narvy-cli 1.0.0__py3-none-any.whl

narvy/rules/ios/objc/network.yml

@@ -0,0 +1,67 @@
+# Objective-C transport-security checks.
+
+- id: IOS-OBJC-NET-001
+  name: "Undocumented API Disables All HTTPS Certificate Validation"
+  pattern: 'allowsAnyHTTPSCertificateForHost'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-295"
+    masvs: "MSTG-NETWORK-3"
+    description: "setAllowsAnyHTTPSCertificateForHost:forHost: is a private/undocumented NSURLRequest API that disables ALL certificate validation for the given host. Its mere presence in a shipped binary is itself an App Store review red flag, and it is a trivial MITM path."
+    recommendation: "Remove this call entirely. Use NSURLSession with a proper URLSessionDelegate that validates the server trust (SecTrustEvaluateWithError), or implement certificate pinning."
+
+- id: IOS-OBJC-NET-002
+  name: "NSURLConnection Accepts Any Certificate/Protection Space"
+  pattern: '(?s)canAuthenticateAgainstProtectionSpace\s*:.*?return\s+YES\s*;'
+  severity: "CRITICAL"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-295"
+    masvs: "MSTG-NETWORK-3"
+    description: "The NSURLConnection delegate's canAuthenticateAgainstProtectionSpace: unconditionally returns YES, meaning the connection will authenticate against ANY protection space/authentication method presented - including self-signed or attacker-controlled certificates."
+    recommendation: "Migrate to NSURLSession. If NSURLConnection must be kept, restrict this to only the expected authentication methods and validate the server trust before returning YES."
+
+- id: IOS-OBJC-NET-003
+  name: "Continues Without Credential on Auth Challenge"
+  pattern: 'continueWithoutCredentialForAuthenticationChallenge\s*:'
+  severity: "HIGH"
+  confidence: "LOW"
+  details:
+    cwe: "CWE-295"
+    masvs: "MSTG-NETWORK-3"
+    description: "continueWithoutCredentialForAuthenticationChallenge: proceeds with the connection despite an unresolved authentication challenge (e.g. an untrusted server certificate). This is a low-confidence heuristic - it flags every call site, not just certificate-bypass usage; verify the surrounding logic manually."
+    recommendation: "Verify this is not being used to silently accept an untrusted server certificate. If it is, validate the server trust explicitly before deciding whether to proceed."
+
+- id: IOS-OBJC-NET-004
+  name: "AFNetworking Certificate Validation Disabled"
+  pattern: 'allowInvalidCertificates\s*=\s*YES'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-295"
+    masvs: "MSTG-NETWORK-3"
+    description: "AFSecurityPolicy.allowInvalidCertificates is set to YES, which disables TLS certificate validation for this AFNetworking session - the app will accept any certificate, including a self-signed one from an attacker performing a MITM."
+    recommendation: "Set allowInvalidCertificates to NO (the default) in release builds. If pinning is required, use AFSecurityPolicy's pinning modes (AFSSLPinningModeCertificate/PublicKey) instead of disabling validation."
+
+- id: IOS-OBJC-NET-005
+  name: "AFNetworking Domain Name Validation Disabled"
+  pattern: 'validatesDomainName\s*=\s*NO'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-297"
+    masvs: "MSTG-NETWORK-3"
+    description: "AFSecurityPolicy.validatesDomainName is set to NO, which disables hostname validation - a certificate for any domain will be accepted for this connection, enabling MITM even with a validly-signed certificate."
+    recommendation: "Leave validatesDomainName at its default (YES). If a specific case genuinely requires disabling it, pin the exact expected certificate/public key instead."
+
+- id: IOS-OBJC-NET-006
+  name: "Hardcoded Cleartext HTTP URL"
+  pattern: '@"http://(?!localhost|127\.0\.0\.1)[^"]+"'
+  severity: "MEDIUM"
+  confidence: "LOW"
+  details:
+    cwe: "CWE-319"
+    masvs: "MSTG-NETWORK-1"
+    description: "A hardcoded http:// (non-TLS) URL literal is used. Traffic to this endpoint is sent in cleartext unless an ATS exception domain forces an upgrade. Low-confidence heuristic - some of these may be intentional (e.g. local dev servers, non-sensitive third-party feeds); verify manually."
