gitrupt 0.1.0__py3-none-any.whl

gitrupt/scanners/secret_rules.py

@@ -0,0 +1,368 @@
+"""
+Provider-specific secret detection rules.
+
+Every rule is a compiled regex + metadata. Add a provider by appending a
+SecretRule to PROVIDER_RULES. The scanner picks it up automatically.
+
+Design notes:
+    - Patterns are anchored to the prefix the provider guarantees.
+    - Where the provider gives a known length, we require it, to avoid
+      matching fragments of longer strings.
+    - Where lengths vary, we use {N,M} ranges, never bare +.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from gitrupt.models import Severity
+
+
+@dataclass(frozen=True)
+class SecretRule:
+    rule_id: str
+    pattern: re.Pattern
+    severity: Severity
+    confidence: float
+    message: str
+    description: str
+    recommendation: str
+    # When set, the rule only fires if one of these words appears
+    # within CONTEXT_WINDOW characters of the match. Used to suppress
+    # entropy-only false positives.
+    context_words: tuple[str, ...] = ()
+
+
+CONTEXT_WINDOW = 120
+
+# ═══════════════════════════════════════════════════════════════════════════
+# AI providers
+# ═══════════════════════════════════════════════════════════════════════════
+
+AI_RULES: tuple[SecretRule, ...] = (
+    SecretRule(
+        rule_id="openai-project-key",
+        pattern=re.compile(r"\bsk-proj-[A-Za-z0-9_-]{80,200}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="OpenAI project API key detected",
+        description="OpenAI project-scoped key (sk-proj-). Grants access to the project's resources.",
+        recommendation="Revoke in platform.openai.com → API keys, then rotate.",
+    ),
+    SecretRule(
+        rule_id="openai-legacy-key",
+        pattern=re.compile(r"\bsk-[A-Za-z0-9]{48}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.85,
+        message="OpenAI legacy API key detected",
+        description="Legacy OpenAI key format (sk- + 48 chars).",
+        recommendation="Migrate to project-scoped keys and revoke the legacy key.",
+    ),
+    SecretRule(
+        rule_id="anthropic-api-key",
+        pattern=re.compile(r"\bsk-ant-api\d{2}-[A-Za-z0-9_-]{80,120}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="Anthropic (Claude) API key detected",
+        description="Anthropic API key (sk-ant-apiNN-).",
+        recommendation="Revoke at console.anthropic.com → API keys.",
+    ),
+    SecretRule(
+        rule_id="anthropic-admin-key",
+        pattern=re.compile(r"\bsk-ant-admin\d{2}-[A-Za-z0-9_-]{80,120}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="Anthropic admin API key detected",
+        description="Anthropic admin key — broader privileges than a standard key.",
+        recommendation="Revoke immediately at console.anthropic.com.",
+    ),
+    SecretRule(
+        rule_id="groq-api-key",
+        pattern=re.compile(r"\bgsk_[A-Za-z0-9]{52}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="Groq API key detected",
+        description="Groq key (gsk_ + 52 alphanumeric). Full API access, no scopes.",
+        recommendation="Revoke at console.groq.com/keys.",
+    ),
+    SecretRule(
+        rule_id="xai-api-key",
+        pattern=re.compile(r"\bxai-[A-Za-z0-9]{20,80}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.9,
+        message="xAI (Grok) API key detected",
+        description="xAI key (xai- prefix).",
+        recommendation="Revoke at console.x.ai → API keys.",
+    ),
+    SecretRule(
+        rule_id="google-ai-api-key",
+        pattern=re.compile(r"\bAIza[0-9A-Za-z_\-]{35}\b"),
+        severity=Severity.HIGH,
+        confidence=0.85,
+        message="Google API key detected (Gemini / Maps / GCP)",
+        description="Google API key (AIza + 35 chars).",
+        recommendation="Restrict the key by API + referrer in GCP console.",
+    ),
+    SecretRule(
+        rule_id="huggingface-token",
+        pattern=re.compile(r"\bhf_[A-Za-z0-9]{34,}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="Hugging Face access token detected",
+        description="HF token (hf_ prefix).",
+        recommendation="Revoke at huggingface.co/settings/tokens.",
+    ),
+    SecretRule(
+        rule_id="replicate-token",
+        pattern=re.compile(r"\br8_[A-Za-z0-9]{36,40}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="Replicate API token detected",
+        description="Replicate token (r8_ + 36–40 chars).",
+        recommendation="Revoke at replicate.com/account/api-tokens.",
+    ),
+    SecretRule(
+        rule_id="perplexity-api-key",
