narvy-cli 1.0.0__py3-none-any.whl

narvy/rules/web/secrets.yml

@@ -0,0 +1,1420 @@
+# Cross-language hardcoded-credential rules, authored by Narvy.
+# Provider tokens and generic high-entropy assignments. Loaded for every stack.
+
+rules:
+- id: narvy.secrets.aws-access-key-id
+  patterns:
+  - pattern-regex: \b(AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA)[A-Z0-9]{16}\b
+  - pattern-not-regex: (?i)(example|sample|test|fake|dummy)
+  languages:
+  - regex
+  message: AWS Access Key ID detected (AKIA/ASIA/AGPA/... 16-char format). This credential grants direct
+    API access to an AWS account. Revoke it in IAM immediately and load credentials from the environment,
+    an instance role, or a secrets manager instead.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.aws-secret-access-key
+  patterns:
+  - pattern-regex: (?i)\baws[a-z0-9_]*secret[a-z0-9_]*\s*(=|:|=>)\s*['\"`]?[A-Za-z0-9/+]{40}['\"`]?
+  - pattern-not-regex: (?i)(example|sample|placeholder|dummy|xxxx|00000000|changeme)
+  languages:
+  - regex
+  message: A variable named like an AWS secret access key is assigned a 40-char base64-alphabet literal.
+    AWS secret keys must never be committed; rotate the key and read it from the environment or a secrets
+    manager.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.aws-session-token
+  patterns:
+  - pattern-regex: (?i)aws_session_token\s*(=|:|=>)\s*['\"`]?[A-Za-z0-9/+=]{32,}['\"`]?
+  - pattern-not-regex: (?i)(example|sample|placeholder|dummy)
+  languages:
+  - regex
+  message: An AWS_SESSION_TOKEN-style variable is assigned a long literal value. Session tokens are short-lived
+    but still grant active AWS API access if leaked; do not hardcode them.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.aws-appsync-key
+  pattern-regex: \bda2-[a-z0-9]{26}\b
+  languages:
+  - regex
+  message: AWS AppSync GraphQL API key detected (da2-... format).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    - appsync
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.amazon-mws-token
+  pattern-regex: \bamzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b
+  languages:
+  - regex
+  message: Amazon Marketplace Web Service (MWS) auth token detected (amzn.mws.<uuid> format). This grants
+    seller-account API access.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.terraform-aws-provider-static-credentials
+  patterns:
+  - pattern-inside: "provider \"aws\" {\n  ...\n}\n"
+  - pattern-either:
+    - pattern: 'access_key = "..."
+
+        '
+    - pattern: 'secret_key = "..."
+
+        '
+  languages:
+  - hcl
+  message: A Terraform `provider "aws"` block hardcodes access_key/secret_key instead of using an instance
+    profile, SSO, or environment credentials. Anyone with read access to this .tf file (or state backend
+    history) gets live AWS credentials.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    - terraform
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.terraform-lambda-env-credentials
+  patterns:
+  - pattern-inside: "resource \"aws_lambda_function\" \"...\" {\n  ...\n  environment {\n    variables\
+      \ = {\n      ...\n    }\n  }\n  ...\n}\n"
+  - pattern: '$KEY = "..."
+
+      '
+  - metavariable-regex:
+      metavariable: $KEY
+      regex: ^(AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)$
+  languages:
+  - hcl
+  message: An AWS Lambda `environment { variables = {...} }` block hardcodes an AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
+    / AWS_SESSION_TOKEN literal. Lambda already has an execution role, so static keys in the function
+    definition leak through the console, CloudFormation template, and state file.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-326: Inadequate Encryption Strength'
+    owasp:
+    - A02:2021 - Cryptographic Failures
+    - A04:2025 - Cryptographic Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    - terraform
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Cryptographic Issues
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.terraform-rds-hardcoded-password
+  patterns:
+  - pattern-either:
+    - patterns:
+      - pattern: 'password = "..."
