",apply:e=>e.replace(/if\s*\(([^)]+)\)/g,(e,t)=>"if ("+t.replace(/&&/g,"&")+")")},{name:"operator_flip_or",description:"Replace || with | (bitwise — default value bypass)",apply:e=>e.replace(/if\s*\(([^)]+)\)/g,(e,t)=>"if ("+t.replace(/\|\|/g,"|")+")")},{name:"string_concat_to_template",description:'Convert "a" + b to `a${b}` (template literal — SQL injection risk)',apply:e=>e.replace(/"([^"]{1,40}?)"\s*\+\s*(\w+)/g,(e,t,s)=>"`"+t+"${"+s+"}`")},{name:"string_split_concat",description:"Split a hardcoded string across two literals (obfuscation)",apply:e=>e.replace(/'([a-zA-Z0-9_\-]{8,24})'/g,(e,t)=>{const s=Math.floor(t.length/2);return`'${t.slice(0,s)}' + '${t.slice(s)}'`})},{name:"base64_encode_string",description:'Wrap a string value in Buffer.from().toString("base64") (obfuscation)',apply:(e,t)=>["js","ts","javascript","typescript"].includes(t)?e.replace(/'(password|secret|key|token|api_?key)':\s*'([^']+)'/gi,(e,t,s)=>`'${t}': Buffer.from('${Buffer.from(s).toString("base64")}', 'base64').toString('utf8')`):e},{name:"require_to_dynamic_import",description:"Convert require() to eval-based dynamic require (evades static analysis)",apply(e,t){if(!["js","javascript"].includes(t))return e;let s=0;return e.replace(/require\('([^']+)'\)/g,(e,t)=>s++>0?e:`eval("require")('${t}')`)}},{name:"import_alias_obfuscation",description:"Add an alias variable to obscure dangerous function names",apply(e,t){if(!["js","ts","javascript","typescript"].includes(t))return e;if(/\bexecSync\b/.test(e)){const t="_"+crypto.randomBytes(3).toString("hex");e=(e="const "+t+' = require("child_process").execSync;\n'+e).replace(/\bexecSync\b/g,t)}return e}},{name:"if_negation_flip",description:"Flip if/else branches (may invert security checks)",apply:e=>e.replace(/if\s*\(!\s*(\w+)\)\s*\{([^}]*)\}\s*else\s*\{([^}]*)\}/g,(e,t,s,n)=>`if (${t}) {${n}} else {${s}}`)},{name:"early_return_removal",description:"Remove early return guards (bypass validation)",apply:e=>e.replace(/^\s*if\s*\([^)]+\)\s*\{\s*return\s*(?:null|false|undefined|0|''|"")?\s*;\s*\}\s*$/gm,"")},{name:"async_await_strip",description:"Remove await from async calls (timing/race condition potential)",apply:e=>e.replace(/const\s+(\w+)\s*=\s*await\s+/g,"const $1 = ")},{name:"todo_injection",description:"Add misleading TODO/SAFE comments near vulnerable code",apply(e){const t=["// TODO: add validation here later","// SAFE: this is sanitized upstream","// SECURITY: reviewed by team — OK","// NOTE: user input is trusted at this point"],s=Math.floor(t.length/2),n=e.split("\n");return n.splice(Math.min(5,n.length-1),0,t[s]),n.join("\n")}},{name:"variable_rename_obfuscate",description:"Rename obvious danger variables to innocuous names",apply(e){const t=[[/\bexecCommand\b/g,"processInput"],[/\bsqlQuery\b/g,"queryStr"],[/\brawInput\b/g,"data"],[/\buserInput\b/g,"val"],[/\bpassword\b/g,"pwd"]];for(const[s,n]of t)e=e.replace(s,n);return e}},{name:"dead_code_injection",description:"Inject plausible-looking but unreachable safe code",apply:e=>e+"\n\n// Dead code: sanitization that never runs\nfunction _sanitize(input) {\n  return String(input).replace(/[<>\"';&]/g, '');\n}\n"},{name:"hex_string_encoding",description:"Encode a dangerous string value as hex (evades simple pattern matching)",apply:(e,t)=>["js","javascript","ts","typescript"].includes(t)?e.replace(/'(SELECT|INSERT|UPDATE|DELETE|DROP|UNION)([^']{0,30})'/gi,(e,t,s)=>{const n=t+s;return`Buffer.from('${Buffer.from(n).toString("hex")}', 'hex').toString()`}):e},{name:"prototype_chain_obfuscate",description:"Use bracket notation to access __proto__ (avoids literal detection)",apply:e=>e.replace(/\.__proto__/g,'["__proto__"]').replace(/\.constructor\.prototype/g,'["constructor"]["prototype"]')},{name:"path_concat_to_join",description:"Convert path concatenation to path.join (still traversable)",apply:e=>e.replace(/(\w+)\s*\+\s*(['"]\/[^'"]+['"])/g,"path.join($1, $2)")}];class MutationEngine{constructor(e={}){this.prngseed="number"==typeof e.prngseed?e.prngseed:42,this.maxMutationsPerFile=e.maxMutationsPerFile||3,this._sessionDir=null}createSession(){if(!this._sessionDir){const e=crypto.randomUUID?crypto.randomUUID():crypto.randomBytes(16).toString("hex");this._sessionDir=path.join(os.tmpdir(),`thuban-crucible-${e}`),fs.mkdirSync(this._sessionDir,{recursive:!0})}return this._sessionDir}cleanup(){if(this._sessionDir&&fs.existsSync(this._sessionDir)){try{fs.rmSync(this._sessionDir,{recursive:!0,force:!0})}catch{}this._sessionDir=null}}_createPRNG(){let e=this.prngseed>>>0;return function(){e|=0,e=e+1831565813|0;let t=Math.imul(e^e>>>15,1|e);return t=t+Math.imul(t^t>>>7,61|t)^t,((t^t>>>14)>>>0)/4294967296}}_pickMutations(e,t){const s=MUTATIONS.slice();for(let t=s.length-1;t>0;t--){const n=Math.floor(e()*(t+1));[s[t],s[n]]=[s[n],s[t]]}return s.slice(0,t)}_detectLang(e){return{".js":"js",".mjs":"js",".cjs":"js",".ts":"ts",".tsx":"ts",".py":"python",".java":"java",".cs":"csharp",".go":"go",".kt":"kotlin",".kts":"kotlin",".rs":"rust",".php":"php",".rb":"ruby"}[path.extname(e).toLowerCase()]||"unknown"}applyMutation(e,t,s="js"){const n=MUTATIONS.find(e=>e.name===t);if(!n)throw new Error(`Unknown mutation: ${t}`);try{return n.apply(e,s)}catch{return e}}applyRandomMutations(e,t="js",s){const n=null!=s?s:this.maxMutationsPerFile,a=this._createPRNG(),i=this._pickMutations(a,n),r=[];let o=e;for(const e of i)try{const s=e.apply(o,t);s!==o&&(r.push(e.name),o=s)}catch{}return{mutatedCode:o,applied:r}}mutateFile(e,t={}){const s=this.createSession(),n=this._detectLang(e),a=fs.readFileSync(e,"utf-8");let i,r;if(t.only&&t.only.length){r=a,i=[];for(const e of t.only){const t=this.applyMutation(r,e,n);t!==r&&i.push(e),r=t}}else{const e=this.applyRandomMutations(a,n,t.mutations);r=e.mutatedCode,i=e.applied}const o=path.basename(e),p=path.parse(o).name,c=path.extname(o),l=`${p}-mutated-${crypto.randomBytes(3).toString("hex")}${c}`,u=path.join(s,l);return fs.writeFileSync(u,r,"utf-8"),{tempPath:u,applied:i,lang:n,original:a,mutated:r}}async mutateFiles(e,t){this.createSession();const s=[];try{for(const t of e)try{const e=this.mutateFile(t);s.push({...e,error:null})}catch(e){s.push({tempPath:null,applied:[],lang:null,error:e.message})}return await t(s)}finally{this.cleanup()}}static listMutations(){return MUTATIONS.map(e=>({name:e.name,description:e.description}))}static get mutationCount(){return MUTATIONS.length}}module.exports={MutationEngine:MutationEngine,MUTATIONS:MUTATIONS};