+    recommendation: "Use https:// for any endpoint that carries sensitive data or app logic. Remove NSAllowsArbitraryLoads / per-domain HTTP exceptions from Info.plist for production builds."

narvy/rules/ios/objc/secrets.yml

@@ -0,0 +1,79 @@
+# Objective-C hardcoded-credential checks.
+
+- id: IOS-OBJC-S-001
+  name: "Hardcoded API Key"
+  pattern: '(?i)(api[_-]?key|api[_-]?secret)\s*=\s*@"[A-Za-z0-9+/=]{16,}"'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded API key or secret token was found. Anyone who reads the source (or a source-available/leaked build) gains unauthorized access to whatever service this key authorizes."
+    recommendation: "Do not hardcode credentials. Retrieve them from a secure backend at runtime, or store them in the Keychain if they must persist on-device."
+
+- id: IOS-OBJC-S-002
+  name: "Hardcoded Password"
+  pattern: '(?i)(password|passwd|pwd)\s*=\s*@"[^"]{6,}"\s*;'
+  severity: "CRITICAL"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-259"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded password literal may have been found in the source code. Storing credentials directly in source is highly insecure."
+    recommendation: "Remove credentials from the code. Prompt the user or retrieve credentials from a secure backend/Keychain instead."
+
+- id: IOS-OBJC-S-003
+  name: "Hardcoded Private Key"
+  # Require base64 key material after the header, so a bare "-----BEGIN PRIVATE KEY-----" marker constant is not flagged.
+  pattern: '-----BEGIN( RSA| EC| OPENSSH| DSA)? PRIVATE KEY-----[\r\n\s]+[A-Za-z0-9+/]{40,}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-321"
+    masvs: "MSTG-CRYPTO-1"
+    description: "A private key block (e.g. RSA) was found embedded in the code. This completely compromises the security provided by the key."
+    recommendation: "Private keys should never ship inside the app bundle or source tree. Use the Keychain/Secure Enclave for on-device key material, or retrieve keys from a secure server at runtime."
+
+- id: IOS-OBJC-S-004
+  name: "Hardcoded AWS Access Key ID"
+  pattern: 'AKIA[0-9A-Z]{16}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "An AWS Access Key ID was found hardcoded in the app. If paired with its secret key (also often nearby), this grants direct access to whatever AWS resources the key's IAM policy allows."
+    recommendation: "Revoke this key in the AWS IAM console immediately, then remove it from the code. Mobile apps should never hold long-lived AWS credentials - use temporary credentials via Cognito Identity Pools or a backend-issued token instead."
+
+- id: IOS-OBJC-S-005
+  name: "Hardcoded Stripe Live Secret Key"
+  pattern: 'sk_live_[0-9a-zA-Z]{24,}'
+  severity: "CRITICAL"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A Stripe LIVE secret key was found hardcoded in the app. This key can create charges, issue refunds, and read all payment data on the connected Stripe account - a direct financial exposure, not just a data leak."
+    recommendation: "Roll this key immediately in the Stripe dashboard. Secret keys must never be shipped client-side; only publishable keys (pk_live_/pk_test_) belong in a mobile app, and all charge/refund logic must run server-side."
+
+- id: IOS-OBJC-S-006
+  name: "Hardcoded JWT"
+  pattern: 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'
+  severity: "MEDIUM"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A hardcoded JSON Web Token was found. If this is a real, live, long-lived token (as opposed to a test fixture), it grants whatever access its claims allow to anyone who reads the source."
+    recommendation: "Confirm whether this is test/fixture data. If it is a real token, revoke it and issue tokens dynamically per-session from the backend instead of embedding one statically."