+        pattern=re.compile(r"\bpplx-[A-Za-z0-9]{48}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="Perplexity API key detected",
+        description="Perplexity key (pplx- + 48 chars).",
+        recommendation="Revoke at perplexity.ai/settings/api.",
+    ),
+    SecretRule(
+        rule_id="cohere-api-key",
+        pattern=re.compile(r"\bco-[A-Za-z0-9]{38,42}\b"),
+        severity=Severity.MEDIUM,
+        confidence=0.6,
+        message="Possible Cohere API key",
+        description="Cohere key format is 40-char base62 with optional co- prefix.",
+        recommendation="Verify in Cohere dashboard and revoke if real.",
+        context_words=("cohere", "co_", "COHERE"),
+    ),
+)
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Payments, email, comms
+# ═══════════════════════════════════════════════════════════════════════════
+
+PAYMENT_RULES: tuple[SecretRule, ...] = (
+    SecretRule(
+        rule_id="stripe-live-secret",
+        pattern=re.compile(r"\bsk_live_[A-Za-z0-9]{24,99}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="Stripe live secret key detected",
+        description="Stripe live-mode secret key — full account access.",
+        recommendation="Roll the key immediately in Stripe Dashboard → Developers → API keys.",
+    ),
+    SecretRule(
+        rule_id="stripe-live-restricted",
+        pattern=re.compile(r"\brk_live_[A-Za-z0-9]{24,99}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="Stripe live restricted key detected",
+        description="Stripe live restricted key.",
+        recommendation="Revoke in Stripe Dashboard.",
+    ),
+    SecretRule(
+        rule_id="sendgrid-api-key",
+        pattern=re.compile(r"\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="SendGrid API key detected",
+        description="SendGrid key (SG.ID.VALUE).",
+        recommendation="Revoke at app.sendgrid.com → Settings → API Keys.",
+    ),
+)
+
+COMMS_RULES: tuple[SecretRule, ...] = (
+    SecretRule(
+        rule_id="slack-token",
+        pattern=re.compile(r"\bxox[baprs]-[0-9A-Za-z-]{10,}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="Slack token detected",
+        description="Slack bot/user/app token (xox[baprs]-).",
+        recommendation="Revoke at api.slack.com/apps.",
+    ),
+    SecretRule(
+        rule_id="slack-webhook",
+        pattern=re.compile(
+            r"https://hooks\.slack\.com/services/T[A-Z0-9]{8,}/B[A-Z0-9]{8,}/[A-Za-z0-9]{20,}"
+        ),
+        severity=Severity.MEDIUM,
+        confidence=0.95,
+        message="Slack incoming webhook URL",
+        description="Slack webhook — anyone with this URL can post to the channel.",
+        recommendation="Rotate the webhook in Slack app settings.",
+    ),
+    SecretRule(
+        rule_id="discord-bot-token",
+        pattern=re.compile(
+            r"\b(?:mfa\.[A-Za-z0-9_-]{20,}|[MN][A-Za-z0-9_-]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27,39})\b"
+        ),
+        severity=Severity.HIGH,
+        confidence=0.85,
+        message="Discord bot token detected",
+        description="Discord token (MFA or standard three-part format).",
+        recommendation="Regenerate in Discord Developer Portal.",
+    ),
+    SecretRule(
+    rule_id="twilio-api-key",
+    pattern=re.compile(r"\bSK[0-9a-fA-F]{32}\b"),
+    severity=Severity.MEDIUM,
+    confidence=0.7,
+    message="Possible Twilio API key SID",
+    description="Twilio API key SID (SK + 32 hex).",
+    recommendation="Verify and revoke in Twilio console if real.",
+),
+)
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Cloud / infrastructure
+# ═══════════════════════════════════════════════════════════════════════════
+
+CLOUD_RULES: tuple[SecretRule, ...] = (
+    SecretRule(
+        rule_id="aws-access-key-id",
+        pattern=re.compile(
+            r"\b(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\b"
+        ),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="AWS access key ID detected",
+        description="AWS access key ID — pairs with a secret key.",
+        recommendation="Rotate via IAM → Users → Security credentials.",
+    ),
+    SecretRule(
+        rule_id="aws-secret-access-key",
+        pattern=re.compile(r"\b[A-Za-z0-9/+=]{40}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.55,
+        message="Possible AWS secret access key",
+        description="40-char base64 string near an AWS context word.",
+        recommendation="Rotate via IAM → Users → Security credentials.",
+        context_words=(