+"use strict";const fs=require("fs"),path=require("path"),os=require("os"),crypto=require("crypto"),MUTATIONS=[{name:"operator_flip_eq",description:"Replace === with == (loose equality — security bypass risk)",apply:e=>e.replace(/===/g,"==").replace(/!==/g,"!=")},{name:"operator_flip_and",description:"Replace && with & (bitwise — can bypass auth checks)",apply:e=>e.replace(/if\s*\(([^)]+)\)/g,(e,t)=>"if ("+t.replace(/&&/g,"&")+")")},{name:"operator_flip_or",description:"Replace || with | (bitwise — default value bypass)",apply:e=>e.replace(/if\s*\(([^)]+)\)/g,(e,t)=>"if ("+t.replace(/\|\|/g,"|")+")")},{name:"string_concat_to_template",description:'Convert "a" + b to `a${b}` (template literal — SQL injection risk)',apply:e=>e.replace(/"([^"]{1,40}?)"\s*\+\s*(\w+)/g,(e,t,s)=>"`"+t+"${"+s+"}`")},{name:"string_split_concat",description:"Split a hardcoded string across two literals (obfuscation)",apply:e=>e.replace(/'([a-zA-Z0-9_\-]{8,24})'/g,(e,t)=>{const s=Math.floor(t.length/2);return`'${t.slice(0,s)}' + '${t.slice(s)}'`})},{name:"base64_encode_string",description:'Wrap a string value in Buffer.from().toString("base64") (obfuscation)',apply:(e,t)=>["js","ts","javascript","typescript"].includes(t)?e.replace(/'(password|secret|key|token|api_?key)':\s*'([^']+)'/gi,(e,t,s)=>`'${t}': Buffer.from('${Buffer.from(s).toString("base64")}', 'base64').toString('utf8')`):e},{name:"require_to_dynamic_import",description:"Convert require() to eval-based dynamic require (evades static analysis)",apply(e,t){if(!["js","javascript"].includes(t))return e;let s=0;return e.replace(/require\('([^']+)'\)/g,(e,t)=>s++>0?e:`eval("require")('${t}')`)}},{name:"import_alias_obfuscation",description:"Add an alias variable to obscure dangerous function names",apply(e,t){if(!["js","ts","javascript","typescript"].includes(t))return e;if(/\bexecSync\b/.test(e)){const t="_"+crypto.randomBytes(3).toString("hex");e=(e="const "+t+' = require("child_process").execSync;\n'+e).replace(/\bexecSync\b/g,t)}return e}},{name:"if_negation_flip",description:"Flip if/else branches (may invert security checks)",apply:e=>e.replace(/if\s*\(!\s*(\w+)\)\s*\{([^}]*)\}\s*else\s*\{([^}]*)\}/g,(e,t,s,n)=>`if (${t}) {${n}} else {${s}}`)},{name:"early_return_removal",description:"Remove early return guards (bypass validation)",apply:e=>e.replace(/^\s*if\s*\([^)]+\)\s*\{\s*return\s*(?:null|false|undefined|0|''|"")?\s*;\s*\}\s*$/gm,"")},{name:"async_await_strip",description:"Remove await from async calls (timing/race condition potential)",apply:e=>e.replace(/const\s+(\w+)\s*=\s*await\s+/g,"const $1 = ")},{name:"todo_injection",description:"Add misleading TODO/SAFE comments near vulnerable code",apply(e){const t=["// TODO: add validation here later","// SAFE: this is sanitized upstream","// SECURITY: reviewed by team — OK","// NOTE: user input is trusted at this point"],s=Math.floor(t.length/2),n=e.split(/\r?\n/);return n.splice(Math.min(5,n.length-1),0,t[s]),n.join("\n")}},{name:"variable_rename_obfuscate",description:"Rename obvious danger variables to innocuous names",apply(e){const t=[[/\bexecCommand\b/g,"processInput"],[/\bsqlQuery\b/g,"queryStr"],[/\brawInput\b/g,"data"],[/\buserInput\b/g,"val"],[/\bpassword\b/g,"pwd"]];for(const[s,n]of t)e=e.replace(s,n);return e}},{name:"dead_code_injection",description:"Inject plausible-looking but unreachable safe code",apply:e=>e+"\n\n// Dead code: sanitization that never runs\nfunction _sanitize(input) {\n  return String(input).replace(/[<>\"';&]/g, '');\n}\n"},{name:"hex_string_encoding",description:"Encode a dangerous string value as hex (evades simple pattern matching)",apply:(e,t)=>["js","javascript","ts","typescript"].includes(t)?e.replace(/'(SELECT|INSERT|UPDATE|DELETE|DROP|UNION)([^']{0,30})'/gi,(e,t,s)=>{const n=t+s;return`Buffer.from('${Buffer.from(n).toString("hex")}', 'hex').toString()`}):e},{name:"prototype_chain_obfuscate",description:"Use bracket notation to access __proto__ (avoids literal detection)",apply:e=>e.replace(/\.__proto__/g,'["__proto__"]').replace(/\.constructor\.prototype/g,'["constructor"]["prototype"]')},{name:"path_concat_to_join",description:"Convert path concatenation to path.join (still traversable)",apply:e=>e.replace(/(\w+)\s*\+\s*(['"]\/[^'"]+['"])/g,"path.join($1, $2)")}];class MutationEngine{constructor(e={}){this.prngseed="number"==typeof e.prngseed?e.prngseed:42,this.maxMutationsPerFile=e.maxMutationsPerFile||3,this._sessionDir=null}createSession(){if(!this._sessionDir){const e=crypto.randomUUID?crypto.randomUUID():crypto.randomBytes(16).toString("hex");this._sessionDir=path.join(os.tmpdir(),`thuban-crucible-${e}`),fs.mkdirSync(this._sessionDir,{recursive:!0})}return this._sessionDir}cleanup(){if(this._sessionDir&&fs.existsSync(this._sessionDir)){try{fs.rmSync(this._sessionDir,{recursive:!0,force:!0})}catch{}this._sessionDir=null}}_createPRNG(){let e=this.prngseed>>>0;return function(){e|=0,e=e+1831565813|0;let t=Math.imul(e^e>>>15,1|e);return t=t+Math.imul(t^t>>>7,61|t)^t,((t^t>>>14)>>>0)/4294967296}}_pickMutations(e,t){const s=MUTATIONS.slice();for(let t=s.length-1;t>0;t--){const n=Math.floor(e()*(t+1));[s[t],s[n]]=[s[n],s[t]]}return s.slice(0,t)}_detectLang(e){return{".js":"js",".mjs":"js",".cjs":"js",".ts":"ts",".tsx":"ts",".py":"python",".java":"java",".cs":"csharp",".go":"go",".kt":"kotlin",".kts":"kotlin",".rs":"rust",".php":"php",".rb":"ruby"}[path.extname(e).toLowerCase()]||"unknown"}applyMutation(e,t,s="js"){const n=MUTATIONS.find(e=>e.name===t);if(!n)throw new Error(`Unknown mutation: ${t}`);try{return n.apply(e,s)}catch{return e}}applyRandomMutations(e,t="js",s){const n=null!