+
+- id: IOS-OBJC-S-007
+  name: "Credentials Embedded in URL"
+  pattern: 'https?://[^/\s:]+:[^/\s@"]+@'
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-798"
+    masvs: "MSTG-STORAGE-1"
+    description: "A URL containing embedded username:password credentials (Basic Auth in the URL itself) was found. These credentials are visible in source, logs, and often browser/proxy history."
+    recommendation: "Remove credentials from the URL. Use an Authorization header set at request time from a securely stored credential, or better, an OAuth token flow."

narvy/rules/ios/objc/storage.yml

@@ -0,0 +1,45 @@
+# Objective-C local-storage checks.
+
+- id: IOS-OBJC-STORAGE-001
+  name: "Sensitive Data Stored in NSUserDefaults"
+  pattern: '(?i)\[[\w\s.\[\]]*userdefaults[\w\s.\]]*\s+setObject\s*:[^;]*forKey\s*:\s*@"[^"]*(password|token|secret|api[_-]?key)[^"]*"'
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-922"
+    masvs: "MSTG-STORAGE-1"
+    description: "A value is written to NSUserDefaults under a key that looks like a credential/token/secret. NSUserDefaults is a plaintext plist file, readable by anyone with filesystem access (jailbreak, backup extraction, or another process on a compromised device)."
+    recommendation: "Store credentials, tokens, and secrets in the Keychain (SecItemAdd with an appropriate kSecAttrAccessible level), never in NSUserDefaults."
+
+- id: IOS-OBJC-STORAGE-002
+  name: "Insecure Keychain Accessibility (Always)"
+  pattern: 'kSecAttrAccessibleAlways(ThisDeviceOnly)?\b'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-922"
+    masvs: "MSTG-STORAGE-1"
+    description: "kSecAttrAccessibleAlways lets the Keychain item be read even while the device is locked. The non-'ThisDeviceOnly' variant additionally allows the item to be restored onto a different device from an iCloud/iTunes backup."
+    recommendation: "Use kSecAttrAccessibleWhenUnlockedThisDeviceOnly (or WhenPasscodeSetThisDeviceOnly for the strongest guarantee) unless the item genuinely must be available before first unlock."
+
+- id: IOS-OBJC-STORAGE-003
+  name: "Sensitive Data Logged via NSLog"
+  pattern: '(?i)NSLog\s*\(\s*@"[^"]*(password|token|secret|api[_-]?key)[^"]*"'
+  severity: "MEDIUM"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-532"
+    masvs: "MSTG-STORAGE-3"
+    description: "NSLog output is readable via the device console, Console.app, and (on many crash reporters) uploaded with crash logs. Logging a value whose format string references a credential/token/secret risks leaking it."
+    recommendation: "Remove sensitive values from log statements entirely, or redact them (e.g. log only the last 4 characters) before logging."
+
+- id: IOS-OBJC-STORAGE-004
+  name: "File Protection Explicitly Disabled"
+  pattern: 'NSFileProtectionNone\b'
+  severity: "MEDIUM"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-922"
+    masvs: "MSTG-STORAGE-1"
+    description: "NSFileProtectionNone explicitly disables Data Protection encryption for a file, making it readable even while the device is locked (e.g. after a jailbreak that bypasses the lock screen)."
+    recommendation: "Use NSFileProtectionCompleteUntilFirstUserAuthentication (the iOS default) or NSFileProtectionComplete for files containing sensitive data. Only use NSFileProtectionNone for genuinely non-sensitive files that must be accessible during background execution while locked."

narvy/rules/ios/objc/webview.yml

@@ -0,0 +1,45 @@
+# Objective-C WebView configuration checks.
+
+- id: IOS-OBJC-WEBVIEW-001
+  name: "Deprecated UIWebView Usage"
+  pattern: '\bUIWebView\s*\*'
+  severity: "MEDIUM"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-1104"
+    masvs: "MSTG-PLATFORM-5"
+    description: "UIWebView is deprecated - Apple has rejected new App Store submissions using it since April 2020. It also lacks WKWebView's out-of-process JS execution and per-origin sandboxing, making JS-injection issues more impactful."