+
+          '
+      - pattern-inside: "resource \"aws_db_instance\" \"...\" {\n  ...\n}\n"
+    - patterns:
+      - pattern: 'master_password = "..."
+
+          '
+      - pattern-inside: "resource \"aws_rds_cluster\" \"...\" {\n  ...\n}\n"
+  languages:
+  - hcl
+  message: An `aws_db_instance` or `aws_rds_cluster` Terraform resource sets `password` / `master_password`
+    to a literal string instead of sourcing it from a `random_password` resource or a secrets manager
+    reference.
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    - terraform
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.python-boto3-hardcoded-credential
+  patterns:
+  - pattern-either:
+    - pattern: 'boto3.client(..., $CRED="...", ...)
+
+        '
+    - pattern: 'boto3.resource(..., $CRED="...", ...)
+
+        '
+    - pattern: 'boto3.Session(..., $CRED="...", ...)
+
+        '
+  - metavariable-regex:
+      metavariable: $CRED
+      regex: (aws_access_key_id|aws_secret_access_key|aws_session_token)$
+  languages:
+  - python
+  message: A boto3 client/resource/Session constructor is called with a literal string for aws_access_key_id
+    / aws_secret_access_key / aws_session_token. Let boto3 pick up credentials from the environment, ~/.aws/credentials,
+    or an instance/task role instead.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - aws
+    - boto3
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.stripe-secret-key
+  pattern-regex: \bsk_live_[0-9a-zA-Z]{24,}\b
+  languages:
+  - regex
+  message: Stripe live secret key detected (sk_live_...). This key can move money and read all customer/payment
+    data on the account. Revoke it in the Stripe dashboard and use environment-provided credentials.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - stripe
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.stripe-restricted-key
+  pattern-regex: \brk_live_[0-9a-zA-Z]{24,}\b
+  languages:
+  - regex
+  message: Stripe restricted live API key detected (rk_live_...). Scope is narrower than a full secret
+    key but it still grants live API access and should not be hardcoded.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - stripe
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.square-access-token
+  pattern-regex: \bsq0atp-[0-9A-Za-z\-_]{22}\b
+  languages:
+  - regex
+  message: Square access token detected (sq0atp-... format).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - square
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.square-oauth-secret
+  pattern-regex: \bsq0csp-[0-9A-Za-z\-_]{43}\b
+  languages:
+  - regex
+  message: Square OAuth application secret detected (sq0csp-... format).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - square
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.paypal-braintree-token
+  pattern-regex: access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32}
+  languages:
+  - regex
+  message: PayPal / Braintree production access token detected (access_token$production$...$... format).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - paypal
+    - braintree
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.picatic-api-key
+  pattern-regex: \bsk_live_[0-9a-z]{32}\b
+  languages:
+  - regex
+  message: Picatic live secret key detected (sk_live_ + 32 lowercase alphanumeric). Note this shares the
+    sk_live_ prefix with Stripe; the 32-char lowercase-only body is Picatic's distinct format.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - picatic
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.twilio-api-key
+  pattern-regex: \bSK[0-9a-fA-F]{32}\b
+  languages:
+  - regex
+  message: Twilio API key SID detected (SK followed by 32 hex chars). Pair with a leaked API secret this
+    grants full Twilio account API access (SMS, calls, billing).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - twilio
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.mailgun-api-key
+  pattern-regex: \bkey-[0-9a-zA-Z]{32}\b
+  languages:
+  - regex
+  message: Mailgun API key detected (key-... format, legacy but still accepted by Mailgun's v3 API).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - mailgun
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.mailchimp-api-key
+  pattern-regex: \b[0-9a-f]{32}-us[0-9]{1,2}\b
+  languages:
+  - regex
+  message: MailChimp API key detected (32 hex chars + -usNN datacenter suffix).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - mailchimp
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.slack-token
+  pattern-either:
+  - pattern-regex: \bxox[baop]-[0-9]{10,13}-[0-9]{10,13}-[0-9a-zA-Z]{24,32}\b
+  - pattern-regex: \bxoxr-[0-9]{10,13}-[0-9]{10,13}-[0-9a-zA-Z]{24,32}\b
+  languages:
+  - regex
+  message: Slack token detected (xoxb-/xoxp-/xoxa-/xoxo- bot/user/app/legacy token format). Grants workspace
+    API access as the associated app or user.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - slack
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.slack-webhook
+  patterns:
+  - pattern-regex: https://hooks\.slack\.com/services/T[A-Za-z0-9_]{8,12}/B[A-Za-z0-9_]{8,12}/[A-Za-z0-9_]{20,32}
+  - pattern-not-regex: T0{8}|B0{8}|X{20,}
+  languages:
+  - regex
+  message: Slack Incoming Webhook URL detected. Anyone holding this URL can post messages into the target
+    channel as the configured integration.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - slack
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.outlook-webhook-url
+  pattern-regex: https://outlook\.office\.com/webhook/[0-9a-fA-F-]{36}
+  languages:
+  - regex
+  message: Microsoft Outlook / Office connector webhook URL detected (outlook.office.com/webhook/<guid>).