=s?s:this.maxMutationsPerFile,a=this._createPRNG(),i=this._pickMutations(a,n),r=[];let o=e;for(const e of i)try{const s=e.apply(o,t);s!==o&&(r.push(e.name),o=s)}catch{}return{mutatedCode:o,applied:r}}mutateFile(e,t={}){const s=this.createSession(),n=this._detectLang(e),a=fs.readFileSync(e,"utf-8").replace(/\r\n/g,"\n");let i,r;if(t.only&&t.only.length){r=a,i=[];for(const e of t.only){const t=this.applyMutation(r,e,n);t!==r&&i.push(e),r=t}}else{const e=this.applyRandomMutations(a,n,t.mutations);r=e.mutatedCode,i=e.applied}const o=path.basename(e),p=path.parse(o).name,c=path.extname(o),l=`${p}-mutated-${crypto.randomBytes(3).toString("hex")}${c}`,u=path.join(s,l);return fs.writeFileSync(u,r,"utf-8"),{tempPath:u,applied:i,lang:n,original:a,mutated:r}}async mutateFiles(e,t){this.createSession();const s=[];try{for(const t of e)try{const e=this.mutateFile(t);s.push({...e,error:null})}catch(e){s.push({tempPath:null,applied:[],lang:null,error:e.message})}return await t(s)}finally{this.cleanup()}}static listMutations(){return MUTATIONS.map(e=>({name:e.name,description:e.description}))}static get mutationCount(){return MUTATIONS.length}}module.exports={MutationEngine:MutationEngine,MUTATIONS:MUTATIONS};

package/dist/packages/crucible/pattern-learner.js

@@ -1 +1 @@
-"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),COMMUNITY_FILENAME="community-discovered.json",COMMUNITY_FILE=path.join(RULES_DIR,COMMUNITY_FILENAME),MISSED_PATTERNS_FILE=path.join(__dirname,"missed-patterns.json"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;class PatternLearner{constructor(e={}){this.rulesDir=e.rulesDir||RULES_DIR,this.communityFile=e.communityFile||path.join(this.rulesDir,COMMUNITY_FILENAME),this.missedPatternsFile=e.missedPatternsFile||MISSED_PATTERNS_FILE}_readJsonArray(e){if(!fs.existsSync(e))return[];try{const t=JSON.parse(fs.readFileSync(e,"utf-8"));if(!Array.isArray(t))return[];for(const e of t)e&&"object"==typeof e&&(delete e.__proto__,delete e.constructor,delete e.prototype);return t}catch{return[]}}_writeJsonArray(e,t){fs.mkdirSync(path.dirname(e),{recursive:!0}),fs.writeFileSync(e,JSON.stringify(t,null,2)+"\n","utf-8")}_invalidateRuleCache(){try{delete require.cache[require.resolve("./rule-loader.js")]}catch{}}_nextId(e,t){if(!/^[A-Z]+$/.test(t))throw new Error(`[PatternLearner] _nextId prefix must be uppercase alpha, got: "${t}"`);let r=0;const n=new RegExp(`^${t}(\\d+)$`);for(const t of e){const e=n.exec(t.id||"");e&&(r=Math.max(r,parseInt(e[1],10)))}return t+String(r+1).padStart("MISS"===t?4:3,"0")}_deriveTrigger(e){if(!e||"string"!=typeof e)return null;const t=e.split("\n").map(e=>e.trim()).filter(Boolean).find(e=>!e.startsWith("//")&&!e.startsWith("#")&&!e.startsWith("*")&&!e.startsWith("/*")&&!/^(import|from|using|package|require|namespace)\b/.test(e)&&e.length>=8&&e.length<=240);if(!t)return null;const r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return this._checkRegexComplexity(r).safe?r:null}_checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500 characters"};let t=0,r=0;const n=[];for(let s=0;s<e.length;s++){const i=e[s];if("\\"!==i)if("("!==i){if(")"===i){const r=n.pop();if(!r)continue;const i=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),a=e[s+1];if("+"===a||"*"===a||"?"===a||i){if(t++,r.hasQuantifier||r.hasAlternation)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};n.length>0&&(n[n.length-1].hasQuantifier=!0)}continue}if("+"!==i&&"*"!==i&&"?"!==i){if("{"===i){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,n.length>0&&(n[n.length-1].hasQuantifier=!0));continue}"|"!==i||(r++,n.length>0&&(n[n.length-1].hasAlternation=!0))}else t++,n.length>0&&(n[n.length-1].hasQuantifier=!0)}else n.push({hasQuantifier:!1,hasAlternation:!1});else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:r>30?{safe:!1,reason:`pattern has ${r} alternations, exceeding max of 30`}:{safe:!0,reason:null}}patternExists(e,t){if(!fs.existsSync(this.rulesDir))return!1;const r=fs.readdirSync(this.rulesDir).filter(e=>e.endsWith(".json"));for(const n of r){const r=this._readJsonArray(path.join(this.rulesDir,n));for(const n of r)if(null==e){if(n.category===t)return!0}else if(n.pattern===e&&n.category===t)return!0}return!1}categoryCovered(e){return this.patternExists(null,e)}recordNewPattern(e={}){const{pattern:t,flags:r="gi",category:n,description:s,language:i=[],severity:a="medium",source:o}=e;if(!t||!n)throw new Error('[PatternLearner] recordNewPattern requires "pattern" and "category"');new RegExp(t,r);const d=this._checkRegexComplexity(t);if(!d.safe)throw new Error(`[PatternLearner] recordNewPattern rejected unsafe pattern: ${d.reason}`);if(this.patternExists(t,n))return{added:!1,reason:"duplicate",id:null};const c=this._readJsonArray(this.communityFile),u=this._nextId(c,"COMM"),l={id:u,pattern:t,flags:r,category:n,description:s||`Community-discovered pattern for "${n}"`,language:i,severity:a,discoveredAt:(new Date).toISOString(),source:o||"crucible-run"};return c.push(l),this._writeJsonArray(this.communityFile,c),this._invalidateRuleCache(),{added:!0,reason:null,id:u,entry:l}}recordDiscoveredIfUncovered(e={}){const{category:t,language:r,content:n,severity:s,seedId:i}=e;if(!t)return{added:!1,reason:"no-category"};if(this.categoryCovered(t))return{added:!1,reason:"already-covered"};const a=this._deriveTrigger(n);return a?this.recordNewPattern({pattern:a,flags:"gi",category:t,description:`Auto-discovered pattern for previously-uncovered category "${t}"`+(i?` (seed ${i})`:""),language:r?