+    recommendation: "Migrate to WKWebView, which runs web content in a separate process and offers WKUserContentController for tighter control over injected scripts and message handlers."
+
+- id: IOS-OBJC-WEBVIEW-002
+  name: "JavaScript Evaluated via String Concatenation"
+  pattern: 'stringByEvaluatingJavaScriptFromString\s*:\s*\[NSString stringWithFormat'
+  severity: "HIGH"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-79"
+    masvs: "MSTG-PLATFORM-5"
+    description: "JavaScript is built via stringWithFormat and evaluated in the WebView. If any interpolated value can be influenced by untrusted input (deep link, server response, user input), this is JavaScript injection into the WebView's context."
+    recommendation: "Avoid building JS strings via string formatting. If dynamic values must be passed into JS, JSON-encode them and use a fixed template, or use WKScriptMessageHandler for structured native<->JS communication instead."
+
+- id: IOS-OBJC-WEBVIEW-003
+  name: "WebView Authentication Challenge Accepts Any Credential"
+  pattern: '(?s)webView\s*:\s*didReceiveAuthenticationChallenge\s*:.*?completionHandler\s*\(\s*NSURLSessionAuthChallengeUseCredential'
+  severity: "CRITICAL"
+  confidence: "MEDIUM"
+  details:
+    cwe: "CWE-295"
+    masvs: "MSTG-NETWORK-3"
+    description: "The WebView's authentication-challenge delegate method calls completionHandler with NSURLSessionAuthChallengeUseCredential, which accepts the credential/certificate offered without validating it - a trivial MITM path for content loaded in the WebView."
+    recommendation: "Validate the server trust (SecTrustEvaluateWithError against the expected certificate/public key) before calling completionHandler with UseCredential. Prefer NSURLSessionAuthChallengePerformDefaultHandling for the common case."
+
+- id: IOS-OBJC-WEBVIEW-004
+  name: "Universal File Access From File URLs Enabled"
+  pattern: 'setAllowUniversalAccessFromFileURLs\s*:\s*YES'
+  severity: "HIGH"
+  confidence: "HIGH"
+  details:
+    cwe: "CWE-940"
+    masvs: "MSTG-PLATFORM-5"
+    description: "allowUniversalAccessFromFileURLs lets JavaScript running in a file:// context reach any origin, including making cross-origin requests and reading local files - a well-known path to universal XSS / local file exfiltration."
+    recommendation: "Leave allowUniversalAccessFromFileURLs at its default (NO/false) unless there is a specific, reviewed need. If local HTML must load remote resources, load it via a custom URL scheme handler instead."

narvy/rules/ios_swift.yml

@@ -0,0 +1,327 @@
+# Swift source rules, authored by Narvy.
+# Keychain, TLS, crypto, WebView, pasteboard, secrets.
+
+rules:
+  - id: ios-swift-ecb-mode
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      ECB mode is used for encryption (kCCOptionECBMode). ECB is insecure
+      because identical plaintext blocks encrypt to identical ciphertext
+      blocks, revealing patterns. Use GCM or CBC with a random IV instead.
+    metadata:
+      cwe: CWE-327
+      masvs: MSTG-CRYPTO-4
+      category: crypto
+    pattern-either:
+      - pattern: CCCrypt(..., kCCOptionECBMode, ...)
+      - pattern-regex: 'kCCOptionECBMode'
+
+  - id: ios-swift-weak-cipher
+    languages: [swift]
+    severity: ERROR
+    message: "DES/3DES/RC4 are broken ciphers (kCCAlgorithmDES/3DES/RC4). Use AES-256-GCM instead."
+    metadata:
+      cwe: CWE-327
+      masvs: MSTG-CRYPTO-4
+      category: crypto
+    pattern-regex: 'kCCAlgorithm(DES|3DES|RC4)\b'
+
+  - id: ios-swift-weak-hash
+    languages: [swift]
+    severity: WARNING
+    message: "MD5/SHA-1 are broken for security-sensitive hashing (CommonCrypto CC_MD5/CC_SHA1 or CryptoKit Insecure.MD5/Insecure.SHA1). Use SHA256+."