+            "aws_secret", "aws_secret_access_key", "AWS_SECRET_ACCESS_KEY",
+            "secret_access_key", "aws", "AWS",
+        ),
+    ),
+    SecretRule(
+        rule_id="azure-connection-string",
+        pattern=re.compile(
+            r"(?:AccountKey|SharedAccessKey)=[A-Za-z0-9+/=]{40,}",
+        ),
+        severity=Severity.CRITICAL,
+        confidence=0.85,
+        message="Azure connection string credential",
+        description="Azure SQL/Storage connection string with embedded key.",
+        recommendation="Rotate the account key in the Azure portal.",
+    ),
+    SecretRule(
+        rule_id="azure-client-secret",
+        pattern=re.compile(
+            r"\b[A-Za-z0-9_~.]{3}\dQ~[A-Za-z0-9_~.\-]{31,34}\b"
+        ),
+        severity=Severity.HIGH,
+        confidence=0.6,
+        message="Possible Azure AD client secret",
+        description="Azure AD client secrets have a distinctive ~ pattern.",
+        recommendation="Rotate the client secret in Azure AD → App registrations.",
+        context_words=("client_secret", "AZURE_CLIENT_SECRET", "azure"),
+    ),
+)
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Developer tooling
+# ═══════════════════════════════════════════════════════════════════════════
+
+DEVELOPS_RULES: tuple[SecretRule, ...] = (
+    SecretRule(
+        rule_id="github-pat-classic",
+        pattern=re.compile(r"\bghp_[A-Za-z0-9]{36}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="GitHub classic PAT detected",
+        description="GitHub personal access token (classic).",
+        recommendation="Revoke at github.com/settings/tokens.",
+    ),
+    SecretRule(
+        rule_id="github-pat-fine-grained",
+        pattern=re.compile(r"\bgithub_pat_[A-Za-z0-9_]{82}\b"),
+        severity=Severity.CRITICAL,
+        confidence=0.95,
+        message="GitHub fine-grained PAT detected",
+        description="GitHub fine-grained personal access token.",
+        recommendation="Revoke at github.com/settings/tokens.",
+    ),
+    SecretRule(
+        rule_id="github-server-token",
+        pattern=re.compile(r"\bghs_[A-Za-z0-9]{36}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="GitHub server-to-server token detected",
+        description="GitHub App server token (ghs_).",
+        recommendation="Rotate the GitHub App's private key.",
+    ),
+    SecretRule(
+        rule_id="npm-token",
+        pattern=re.compile(r"\bnpm_[A-Za-z0-9]{36}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="npm access token detected",
+        description="npm token (npm_ + 36 chars).",
+        recommendation="Revoke at npmjs.com → Access Tokens.",
+    ),
+    SecretRule(
+        rule_id="pypi-token",
+        pattern=re.compile(r"\bpypi-[A-Za-z0-9_-]{50,}\b"),
+        severity=Severity.HIGH,
+        confidence=0.9,
+        message="PyPI API token detected",
+        description="PyPI upload token (pypi- prefix).",
+        recommendation="Revoke at pypi.org → Account → API tokens.",
+    ),
+    SecretRule(
+        rule_id="digitalocean-token",
+        pattern=re.compile(r"\bdop_v1_[a-f0-9]{64}\b"),
+        severity=Severity.HIGH,
+        confidence=0.95,
+        message="DigitalOcean personal access token detected",
+        description="DigitalOcean token (dop_v1_ + 64 hex).",
+        recommendation="Revoke at cloud.digitalocean.com → API → Tokens.",
+    ),
+    SecretRule(
+        rule_id="heroku-api-key",
+        pattern=re.compile(
+            r"\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b"
+        ),
+        severity=Severity.LOW,
+        confidence=0.4,
+        message="Possible Heroku API key (UUID format)",
+        description="Heroku keys are UUIDs — only flagged near Heroku context.",
+        recommendation="Verify in Heroku Account → API Key.",
+        context_words=("heroku", "HEROKU", "heroku_api"),
+    ),
+)
+
+PROVIDER_RULES: tuple[SecretRule, ...] = (
+    AI_RULES + PAYMENT_RULES + COMMS_RULES + CLOUD_RULES + DEVELOPS_RULES
+)
+
+# ═══════════════════════════════════════════════════════════════════════════
+# Private key blocks
+# ═══════════════════════════════════════════════════════════════════════════
+
+PRIVATE_KEY_RULE = SecretRule(
+    rule_id="private-key-block",
+    pattern=re.compile(
+        r"-----BEGIN ((?:RSA|EC|DSA|OPENSSH|PGP|SSH2|ENCRYPTED) )?PRIVATE KEY(?: BLOCK)?-----"
+    ),
+    severity=Severity.CRITICAL,
+    confidence=1.0,
+    message="Private key block detected",
+    description="PEM-encoded private key material.",
+    recommendation="Remove from the commit; rotate the key.",
+)