[r]:[],severity:s||"medium",source:`crucible-auto-discovery:${i||"unknown"}`}):{added:!1,reason:"no-derivable-trigger"}}recordMissedPattern(e={}){const{seedId:t,content:r,expectedCategory:n,language:s,scannerOutput:i,severity:a="medium",meta:o={}}=e;if(!n)throw new Error('[PatternLearner] recordMissedPattern requires "expectedCategory"');const d=this._readJsonArray(this.missedPatternsFile),c=`${t||""}|${n}|${s||""}`,u=d.find(e=>`${e.seedId||""}|${e.expectedCategory}|${e.language||""}`===c);if(u)return u.timesSeen=(u.timesSeen||1)+1,u.lastSeenAt=(new Date).toISOString(),this._writeJsonArray(this.missedPatternsFile,d),{added:!1,reason:"duplicate-updated",entry:u};const l={id:this._nextId(d,"MISS"),seedId:t||null,expectedCategory:n,language:s||null,severity:a,content:r||null,scannerOutput:i||null,status:"pending",discoveredAt:(new Date).toISOString(),timesSeen:1,meta:o};return d.push(l),this._writeJsonArray(this.missedPatternsFile,d),{added:!0,reason:null,entry:l}}getMissedPatterns(e={}){const t=this._readJsonArray(this.missedPatternsFile);return e.status?t.filter(t=>t.status===e.status):t}reviewMissedPattern(e,t){if("confirmed"!==t&&"rejected"!==t)throw new Error('[PatternLearner] decision must be "confirmed" or "rejected"');const r=this._readJsonArray(this.missedPatternsFile),n=r.find(t=>t.id===e);return n?(n.status=t,n.reviewedAt=(new Date).toISOString(),this._writeJsonArray(this.missedPatternsFile,r),n):null}promoteToScannerRule(e,t={}){const{pattern:r,flags:n="gi",description:s,language:i,severity:a}=t,o=this._readJsonArray(this.missedPatternsFile),d=o.find(t=>t.id===e);if(!d)throw new Error(`[PatternLearner] missed-pattern "${e}" not found`);if("confirmed"!==d.status)throw new Error(`[PatternLearner] missed-pattern "${e}" must be status "confirmed" before promotion (current: "${d.status}")`);if(!r)throw new Error('[PatternLearner] promoteToScannerRule requires an explicit "pattern" regex source');const c=this.recordNewPattern({pattern:r,flags:n,category:d.expectedCategory,description:s||`Promoted from missed-pattern ${e}: ${d.expectedCategory}`,language:i||(d.language?[d.language]:[]),severity:a||d.severity||"medium",source:`learn:${e}`});return c.added&&(d.status="promoted",d.promotedAt=(new Date).toISOString(),d.promotedRuleId=c.id,this._writeJsonArray(this.missedPatternsFile,o)),Object.assign({},c,{missedEntry:d})}autoPromoteMissedPatterns(){const e=this._readJsonArray(this.missedPatternsFile),t=this._readJsonArray(this.communityFile);let r=0,n=0,s=0;const i=[];for(const a of e){if("pending"!==a.status)continue;r++;const e=this._deriveTrigger(a.content);if(!e){a.status="rejected",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-review: no derivable pattern from stored content",s++;continue}if(this.patternExists(e,a.expectedCategory)){a.status="rejected",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-review: derived pattern already covered by an existing rule",s++;continue}a.status="confirmed",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-confirmed: derivable pattern found";const o=this._nextId(t,"COMM");t.push({id:o,pattern:e,flags:"gi",category:a.expectedCategory,description:`Auto-promoted from missed-pattern ${a.id}: ${a.expectedCategory}`,language:a.language?[a.language]:[],severity:a.severity||"medium",discoveredAt:(new Date).toISOString(),source:`learn:${a.id}`}),a.status="promoted",a.promotedAt=(new Date).toISOString(),a.promotedRuleId=o,n++,i.push(o)}return n>0&&(this._writeJsonArray(this.communityFile,t),this._invalidateRuleCache()),r>0&&this._writeJsonArray(this.missedPatternsFile,e),{reviewed:r,promoted:n,skipped:s,promotedIds:i}}}module.exports={PatternLearner:PatternLearner,RULES_DIR:RULES_DIR,COMMUNITY_FILE:COMMUNITY_FILE,MISSED_PATTERNS_FILE:MISSED_PATTERNS_FILE};
+"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),COMMUNITY_FILENAME="community-discovered.json",COMMUNITY_FILE=path.join(RULES_DIR,COMMUNITY_FILENAME),MISSED_PATTERNS_FILE=path.join(__dirname,"missed-patterns.json"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;class PatternLearner{constructor(e={}){this.rulesDir=e.rulesDir||RULES_DIR,this.communityFile=e.communityFile||path.join(this.rulesDir,COMMUNITY_FILENAME),this.missedPatternsFile=e.missedPatternsFile||MISSED_PATTERNS_FILE}_readJsonArray(e){if(!fs.existsSync(e))return[];try{const t=JSON.parse(fs.readFileSync(e,"utf-8"));if(!Array.isArray(t))return[];for(const e of t)e&&"object"==typeof e&&(delete e.__proto__,delete e.constructor,delete e.prototype);return t}catch{return[]}}_writeJsonArray(e,t){fs.mkdirSync(path.dirname(e),{recursive:!0}),fs.writeFileSync(e,JSON.stringify(t,null,2)+"\n","utf-8")}_invalidateRuleCache(){try{delete require.cache[require.resolve("./rule-loader.js")]}catch{}}_nextId(e,t){if(!/^[A-Z]+$/.test(t))throw new Error(`[PatternLearner] _nextId prefix must be uppercase alpha, got: "${t}"`);let r=0;const n=new RegExp(`^${t}(\\d+)$`);for(const t of e){const e=n.exec(t.id||"");e&&(r=Math.max(r,parseInt(e[1],10)))}return t+String(r+1).padStart("MISS"===t?4:3,"0")}_deriveTrigger(e){if(!e||"string"!=typeof e)return null;const t=e.split(/\r?\n/).map(e=>e.trim()).filter(Boolean).find(e=>!e.startsWith("//")&&!e.startsWith("#")&&!e.startsWith("*")&&!e.startsWith("/*")&&!/^(import|from|using|package|require|namespace)\b/.test(e)&&e.length>=8&&e.length<=240);if(!t)return null;const r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return this._checkRegexComplexity(r).safe?r:null}_checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500 characters"};let t=0,r=0;const n=[];for(let s=0;s<e.length;s++){const i=e[s];if("\\"!==i)if("("!==i){if(")"===i){const r=n.pop();if(!r)continue;const i=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),a=e[s+1];if("+"===a||"*"===a||"?"===a||i){if(t++,r.hasQuantifier||r.hasAlternation)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};n.length>0&&(n[n.length-1].hasQuantifier=!0)}continue}if("+"!==i&&"*"!==i&&"?"!==i){if("{"===i){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,n.length>0&&(n[n.length-1].hasQuantifier=!0));continue}"|"!==i||(r++,n.length>0&&(n[n.length-1].hasAlternation=!0))}else t++,n.length>0&&(n[n.length-1].hasQuantifier=!0)}else n.push({hasQuantifier:!1,hasAlternation:!1});else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:r>30?