+    Lets anyone holding the URL post into the connected Outlook group.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - outlook
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.telegram-bot-token
+  patterns:
+  - pattern-regex: \b[0-9]{6,12}:AA[0-9A-Za-z_-]{33}\b
+  - pattern-not-regex: go\.mod|v[0-9]+\.[0-9]+\.[0-9]+
+  languages:
+  - regex
+  message: Telegram Bot API token detected (<numeric-id>:AA<33 chars> format). Full control of the bot
+    (send messages, read updates) for anyone holding this token.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - telegram
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.onfido-live-token
+  pattern-regex: \bapi_live(?:_[a-zA-Z]{2})?\.[a-zA-Z0-9_-]{11}\.[a-zA-Z0-9_-]{32}\b
+  languages:
+  - regex
+  message: Onfido live API token detected (api_live[_xx].<11 chars>.<32 chars> format). Grants live identity-verification
+    API access.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - onfido
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.heroku-api-key
+  pattern-regex: (?i)heroku[^\n]{0,50}[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
+  languages:
+  - regex
+  message: A variable/string near the word 'heroku' holds a UUID-shaped value. Heroku API keys are UUIDs;
+    treat any hardcoded UUID adjacent to a heroku reference as a leaked credential.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - heroku
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.hockeyapp-api-key
+  pattern-regex: (?i)\b(hockeyapp[_.]?api[_.]?token|hockey_app_token|HOCKEYAPP_API_TOKEN)\s*[:=]\s*[\"'`]?[0-9a-f]{32}\b
+  languages:
+  - regex
+  message: A value is assigned directly to a HockeyApp/App Center API-token variable name (e.g. `apiToken`
+    in a Gradle `hockeyapp {}` block, or the `HOCKEYAPP_API_TOKEN` env var used by CI plugins) and holds
+    a 32-char hex string, the token's known length.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - hockeyapp
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.codeclimate-token
+  pattern-regex: (?i)\bCC_TEST_REPORTER_ID\s*[:=]\s*[\"'`]?[0-9a-f]{64}\b
+  languages:
+  - regex
+  message: A value is assigned directly to `CC_TEST_REPORTER_ID`, the exact environment variable name
+    Code Climate's `test-reporter` binary reads its upload token from, and holds a 64-char hex string,
+    the token's known length.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - codeclimate
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.sonarqube-token
+  pattern-regex: (?i)\b(sonar\.(login|token|password)|SONAR_TOKEN|SONARQUBE_TOKEN)\s*[:=]\s*[\"'`]?[0-9a-f]{40}\b
+  languages:
+  - regex
+  message: A value is assigned directly to a documented SonarScanner auth parameter (`sonar.login` /
+    `sonar.token` / `sonar.password`, or the `SONAR_TOKEN` env var) and holds a 40-char hex string, matching
+    a SonarQube/SonarCloud user token's known length.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - sonarqube
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*go.mod'
+    - '*package.json'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*pnpm-lock*'
+    - '*Podfile.lock'
+    - '*Cargo.lock'
+    - '*.xcscmblueprint'
+- id: narvy.secrets.saucelabs-token
+  pattern-regex: (?i)\b(SAUCE_ACCESS_KEY|sauceAccessKey|sauce[_-]?access[_-]?key)\s*[:=]\s*[\"'`]?[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[0-9a-f]{4}-[0-9a-f]{12}\b
