narvy-cli 1.0.0__py3-none-any.whl

narvy/rules/web/secrets_supplement.yml

@@ -0,0 +1,383 @@
+# Additional credential patterns not covered by secrets.yml.
+# Loaded for every stack.
+
+rules:
+
+- id: narvy.secrets.github-pat-classic
+  pattern-regex: \bghp_[A-Za-z0-9]{36,}\b
+  languages:
+  - regex
+  message: >
+    GitHub Classic Personal Access Token detected (ghp_...). This token grants
+    direct API access to GitHub repositories and should never be hardcoded.
+    Rotate it immediately and store in an environment variable or secret manager.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - github
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+    - '*pnpm-lock*'
+
+- id: narvy.secrets.github-pat-fine-grained
+  pattern-regex: \bgithub_pat_[A-Za-z0-9_]{59,}\b
+  languages:
+  - regex
+  message: >
+    GitHub Fine-Grained Personal Access Token detected (github_pat_...).
+    This modern PAT format grants scoped repository access. Rotate immediately
+    and use environment variables or a secret manager.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - github
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+
+- id: narvy.secrets.github-oauth-token
+  pattern-regex: \bgho_[A-Za-z0-9]{36,}\b
+  languages:
+  - regex
+  message: >
+    GitHub OAuth Access Token detected (gho_...). This token provides OAuth
+    app access to GitHub. Rotate it immediately and store securely.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - github
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+
+- id: narvy.secrets.github-app-tokens
+  pattern-either:
+  - pattern-regex: \bghu_[A-Za-z0-9]{36,}\b
+  - pattern-regex: \bghs_[A-Za-z0-9]{36,}\b
+  - pattern-regex: \bghr_[A-Za-z0-9]{36,}\b
+  languages:
+  - regex
+  message: >
+    GitHub App token detected (ghu_/ghs_/ghr_ prefix). These tokens are issued
+    by GitHub Apps for user-to-server, server-to-server, or refresh flows.
+    They must not appear in source code. Rotate immediately.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - github
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+
+- id: narvy.secrets.gitlab-pat
+  pattern-regex: \bglpat-[A-Za-z0-9_-]{20,}\b
+  languages:
+  - regex
+  message: >
+    GitLab Personal Access Token detected (glpat-...). This token grants API
+    access to GitLab projects. Rotate immediately and store in an environment
+    variable or secret manager.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - gitlab
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+
+- id: narvy.secrets.openai-api-key
+  pattern-either:
+  - pattern-regex: \bsk-[A-Za-z0-9]{32,}\b
+  - pattern-regex: \bsk-proj-[A-Za-z0-9]{32,}\b
+  languages:
+  - regex
+  message: >
+    OpenAI API Key detected (sk-... or sk-proj-...). This key allows billing
+    charges and access to OpenAI models. Rotate immediately via the OpenAI
+    dashboard and store in an environment variable.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - openai
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+    - '*.test.*'
+    - '*_test.*'
+    - '*test_*'
+
+- id: narvy.secrets.npm-access-token
+  pattern-regex: \bnpm_[A-Za-z0-9]{36,}\b
+  languages:
+  - regex
+  message: >
+    npm Access Token detected (npm_...). This token allows publishing packages
+    to the npm registry under your account. Rotate immediately and store in
+    CI/CD secrets or environment variables.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - npm
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+
+- id: narvy.secrets.sendgrid-api-key
+  pattern-regex: \bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b
+  languages:
+  - regex
+  message: >
+    SendGrid API Key detected (SG.<22>.<43>). This key allows sending emails
+    from your SendGrid account. Rotate immediately via the SendGrid dashboard.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - sendgrid
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+
+- id: narvy.secrets.google-api-key
+  pattern-regex: \bAIza[0-9A-Za-z_-]{35}\b
+  languages:
+  - regex
+  message: >
+    Google API Key detected (AIza...). This key may enable access to Google
+    Maps, Firebase, Cloud APIs, or other Google services. Restrict it in the
+    Google Cloud Console and store in environment variables.
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    - google
+    - firebase
+    confidence: HIGH
+    subcategory:
+    - vuln
+    likelihood: HIGH
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+    - '*.xcscmblueprint'
+
+- id: narvy.secrets.generic-high-entropy-assignment
+  patterns:
+  - pattern-regex: (?i)(?:(?:api_?|secret_?|private_?|client_?|auth_?|access_?)?(?:key|secret|token|password|passwd))\s*[=:]\s*["'`](?P<SECRET>[A-Za-z0-9+/=_\-]{20,})["'`]
+  - pattern-not-regex: (?i)(?:example|sample|test|fake|placeholder|dummy|changeme|your_|replace|xxxx|todo|fixme|\$\{|\$\(|%[A-Z])
+  - pattern-not-regex: (?i)(?:https?://|jdbc:|mongodb://|redis://|postgres://)
+  - pattern-not-regex: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
+  - metavariable-analysis:
+      analyzer: entropy
+      metavariable: $SECRET
+  languages:
+  - regex
+  message: >
+    High-entropy value assigned to a sensitive variable name detected. This
+    pattern matches hardcoded secrets (API keys, passwords, tokens) based on
+    both variable naming context and Shannon entropy of the value. Review and
+    move this secret to an environment variable or secret manager.
+  severity: WARNING
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    - 'CWE-321: Use of Hard-coded Cryptographic Key'
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    category: security
+    technology:
+    - secrets
+    confidence: MEDIUM
+    subcategory:
+    - audit
+    likelihood: MEDIUM
+    impact: HIGH
+    vulnerability_class:
+    - Hard-coded Secrets
+    source: narvy-local
+  paths:
+    exclude:
+    - '*.svg'
+    - '*go.sum'
+    - '*package-lock.json'
+    - '*yarn.lock'
+    - '*Podfile.lock'
+    - '*cargo.lock'
+    - '*pnpm-lock*'
+    - '*.xcscmblueprint'
+    - '*.min.js'
+    - '*bundle.js'
+    - '*vendor/*'
+    - '*node_modules/*'
+    - '*test*'
+    - '*spec*'
+    - '*mock*'
+    - '*fixture*'

narvy/sca/__init__.py

@@ -0,0 +1 @@
+"""Software Composition Analysis: third-party dependency CVE scanning."""