{safe:!1,reason:`pattern has ${r} alternations, exceeding max of 30`}:{safe:!0,reason:null}}patternExists(e,t){if(!fs.existsSync(this.rulesDir))return!1;const r=fs.readdirSync(this.rulesDir).filter(e=>e.endsWith(".json"));for(const n of r){const r=this._readJsonArray(path.join(this.rulesDir,n));for(const n of r)if(null==e){if(n.category===t)return!0}else if(n.pattern===e&&n.category===t)return!0}return!1}categoryCovered(e){return this.patternExists(null,e)}recordNewPattern(e={}){const{pattern:t,flags:r="gi",category:n,description:s,language:i=[],severity:a="medium",source:o}=e;if(!t||!n)throw new Error('[PatternLearner] recordNewPattern requires "pattern" and "category"');new RegExp(t,r);const d=this._checkRegexComplexity(t);if(!d.safe)throw new Error(`[PatternLearner] recordNewPattern rejected unsafe pattern: ${d.reason}`);if(this.patternExists(t,n))return{added:!1,reason:"duplicate",id:null};const c=this._readJsonArray(this.communityFile),u=this._nextId(c,"COMM"),l={id:u,pattern:t,flags:r,category:n,description:s||`Community-discovered pattern for "${n}"`,language:i,severity:a,discoveredAt:(new Date).toISOString(),source:o||"crucible-run"};return c.push(l),this._writeJsonArray(this.communityFile,c),this._invalidateRuleCache(),{added:!0,reason:null,id:u,entry:l}}recordDiscoveredIfUncovered(e={}){const{category:t,language:r,content:n,severity:s,seedId:i}=e;if(!t)return{added:!1,reason:"no-category"};if(this.categoryCovered(t))return{added:!1,reason:"already-covered"};const a=this._deriveTrigger(n);return a?this.recordNewPattern({pattern:a,flags:"gi",category:t,description:`Auto-discovered pattern for previously-uncovered category "${t}"`+(i?` (seed ${i})`:""),language:r?[r]:[],severity:s||"medium",source:`crucible-auto-discovery:${i||"unknown"}`}):{added:!1,reason:"no-derivable-trigger"}}recordMissedPattern(e={}){const{seedId:t,content:r,expectedCategory:n,language:s,scannerOutput:i,severity:a="medium",meta:o={}}=e;if(!n)throw new Error('[PatternLearner] recordMissedPattern requires "expectedCategory"');const d=this._readJsonArray(this.missedPatternsFile),c=`${t||""}|${n}|${s||""}`,u=d.find(e=>`${e.seedId||""}|${e.expectedCategory}|${e.language||""}`===c);if(u)return u.timesSeen=(u.timesSeen||1)+1,u.lastSeenAt=(new Date).toISOString(),this._writeJsonArray(this.missedPatternsFile,d),{added:!1,reason:"duplicate-updated",entry:u};const l={id:this._nextId(d,"MISS"),seedId:t||null,expectedCategory:n,language:s||null,severity:a,content:r||null,scannerOutput:i||null,status:"pending",discoveredAt:(new Date).toISOString(),timesSeen:1,meta:o};return d.push(l),this._writeJsonArray(this.missedPatternsFile,d),{added:!0,reason:null,entry:l}}getMissedPatterns(e={}){const t=this._readJsonArray(this.missedPatternsFile);return e.status?t.filter(t=>t.status===e.status):t}reviewMissedPattern(e,t){if("confirmed"!==t&&"rejected"!==t)throw new Error('[PatternLearner] decision must be "confirmed" or "rejected"');const r=this._readJsonArray(this.missedPatternsFile),n=r.find(t=>t.id===e);return n?(n.status=t,n.reviewedAt=(new Date).toISOString(),this._writeJsonArray(this.missedPatternsFile,r),n):null}promoteToScannerRule(e,t={}){const{pattern:r,flags:n="gi",description:s,language:i,severity:a}=t,o=this._readJsonArray(this.missedPatternsFile),d=o.find(t=>t.id===e);if(!d)throw new Error(`[PatternLearner] missed-pattern "${e}" not found`);if("confirmed"!==d.status)throw new Error(`[PatternLearner] missed-pattern "${e}" must be status "confirmed" before promotion (current: "${d.status}")`);if(!r)throw new Error('[PatternLearner] promoteToScannerRule requires an explicit "pattern" regex source');const c=this.recordNewPattern({pattern:r,flags:n,category:d.expectedCategory,description:s||`Promoted from missed-pattern ${e}: ${d.expectedCategory}`,language:i||(d.language?[d.language]:[]),severity:a||d.severity||"medium",source:`learn:${e}`});return c.added&&(d.status="promoted",d.promotedAt=(new Date).toISOString(),d.promotedRuleId=c.id,this._writeJsonArray(this.missedPatternsFile,o)),Object.assign({},c,{missedEntry:d})}autoPromoteMissedPatterns(){const e=this._readJsonArray(this.missedPatternsFile),t=this._readJsonArray(this.communityFile);let r=0,n=0,s=0;const i=[];for(const a of e){if("pending"!==a.status)continue;r++;const e=this._deriveTrigger(a.content);if(!e){a.status="rejected",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-review: no derivable pattern from stored content",s++;continue}if(this.patternExists(e,a.expectedCategory)){a.status="rejected",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-review: derived pattern already covered by an existing rule",s++;continue}a.status="confirmed",a.reviewedAt=(new Date).toISOString(),a.reviewNote="auto-confirmed: derivable pattern found";const o=this._nextId(t,"COMM");t.push({id:o,pattern:e,flags:"gi",category:a.expectedCategory,description:`Auto-promoted from missed-pattern ${a.id}: ${a.expectedCategory}`,language:a.language?[a.language]:[],severity:a.severity||"medium",discoveredAt:(new Date).toISOString(),source:`learn:${a.id}`}),a.status="promoted",a.promotedAt=(new Date).toISOString(),a.promotedRuleId=o,n++,i.push(o)}return n>0&&(this._writeJsonArray(this.communityFile,t),this._invalidateRuleCache()),r>0&&this._writeJsonArray(this.missedPatternsFile,e),{reviewed:r,promoted:n,skipped:s,promotedIds:i}}}module.exports={PatternLearner:PatternLearner,RULES_DIR:RULES_DIR,COMMUNITY_FILE:COMMUNITY_FILE,MISSED_PATTERNS_FILE:MISSED_PATTERNS_FILE};

package/dist/packages/crucible/rule-loader.js

@@ -1 +1 @@