+  languages:
+  - regex
+  message: A value is assigned directly to `SAUCE_ACCESS_KEY` (or the equivalent `sauceAccessKey` config
+    property used by WebDriver/Sauce Connect integrations) and is a UUIDv4, the documented shape of a
+    Sauce Labs access key.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - saucelabs
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.facebook-access-token
+  pattern-regex: (?i)\b(fb|facebook|graph)[a-z0-9_]{0,15}(access)?_?token\s*[:=]\s*[\"'`]?EAA[A-Za-z0-9]{20,}
+  languages:
+  - regex
+  message: A value is assigned directly to a Facebook/Meta-token-looking variable name and starts with
+    `EAA`, the prefix Meta's Graph API has used on every issued user/page/app access token since the
+    API's early versions. Meta does not publish a formal token format spec (their own docs describe
+    access tokens only as "opaque strings" of variable length), so this is a context+prefix heuristic,
+    not a fingerprint match against a documented format. Treat findings as a strong lead, not certainty.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - facebook
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.facebook-oauth-token
+  pattern-regex: (?i)facebook[^\n]{0,80}token[^\n]{0,20}[\"'`]?[0-9a-f]{32}[\"'`]?
+  languages:
+  - regex
+  message: A variable/string containing 'facebook' near 'token' holds a 32-char hex value, matching a
+    Facebook OAuth token shape.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - facebook
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.google-oauth-access-token
+  pattern-regex: \bya29\.[0-9A-Za-z_-]{20,}\b
+  languages:
+  - regex
+  message: Google OAuth2 access token detected (ya29.<token> format).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - google
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.google-service-account-json
+  pattern-regex: '[\"''`]?type[\"''`]?\s*(:|=>|=)\s*[\"''`]?service_account[\"''`]?'
+  languages:
+  - regex
+  message: 'A JSON blob with `"type": "service_account"` was found in source. GCP service-account key
+    files grant standing API access scoped to IAM roles and must never be committed. Store them in a
+    secrets manager or workload-identity federation instead.'
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - gcp
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.artifactory-password
+  patterns:
+  - pattern-either:
+    - pattern-regex: (?i)artifactory[^\n]{0,80}\bAP[2-9A-F][A-Za-z0-9]{8,}\b
+    - pattern-regex: \bAP[2-9A-F][A-Za-z0-9]{8,}\b[^\n]{0,80}(?i)artifactory
+  - pattern-not-regex: (?i)sha(1|2|3|118|256|512)
+  languages:
+  - regex
+  message: JFrog Artifactory encrypted password detected (AP[2-9ABCDEF]... high-entropy token), co-located
+    with the word 'artifactory'.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - artifactory
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*go.mod'
+    - '*package.json'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*pnpm-lock*'
+    - '*Podfile.lock'
+    - '*Cargo.lock'
+    - '*.xcscmblueprint'
+- id: narvy.secrets.artifactory-token
+  patterns:
+  - pattern-regex: \bAKC[a-zA-Z0-9]{10,}\b
+  - pattern-not-regex: (?i)sha(128|256|512)
+  languages:
+  - regex
+  message: JFrog Artifactory API token detected (AKC... high-entropy prefix).