+    metadata:
+      cwe: CWE-328
+      masvs: MSTG-CRYPTO-4
+      category: crypto
+    pattern-either:
+      - pattern: CC_MD5(...)
+      - pattern: CC_SHA1(...)
+      - pattern: Insecure.MD5.hash(...)
+      - pattern: Insecure.SHA1.hash(...)
+      - pattern: Insecure.MD5()
+      - pattern: Insecure.SHA1()
+
+  - id: ios-swift-weak-prng
+    languages: [swift]
+    severity: ERROR
+    message: "rand()/random()/drand48() are not cryptographically secure. Use SecRandomCopyBytes or CryptoKit for security-sensitive values."
+    metadata:
+      cwe: CWE-338
+      masvs: MSTG-CRYPTO-6
+      category: crypto
+    pattern-either:
+      - pattern: rand()
+      - pattern: random()
+      - pattern: drand48()
+      - pattern: arc4random() % $N
+
+  - id: ios-swift-hardcoded-crypto-key
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A symmetric encryption key/passphrase is built directly from a string
+      literal (SymmetricKey/CCCrypt/CCCryptorCreate). Anyone who reads the
+      source (or decompiles a source-available build) recovers the exact
+      key used to encrypt/decrypt all protected data.
+    metadata:
+      cwe: CWE-321
+      masvs: MSTG-CRYPTO-1
+      category: crypto
+    pattern-either:
+      - pattern: 'SymmetricKey(data: Data("...".utf8))'
+      - pattern: 'SymmetricKey(data: "...".data(using: $ENC)!)'
+      - pattern: CCCrypt(..., "...", ...)
+      - pattern: CCCryptorCreate(..., "...", ...)
+
+  - id: ios-swift-trust-all-certs
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      URLSession authentication challenge handler calls completionHandler
+      with .useCredential unconditionally - this accepts ANY server
+      certificate, disabling TLS validation entirely (trivial MITM).
+    metadata:
+      cwe: CWE-295
+      masvs: MSTG-NETWORK-3
+      category: network
+    pattern-either:
+      - pattern: 'completionHandler(.useCredential, URLCredential(trust: $T))'
+      - pattern: 'completionHandler(URLSession.AuthChallengeDisposition.useCredential, URLCredential(trust: $T))'
+
+  - id: ios-swift-webview-js-untrusted-concat
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      evaluateJavaScript() is called with a string built via concatenation
+      or interpolation instead of a fixed literal. If any part of the
+      string can be influenced by untrusted input (deep link, server
+      response, user input), this is JavaScript injection into the WebView.
+    metadata:
+      cwe: CWE-79
+      masvs: MSTG-PLATFORM-5
+      category: webview
+    patterns:
+      - pattern-either:
+          - pattern: $WV.evaluateJavaScript($A + $B, ...)
+          - pattern: $WV.evaluateJavaScript("...\($X)...", ...)
+
+  - id: ios-swift-uiwebview-deprecated
+    languages: [swift]
+    severity: WARNING
+    message: >-
+      UIWebView is deprecated (Apple rejects new App Store submissions using
+      it) and lacks WKWebView's process-isolation / modern security
+      protections (no per-origin sandboxing of JS, weaker WKUserContentController
+      controls). Migrate to WKWebView.
+    metadata:
+      cwe: CWE-1104
+      masvs: MSTG-PLATFORM-5
+      category: webview
+    pattern: UIWebView(...)
+
+  - id: ios-swift-log-sensitive-data
+    languages: [swift]
+    severity: WARNING
+    message: >-
+      A log statement (print/NSLog/os_log) includes a value whose name
+      looks like a credential/token/secret - readable via device console
+      logs, crash reporters, or (for print) even shipped in release builds
+      if not stripped.
+    metadata:
+      cwe: CWE-532
+      masvs: MSTG-STORAGE-3
+      category: logging
+    patterns:
+      - pattern-either:
+          - pattern: print($MSG)
+          - pattern: NSLog($MSG, ...)