-"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let s=0;s<e.length;s++){const a=e[s];if("\\"!==a)if("("!==a){if(")"===a){const n=r.pop();if(!n)continue;const a=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),i=e[s+1];if("+"===i||"*"===i||"?"===i||a){if(t++,n.hasQuantifier)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==a&&"*"!==a&&"?"!==a){if("{"===a){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==a||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else{if("?"===e[s+1]){const t=e[s+2];":"===t||"="===t||"!"===t?s+=2:"<"===t&&(s+=3)}r.push({hasQuantifier:!1,hasAlternation:!1})}else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,s;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{s=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:s,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};
+"use strict";const fs=require("fs"),path=require("path"),RULES_DIR=path.join(__dirname,"rules"),MAX_PATTERN_LENGTH=500,MAX_QUANTIFIERS=20,MAX_ALTERNATIONS=30;function _checkRegexComplexity(e){if("string"!=typeof e||!e)return{safe:!1,reason:"pattern must be a non-empty string"};if(e.length>500)return{safe:!1,reason:"pattern exceeds max length of 500"};let t=0,n=0;const r=[];for(let s=0;s<e.length;s++){const a=e[s];if("\\"!==a)if("("!==a){if(")"===a){const n=r.pop();if(!n)continue;const a=/^\{\d+(,\d*)?\}/.exec(e.slice(s+1)),i=e[s+1];if("+"===i||"*"===i||"?"===i||a){if(t++,n.hasQuantifier)return{safe:!1,reason:"nested quantifier detected (potential catastrophic backtracking)"};r.length>0&&(r[r.length-1].hasQuantifier=!0)}continue}if("+"!==a&&"*"!==a&&"?"!==a){if("{"===a){/^\{\d+(,\d*)?\}/.exec(e.slice(s))&&(t++,r.length>0&&(r[r.length-1].hasQuantifier=!0));continue}"|"!==a||(n++,r.length>0&&(r[r.length-1].hasAlternation=!0))}else t++,r.length>0&&(r[r.length-1].hasQuantifier=!0)}else{if("?"===e[s+1]){const t=e[s+2];":"===t||"="===t||"!"===t?s+=2:"<"===t&&(s+=3)}r.push({hasQuantifier:!1,hasAlternation:!1})}else s++}return t>20?{safe:!1,reason:`pattern has ${t} quantifiers, exceeding max of 20`}:n>30?{safe:!1,reason:`pattern has ${n} alternations, exceeding max of 30`}:{safe:!0,reason:null}}let _compiledPatterns=null;function getPatterns(){if(_compiledPatterns)return _compiledPatterns;const e=fs.readdirSync(RULES_DIR).filter(e=>e.endsWith(".json")).sort(),t=[];for(const n of e){const e=path.join(RULES_DIR,n);let r;try{const t=fs.readFileSync(e,"utf-8");r=JSON.parse(t)}catch(e){throw new Error(`[rule-loader] Failed to read/parse rule file "${n}": ${e.message}`)}if(!Array.isArray(r))throw new Error(`[rule-loader] Rule file "${n}" must export a JSON array, got: ${typeof r}`);for(const e of r){if(e.pattern){const t=_checkRegexComplexity(e.pattern);if(!t.safe){console.warn(`[rule-loader] WARNING: Skipping rule "${e.id}" in "${n}" — ${t.reason}`);continue}}let r,s;try{r=new RegExp(e.pattern,e.flags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile rule "${e&&e.id}" in file "${n}": ${t.message}\n  pattern: ${e&&e.pattern}\n  flags:   ${e&&e.flags}`)}if(e.context)try{s=new RegExp(e.context,e.contextFlags||"")}catch(t){throw new Error(`[rule-loader] Failed to compile context for rule "${e&&e.id}" in file "${n}": ${t.message}`)}t.push({regex:r,category:e.category,id:e.id,description:e.description,language:e.language,severity:e.severity,name:e.name,type:e.type,message:e.message,context:s,skipIfSafe:e.skipIfSafe,skipInTests:e.skipInTests,excludeExtensions:e.excludeExtensions,owasp:e.owasp,cwe:e.cwe,sourceFile:n})}}return _compiledPatterns=t,_compiledPatterns}function getCodeScannerPatterns(){return getPatterns().filter(e=>"code-scanner-core.json"===e.sourceFile).map(e=>{const t={id:e.id,name:e.name,type:e.type,pattern:e.regex,severity:e.severity,message:e.message};return e.context&&(t.context=e.context),e.skipIfSafe&&(t.skipIfSafe=!0),e.skipInTests&&(t.skipInTests=!0),e.excludeExtensions&&(t.excludeExtensions=e.excludeExtensions),e.owasp&&(t.owasp=e.owasp),e.cwe&&(t.cwe=e.cwe),t})}module.exports={getPatterns:getPatterns,getCodeScannerPatterns:getCodeScannerPatterns};

package/dist/packages/crucible/rules/code-scanner-core.json

@@ -1,147 +1,281 @@
-[
-  {
-    "id": "SEC001",
-    "name": "Hardcoded API Key",
-    "type": "hardcoded_secret",
-    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
-    "flags": "",
-    "severity": "critical",
-    "message": "Possible hardcoded API key or secret detected",
-    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
-    "contextFlags": "i",
-    "skipIfSafe": true
-  },
-  {
-    "id": "SEC001B",
-    "name": "Hardcoded API Key (bare)",
-    "type": "hardcoded_secret",
-    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
-    "flags": "",
-    "severity": "critical",
-    "message": "Possible hardcoded API key or secret detected",
-    "skipIfSafe": true
-  },
-  {
-    "id": "SEC002",
-    "name": "Hardcoded Password",
-    "type": "hardcoded_secret",
-    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
-    "flags": "i",
-    "severity": "critical",
-    "message": "Hardcoded password detected",
-    "skipIfSafe": true,
-    "skipInTests": true
-  },
-  {
-    "id": "SEC002B",
-    "name": "Hardcoded Password (JSON key)",
-    "type": "hardcoded_secret",
-    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
-    "flags": "i",
-    "severity": "critical",
-    "message": "Hardcoded password detected",
-    "skipIfSafe": true,
-    "skipInTests": true
-  },
-  {
-    "id": "SEC003",
-    "name": "SQL Injection Risk",
-    "type": "sql_injection",
-    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
-    "flags": "i",
-    "severity": "error",
-    "message": "Potential SQL injection - use parameterized queries"
-  },
-  {
-    "id": "SEC004",
-    "name": "eval() Usage",
-    "type": "eval_abuse",
-    "pattern": "\\beval\\s*\\(",
-    "flags": "",
-    "severity": "error",
-    "message": "eval() is dangerous and should be avoided"
-  },
-  {
-    "id": "SEC004B",
-    "name": "eval() Usage (unicode-escaped)",
-    "type": "eval_abuse",
-    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
-    "flags": "",
-    "severity": "error",
-    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided"
-  },
-  {
-    "id": "SEC005",
-    "name": "innerHTML/document.write Assignment",
-    "type": "xss",
-    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