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - artifactory
+    confidence: LOW
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*go.mod'
+    - '*package.json'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*pnpm-lock*'
+    - '*Podfile.lock'
+    - '*Cargo.lock'
+    - '*.xcscmblueprint'
+- id: narvy.secrets.npm-registry-authtoken-assignment
+  patterns:
+  - pattern-regex: //[^\s=]+/?:_(authToken|password)=\S+
+  - pattern-not-regex: \$\{|%s|<[A-Za-z_]+>
+  languages:
+  - regex
+  message: An .npmrc-style registry auth line (`//<registry-host>/:_authToken=` or `:_password=`) holds a
+    literal token instead of an `${NPM_TOKEN}`-style environment interpolation. Anyone with read access to
+    the file can publish to that registry as you. Move the token to an env var and reference it here.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - npm
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.kubernetes-secret-manifest-committed-value
+  patterns:
+  - pattern: |
+      kind: Secret
+      ...
+      data:
+        ...
+        $KEY: $VALUE
+        ...
+  - metavariable-regex:
+      metavariable: $VALUE
+      regex: ^(?!([A-Za-z0-9+/])\1{6,}=*$)[A-Za-z0-9+/]{24,}={0,2}$
+  languages:
+  - yaml
+  message: 'A `kind: Secret` document''s `data:` map has a value that decodes as base64 committed directly
+    to the manifest. Kubernetes Secrets are only base64-encoded, not encrypted at rest by default. Use
+    Sealed Secrets, SOPS, or an external secrets operator instead of committing the encoded value.'
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - kubernetes
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.gradle-password-hardcoded
+  patterns:
+  - pattern: '$PASS = $ENVCALL ?: "$FALLBACK"
+
+      '
+  - metavariable-regex:
+      metavariable: $PASS
+      regex: (?i).*(password|passwd|secret|apikey|token|credential)
+  - metavariable-regex:
+      metavariable: $FALLBACK
+      regex: (?i)^(?!.*(placeholder|changeme|change_me|example|dummy|xxx|todo|fixme|your_|replace_?me|insert_)).*$
+  languages:
+  - kotlin
+  message: 'A `build.gradle.kts` variable named like a password/credential falls back to a literal default
+    when the matching env var is unset (`val PASS = System.getenv("X") ?: "literal"`). The literal fallback
+    ships in every build and in version control.'
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - gradle
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+  paths:
+    include:
+    - '*build.gradle.kts'
+- id: narvy.secrets.detected-private-key
+  message: A PEM-encoded private key block ('-----BEGIN ... PRIVATE KEY-----') was found in source. Private
+    keys must never ship in a repository. Rotate the key pair and load the key from a secrets manager,
+    KMS, or an untracked local file.
+  severity: ERROR
+  languages:
+  - regex
+  pattern-regex: '-----BEGIN\s+((RSA|DSA|EC|OPENSSH|PGP)\s+)?PRIVATE KEY(\s+BLOCK)?-----'
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.pgp-private-key-block
+  pattern-regex: '-----BEGIN\s+PGP\s+PRIVATE\s+KEY\s+BLOCK-----'
+  languages:
+  - regex
+  message: 'A PGP private key block (''-----BEGIN ... PGP PRIVATE ... KEY BLOCK-----'') was found in source.
+    Treat identically to any other private key leak: rotate and remove from history.'
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - pgp
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.credentials-in-uri
+  patterns:
+  - pattern: '$SCHEME://$USER:$PASS@$HOST
+
+      '
+  - metavariable-regex:
+      metavariable: $SCHEME
+      regex: (?i)^(https?|ftp|smtp|ssh|sftp|postgres(ql)?|mysql|mongodb(\+srv)?|redis|amqp|ldap)$
+  - metavariable-regex:
+      metavariable: $PASS
+      regex: ^.{3,64}$
+  - pattern-not-regex: (?i)(user|username|xxxx|\$\{|%s|<[a-z_]+>|localhost)
+  languages:
+  - generic
+  message: A connection string / URL embeds a username:password before the host (scheme://user:pass@host).