+          - pattern: os_log($MSG, ...)
+      - metavariable-pattern:
+          metavariable: $MSG
+          patterns:
+            - pattern-regex: '(?i)(password|token|secret|api[_-]?key)'
+
+  - id: ios-swift-keychain-insecure-accessibility
+    languages: [swift]
+    severity: WARNING
+    message: >-
+      kSecAttrAccessibleAlways(ThisDeviceOnly) lets the Keychain item be
+      read even while the device is locked, and the non-"ThisDeviceOnly"
+      variants let it be restored onto a different device from an iCloud/
+      iTunes backup. Prefer kSecAttrAccessibleWhenUnlockedThisDeviceOnly.
+    metadata:
+      cwe: CWE-922
+      masvs: MSTG-STORAGE-1
+      category: storage
+    pattern-regex: 'kSecAttrAccessibleAlways\b'
+
+  - id: ios-swift-sql-injection
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      SQL built via string concatenation/interpolation is passed to a raw
+      exec/query call (sqlite3_exec or an ORM's rawQuery-style API). Use
+      parameterized queries (bound placeholders) instead.
+    metadata:
+      cwe: CWE-89
+      masvs: MSTG-PLATFORM-2
+      category: injection
+    pattern-either:
+      - pattern: sqlite3_exec($DB, $A + $B, ...)
+      - pattern: sqlite3_exec($DB, "...\($X)...", ...)
+      - pattern: sqlite3_prepare_v2($DB, $A + $B, ...)
+      - pattern: sqlite3_prepare_v2($DB, "...\($X)...", ...)
+      - pattern: sqlite3_prepare($DB, "...\($X)...", ...)
+      - pattern: $DB.executeQuery("...\($X)...", ...)
+      - pattern: $DB.executeQuery($A + $B, ...)
+      - pattern: $DB.executeUpdate("...\($X)...", ...)
+      - pattern: $DB.executeUpdate($A + $B, ...)
+
+  - id: ios-swift-sql-injection-string-build
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A SQL statement (SELECT/INSERT/UPDATE/DELETE/...) injects a value via
+      Swift string interpolation (\(...)) or concatenation (+). If the
+      interpolated/concatenated value derives from user input this is SQL
+      injection. Use parameterized queries with bound placeholders instead.
+    metadata:
+      cwe: CWE-89
+      masvs: MSTG-PLATFORM-2
+      category: injection
+    pattern-regex: |-
+      (?i)"\s*(?:SELECT\b[^"\n]*?\bFROM\b|INSERT\s+INTO\b|UPDATE\b[^"\n]*?\bSET\b|DELETE\s+FROM\b|REPLACE\s+INTO\b|(?:DROP|ALTER|CREATE)\s+TABLE\b)(?:[^"\n]*?'[^'\n]*\\\(|[^"\n]*?(?:=|==|<>|!=|<=|>=|<|>|\bLIKE\b|\bGLOB\b)\s*\\\(|[^"\n]*?(?:=|==|<>|!=|<=|>=|<|>|\bLIKE\b|\bGLOB\b)\s*"\s*\+)
+
+  - id: ios-swift-cleartext-http-url
+    languages: [swift]
+    severity: WARNING
+    message: >-
+      A hardcoded http:// (non-TLS) URL literal is used. Traffic to this
+      endpoint is sent in cleartext unless ATS exception domains force it
+      to upgrade - verify this isn't a real network destination.
+    metadata:
+      cwe: CWE-319
+      masvs: MSTG-NETWORK-1
+      category: network
+    pattern-regex: '"http://(?!localhost|127\.0\.0\.1)[^"]+"'
+
+  # Hardcoded cloud / third-party credentials: fixed-prefix high-entropy tokens.