-    "flags": "",
-    "severity": "warning",
-    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization"
-  },
-  {
-    "id": "SEC006",
-    "name": "Disabled Security",
-    "type": "insecure_config",
-    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
-    "flags": "",
-    "severity": "error",
-    "message": "SSL certificate validation disabled"
-  },
-  {
-    "id": "SEC007",
-    "name": "Exposed .env Reference",
-    "type": "insecure_config",
-    "pattern": "\\.env['\"]",
-    "flags": "",
-    "severity": "warning",
-    "message": "Direct .env file manipulation - ensure not exposed",
-    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
-    "contextFlags": "i"
-  },
-  {
-    "id": "SEC008",
-    "name": "Unsafe Block (Rust)",
-    "type": "memory_safety",
-    "pattern": "\\bunsafe\\s*\\{",
-    "flags": "",
-    "severity": "warning",
-    "message": "Rust unsafe block - verify memory safety guarantees"
-  },
-  {
-    "id": "SEC009",
-    "name": "Shell Execution (PHP/Ruby/Python)",
-    "type": "command_injection",
-    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|`[^`]+`|\\bos\\.system\\s*\\(|\\bos\\.popen\\s*\\(|\\bsubprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*shell\\s*=\\s*True",
-    "flags": "",
-    "severity": "error",
-    "message": "Shell/OS execution function — command injection risk if input unsanitized"
-  },
-  {
-    "id": "SEC010",
-    "name": "Prototype Pollution",
-    "type": "prototype_pollution",
-    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
-    "flags": "",
-    "severity": "error",
-    "message": "Possible prototype pollution via __proto__/constructor.prototype"
-  },
-  {
-    "id": "SEC011",
-    "name": "PHP SQL Injection (dot concatenation)",
-    "type": "sql_injection",
-    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
-    "flags": "i",
-    "severity": "critical",
-    "message": "PHP SQL injection: user input concatenated into SQL query with dot operator — use PDO prepared statements"
-  },
-  {
-    "id": "SEC012",
-    "name": "PHP XSS (echo with user input)",
-    "type": "xss",
-    "pattern": "echo\\s+(?!htmlspecialchars|htmlentities|strip_tags|esc_html).*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
-    "flags": "i",
-    "severity": "error",
-    "message": "PHP XSS: unescaped user input echoed to page — use htmlspecialchars()"
-  }
-]
+[
+  {
+    "id": "SEC001",
+    "name": "Hardcoded API Key",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]|['\"][a-zA-Z0-9]{32,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "context": "(api[_-]?key|apikey|secret[_\\s]*key|token|credential|bearer)",
+    "contextFlags": "i",
+    "skipIfSafe": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC001B",
+    "name": "Hardcoded API Key (bare)",
+    "type": "hardcoded_secret",
+    "pattern": "['\"](?:sk-|pk-|xox[pboa]-|AKIA|ghp_|gho_|github_pat_)[a-zA-Z0-9_-]{10,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Possible hardcoded API key or secret detected",
+    "skipIfSafe": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC002",
+    "name": "Hardcoded Password",
+    "type": "hardcoded_secret",
+    "pattern": "password\\s*[:=]\\s*['\"][^'\"]+['\"]",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC002B",
+    "name": "Hardcoded Password (JSON key)",
+    "type": "hardcoded_secret",
+    "pattern": "[\"']password[\"']\\s*:\\s*[\"'][^\"']+[\"']",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded password detected",
+    "skipIfSafe": true,
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC003",
+    "name": "SQL Injection Risk",
+    "type": "sql_injection",
+    "pattern": "\\b(?:SELECT|INSERT\\s+INTO|UPDATE|DELETE\\s+FROM|WHERE)\\b.*(\\$\\{|\\+\\s*['\"]|\\+\\s*\\w+|f['\"].*\\{|%s|%d)",
+    "flags": "i",
+    "severity": "error",
+    "message": "Potential SQL injection - use parameterized queries",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC004",
+    "name": "eval() Usage",
+    "type": "eval_abuse",
+    "pattern": "\\beval\\s*\\(",
+    "flags": "",
+    "severity": "error",
+    "message": "eval() is dangerous and should be avoided",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-95"
+  },
+  {
+    "id": "SEC004B",
+    "name": "eval() Usage (unicode-escaped)",
+    "type": "eval_abuse",
+    "pattern": "\\\\u0065\\\\u0076\\\\u0061\\\\u006[cC]",
+    "flags": "",
+    "severity": "error",
+    "message": "Obfuscated eval() usage (unicode escapes) is dangerous and should be avoided",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-95"
+  },
+  {
+    "id": "SEC005",
+    "name": "innerHTML/document.write Assignment",
+    "type": "xss",
+    "pattern": "\\.innerHTML\\s*=|\\bdocument\\.write\\s*\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "innerHTML/document.write can cause XSS - consider using textContent or sanitization",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-79"
+  },
+  {
+    "id": "SEC006",
+    "name": "Disabled Security",
+    "type": "insecure_config",
+    "pattern": "rejectUnauthorized\\s*:\\s*false|verify\\s*=\\s*False|InsecureSkipVerify\\s*:\\s*true",
+    "flags": "",
+    "severity": "error",
+    "message": "SSL certificate validation disabled",
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-295"
+  },
+  {
+    "id": "SEC007",
+    "name": "Exposed .env Reference",
+    "type": "insecure_config",
+    "pattern": "\\.env['\"]",
+    "flags": "",
+    "severity": "warning",
+    "message": "Direct .env file manipulation - ensure not exposed",
+    "context": "fs\\.(read|write)|path\\.join|open\\s*\\(|os\\.Open",
+    "contextFlags": "i",
+    "owasp": "A05:2021 Security Misconfiguration",
+    "cwe": "CWE-538"
+  },
+  {
+    "id": "SEC008",
+    "name": "Unsafe Block (Rust)",
+    "type": "memory_safety",
+    "pattern": "\\bunsafe\\s*\\{",
+    "flags": "",
+    "severity": "warning",