+    Database, message-queue, and API URIs with inline credentials leak into logs, shell history, and process
+    listings. Pass credentials via a separate auth mechanism or env var instead.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - database
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.etc-shadow-contents
+  message: Contents matching a Linux /etc/shadow entry (root:$hash:...) were found in source. A committed
+    shadow file leaks every local account's password hash for offline cracking.
+  severity: ERROR
+  languages:
+  - regex
+  pattern-regex: '^\s*root:[$!*][^\n:]*:[0-9]*:[0-9]*:'
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.bcrypt-hash-hardcoded
+  pattern-regex: \$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}
+  languages:
+  - regex
+  message: A bcrypt password hash ($2a$/$2b$/$2y$ + cost + 53-char salt+hash) is hardcoded. Even though
+    it's a hash and not the plaintext, a committed hash is crackable offline and usually indicates a seeded/default
+    account. Verify it is test-only or remove it.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - bcrypt
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: LOW
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.ssh-password-cli
+  pattern-regex: sshpass\s+-p\s*['\"][^'\"%]
+  languages:
+  - regex
+  message: '`sshpass -p` passes an SSH password as a plaintext CLI argument, which is visible to every
+    local user via `ps` and lands in shell history. Use `sshpass -f <file>` reading from a private, restricted-permission
+    file, or switch to key-based auth.'
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - ssh
+    confidence: MEDIUM
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.ruby-hardcoded-http-basic-auth
+  pattern: http_basic_authenticate_with ..., :password => "...", ...
+  languages:
+  - ruby
+  message: A `http_basic_authenticate_with` call hardcodes the `:password` option. This isn't limited to
+    `ApplicationController` subclasses. API-only controllers and controllers that pull the method in
+    via a concern/module call it the same way. Anyone with source access has the credential; move it to
+    Rails credentials / an env var.
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - ruby
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.ruby-rsa-passphrase-hardcoded
+  pattern-either:
+  - pattern: 'OpenSSL::PKey::RSA.new(..., ''...'')
+
+      '
+  - pattern: 'OpenSSL::PKey::RSA.new(...).to_pem(..., ''...'')
+
+      '
+  - pattern: 'OpenSSL::PKey::RSA.new(...).export(..., ''...'')
+
+      '
+  languages:
+  - ruby
+  message: An `OpenSSL::PKey::RSA` key is constructed, exported, or PEM-encoded with a literal string
+    passphrase argument. The passphrase protects the private key at rest, and hardcoding it defeats that
+    protection entirely.
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - ruby
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.js-express-session-hardcoded-secret
+  patterns:
+  - pattern-either:
+    - pattern-inside: '$SESSION = require(''express-session'')
+
+        ...
+
+        '
+    - pattern-inside: 'import $SESSION from ''express-session''
+
+        ...
+
+        '
+  - pattern: '$APP.use($SESSION({ ..., secret: "...", ... }))
+
+      '
+  languages:
+  - javascript
+  - typescript
+  message: '`express-session` is configured with a literal `secret:` string. This secret signs the session-id
+    cookie; a hardcoded value lets anyone who reads the source forge valid session cookies.'
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - express
+    - jwt
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0
+- id: narvy.secrets.js-jsonwebtoken-hardcoded-secret
+  patterns:
+  - pattern-either:
+    - pattern-inside: '$JWT = require("jsonwebtoken")
+
+        ...
+
+        '
+    - pattern-inside: 'import $JWT from "jsonwebtoken"
+
+        ...
+
+        '
+  - pattern-either:
+    - pattern: '$JWT.sign($DATA, "...", ...)
+
+        '
+    - pattern: '$JWT.verify($DATA, "...", ...)
+
+        '
+  languages:
+  - javascript
+  - typescript
+  message: '`jsonwebtoken`''s `sign()`/`verify()` is called with a literal string as the secret/key argument.
+    This is the value that authenticates every issued token; a hardcoded copy in source lets anyone forge
+    tokens.'
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - javascript
+    - jwt
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: MEDIUM
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+    license: Apache-2.0