+  - id: ios-swift-hardcoded-aws-access-key
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      An AWS Access Key ID (AKIA...) is hardcoded in Swift source. Paired
+      with its secret (often nearby), it grants direct access to whatever the
+      key's IAM policy allows. Revoke it in IAM now and remove it; mobile apps
+      should use temporary credentials (Cognito Identity Pools or a
+      backend-issued token), never a long-lived AWS key.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    pattern-regex: '\bAKIA[0-9A-Z]{16}\b'
+
+  - id: ios-swift-hardcoded-google-api-key
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A Google API key (AIza...) is hardcoded in Swift source. Depending on
+      the key's API restrictions this can be abused for billed API calls or
+      data access. Restrict/rotate the key in the Google Cloud console and
+      load it from a secure backend instead of embedding it.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    pattern-regex: '\bAIza[0-9A-Za-z\-_]{35}\b'
+
+  - id: ios-swift-hardcoded-stripe-secret-key
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A Stripe LIVE secret key (sk_live_...) is hardcoded in Swift source.
+      It can create charges, issue refunds and read all payment data - a
+      direct financial exposure. Roll it in the Stripe dashboard immediately;
+      only publishable keys (pk_live_/pk_test_) belong in a mobile app, and
+      charge/refund logic must run server-side.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    pattern-regex: '\bsk_live_[0-9a-zA-Z]{24,}\b'
+
+  - id: ios-swift-hardcoded-github-token
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A GitHub personal-access token (ghp_...) is hardcoded in Swift source.
+      Anyone who reads it gains whatever repo/org access the token carries.
+      Revoke it in GitHub settings and remove it from the source tree.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    pattern-regex: '\bghp_[A-Za-z0-9]{36}\b'
+
+  - id: ios-swift-hardcoded-slack-token
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A Slack token (xox[baprs]-...) is hardcoded in Swift source. It grants
+      whatever workspace access the token type allows. Revoke it in Slack and
+      remove it; load it from a secure backend if the app truly needs it.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    pattern-regex: '\bxox[baprs]-[0-9A-Za-z-]{10,48}\b'
+
+  - id: ios-swift-hardcoded-private-key
+    languages: [swift]
+    severity: ERROR
+    message: >-
+      A PEM private-key block is embedded in Swift source. Shipping a private
+      key inside the app bundle fully compromises whatever it protects. Use
+      the Keychain / Secure Enclave for on-device key material, or fetch keys
+      from a secure server at runtime.
+    metadata:
+      cwe: CWE-321
+      masvs: MSTG-CRYPTO-1
+      category: secrets
+    # Require base64 key material after the header, so a bare "-----BEGIN PRIVATE KEY-----" marker constant is not flagged.
+    pattern-regex: '-----BEGIN( RSA| EC| OPENSSH| DSA)? PRIVATE KEY-----[\r\n\s]+[A-Za-z0-9+/]{40,}'
+
+  - id: ios-swift-credentials-in-url
+    languages: [swift]
+    severity: WARNING
+    message: >-
+      A URL with embedded username:password credentials (Basic Auth in the
+      URL) is hardcoded in Swift source. These credentials leak into logs,
+      proxies and crash reports. Use an Authorization header set at request
+      time from a securely stored credential, or an OAuth token flow.
+    metadata:
+      cwe: CWE-798
+      masvs: MSTG-STORAGE-1
+      category: secrets
+    pattern-regex: '"https?://[^/\s:"]+:[^/\s@"]+@'
+
+  - id: ios-swift-userdefaults-sensitive-data
+    languages: [swift]
+    severity: WARNING
+    message: >-
+      A value is written to UserDefaults under a key that looks like a
+      credential/token/secret. UserDefaults (plist-backed) is unencrypted
+      and readable by anyone with filesystem access (jailbreak, backup
+      extraction) - use the Keychain for secrets instead.
+    metadata:
+      cwe: CWE-922
+      masvs: MSTG-STORAGE-1
+      category: storage
+    patterns:
+      - pattern: '$UD.set($VALUE, forKey: $KEY)'
+      - metavariable-pattern:
+          metavariable: $KEY
+          patterns:
+            - pattern-regex: '(?i)"[^"]*(password|token|secret|api[_-]?key)[^"]*"'