+    "message": "Rust unsafe block - verify memory safety guarantees",
+    "owasp": "A06:2021 Vulnerable and Outdated Components",
+    "cwe": "CWE-787"
+  },
+  {
+    "id": "SEC009",
+    "name": "Shell Execution (PHP/Ruby/Python)",
+    "type": "command_injection",
+    "pattern": "\\bshell_exec\\s*\\(|\\bpassthru\\s*\\(|\\bos\\.system\\s*\\(|\\bos\\.popen\\s*\\(|\\bsubprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*shell\\s*=\\s*True|\\bexec\\s*\\(\\s*[\"']|\\bsystem\\s*\\(\\s*[\"']",
+    "flags": "",
+    "severity": "error",
+    "message": "Shell/OS execution function — command injection risk if input unsanitized",
+    "excludeExtensions": [".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs"],
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-78"
+  },
+  {
+    "id": "SEC010",
+    "name": "Prototype Pollution",
+    "type": "prototype_pollution",
+    "pattern": "\\[\\s*['\"]__proto__['\"]\\s*\\]|\\.__proto__\\s*(=|\\[)|constructor\\s*\\[\\s*['\"]prototype['\"]\\s*\\]|constructor\\.prototype\\s*(=|\\[)|['\"]__proto__['\"]\\s*:",
+    "flags": "",
+    "severity": "error",
+    "message": "Possible prototype pollution via __proto__/constructor.prototype",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-1321"
+  },
+  {
+    "id": "SEC011",
+    "name": "PHP SQL Injection (dot concatenation)",
+    "type": "sql_injection",
+    "pattern": "\"SELECT[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"UPDATE[^\"]*SET[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\"DELETE[^\"]*WHERE[^\"]*\"\\s*\\.\\s*\\$[a-zA-Z_]|\\$(?:query|sql|qry)\\s*\\.=\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "critical",
+    "message": "PHP SQL injection: user input concatenated into SQL query with dot operator — use PDO prepared statements",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC012",
+    "name": "PHP XSS (echo with user input)",
+    "type": "xss",
+    "pattern": "echo\\s+(?!htmlspecialchars|htmlentities|strip_tags|esc_html).*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST|_COOKIE)|print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE)",
+    "flags": "i",
+    "severity": "error",
+    "message": "PHP XSS: unescaped user input echoed to page — use htmlspecialchars()",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-79"
+  },
+  {
+    "id": "SEC013",
+    "name": "Hardcoded JWT Token",
+    "type": "hardcoded_secret",
+    "pattern": "['\"]eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "Hardcoded JWT token detected — rotate immediately and use environment variables",
+    "skipIfSafe": true,
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC014",
+    "name": "Hardcoded PEM Private Key",
+    "type": "hardcoded_secret",
+    "pattern": "-----BEGIN (?:RSA |EC )?PRIVATE KEY-----",
+    "flags": "",
+    "severity": "critical",
+    "message": "Private key embedded in source code — move to secure key store or environment variable",
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-321"
+  },
+  {
+    "id": "SEC015",
+    "name": "Hardcoded AWS Secret Access Key",
+    "type": "hardcoded_secret",
+    "pattern": "(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\\s*[:=]\\s*['\"][A-Za-z0-9/+=]{40}['\"]",
+    "flags": "",
+    "severity": "critical",
+    "message": "AWS Secret Access Key hardcoded — use IAM roles or environment variables",
+    "skipIfSafe": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC016",
+    "name": "Rust Hardcoded Secret (const &str)",
+    "type": "hardcoded_secret",
+    "pattern": "const\\s+(?:PASSWORD|SECRET|API_KEY|TOKEN|PRIVATE_KEY|DB_PASS)\\s*:\\s*&str\\s*=\\s*\"[^\"]+\"",
+    "flags": "i",
+    "severity": "critical",
+    "message": "Hardcoded secret in Rust const — use environment variables at runtime",
+    "skipInTests": true,
+    "owasp": "A02:2021 Cryptographic Failures",
+    "cwe": "CWE-798"
+  },
+  {
+    "id": "SEC017",
+    "name": "Rust format! SQL Injection",
+    "type": "sql_injection",
+    "pattern": "format!\\s*\\(\\s*\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*\\{",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with format!() macro — use parameterized queries (sqlx::query! or bind)",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC018",
+    "name": "Ruby String Interpolation XSS/Injection",
+    "type": "xss",
+    "pattern": "[\"'](?:SELECT|INSERT|UPDATE|DELETE|WHERE|<)[^\"']*#\\{[^}]*(?:params|request|input|user|cookies|session)[^}]*\\}",
+    "flags": "i",
+    "severity": "error",
+    "message": "User input interpolated via Ruby #{} into SQL/HTML — use parameterized queries or sanitize",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "SEC019",
+    "name": "Go format SQL Injection",
+    "type": "sql_injection",
+    "pattern": "fmt\\.Sprintf\\s*\\(\\s*\"(?:SELECT|INSERT|UPDATE|DELETE|WHERE)[^\"]*%[sv]",
+    "flags": "i",
+    "severity": "error",
+    "message": "SQL query built with fmt.Sprintf — use parameterized queries (db.Query with $1/? placeholders)",
+    "owasp": "A03:2021 Injection",
+    "cwe": "CWE-89"
+  },
+  {
+    "id": "RUST001",
+    "name": "Rust Deprecated API (mem::uninitialized)",
+    "type": "deprecated_api",
+    "pattern": "mem::uninitialized\\s*\\(|MaybeUninit::uninit\\(\\)\\.assume_init\\(\\)",
+    "flags": "",
+    "severity": "error",
+    "message": "mem::uninitialized is UB since Rust 1.39 — use MaybeUninit::zeroed() or MaybeUninit with proper init",
+    "owasp": "A06:2021 Vulnerable and Outdated Components",
+    "cwe": "CWE-908"
+  },
+  {
+    "id": "RUST002",
+    "name": "Rust Deprecated trim_left/trim_right",
+    "type": "deprecated_api",
+    "pattern": "\\.trim_left\\(\\)|\\.trim_right\\(\\)|\\.trim_left_matches\\(|\\.trim_right_matches\\(",
+    "flags": "",
+    "severity": "warning",
+    "message": "trim_left/trim_right deprecated since Rust 1.33 — use trim_start/trim_end",
+    "owasp": "A06:2021 Vulnerable and Outdated Components",
+    "cwe": "CWE-477"
+  }
+]