rules: - id: hardcoded-generic-secret patterns: - pattern-regex: '(?i)(?:api[_-]?key|api[_-]?secret|secret[_-]?key|access[_-]?token|auth[_-]?token)\s*[=:]\s*["\x27][A-Za-z0-9+/\-_]{20,}["\x27]' message: | Possible hardcoded secret detected. API keys, secret keys, and access tokens must not be committed to source code. Move this value to an environment variable. severity: HIGH languages: [generic] - id: hardcoded-stripe-secret-key patterns: - pattern-regex: 'sk_(?:live|test)_[A-Za-z0-9]{24,}' message: | Hardcoded Stripe secret key detected. This key grants full access to your Stripe account. Remove it immediately, rotate the key in the Stripe dashboard, and store it as an environment variable (STRIPE_SECRET_KEY). severity: CRITICAL languages: [generic] - id: hardcoded-openai-api-key patterns: - pattern-regex: 'sk-[A-Za-z0-9]{32,}' message: | Possible hardcoded OpenAI API key detected. Rotate this key immediately and store it as an environment variable (OPENAI_API_KEY). severity: CRITICAL languages: [generic] - id: hardcoded-anthropic-api-key patterns: - pattern-regex: 'sk-ant-[A-Za-z0-9_\-]{20,}' message: | Possible hardcoded Anthropic API key detected. This key grants access to your Claude API account and billing. Rotate it immediately in the Anthropic console and store it as an environment variable (ANTHROPIC_API_KEY). severity: CRITICAL languages: [generic] - id: hardcoded-jwt-secret patterns: - pattern-regex: '(?i)(?:jwt[_-]?secret|nextauth[_-]?secret|auth[_-]?secret)\s*[=:]\s*["\x27][^"\x27\s]{8,}["\x27]' message: | Possible hardcoded JWT or NextAuth secret detected. This value is used to sign tokens and must not be committed to source code. Move it to an environment variable. severity: CRITICAL languages: [generic] - id: hardcoded-database-url patterns: - pattern-regex: '(?i)(?:database[_-]?url|postgres[_-]?url|mysql[_-]?url|mongo[_-]?url)\s*[=:]\s*["\x27](?:postgres|postgresql|mysql|mongodb)://[^"\x27\s]+' message: | Hardcoded database connection string detected. This exposes database credentials. Move this value to an environment variable and add it to .gitignore. severity: CRITICAL languages: [generic] - id: next-public-secret patterns: - pattern-regex: 'NEXT_PUBLIC_(?:.*SECRET|.*KEY|.*TOKEN|.*PASSWORD)[^=\n]*=[^\n]+' message: | A secret-looking environment variable is prefixed with NEXT_PUBLIC_, which bundles it into the client-side JavaScript. Remove the NEXT_PUBLIC_ prefix and ensure this variable is only used in server-side code. severity: HIGH languages: [generic] paths: include: - "**/.env*" - id: env-file-with-secrets-committed patterns: - pattern-regex: '(?:STRIPE_SECRET_KEY|SUPABASE_SERVICE_ROLE_KEY|OPENAI_API_KEY|JWT_SECRET|NEXTAUTH_SECRET|DATABASE_URL)\s*=\s*.+' message: | This file contains what appears to be a real secret value. Ensure this file is listed in .gitignore and has never been committed to the repository. If it has been committed, rotate all secrets immediately. severity: CRITICAL languages: [generic] paths: include: - "**/.env" - "**/.env.local" - "**/.env.production" - "**/.env.development" - id: hardcoded-aws-access-key-id patterns: - pattern-regex: '\b(?:AKIA|ASIA)[0-9A-Z]{16}\b' message: | Hardcoded AWS access key ID detected (AKIA/ASIA prefix). This grants programmatic access to your AWS account. Remove it, rotate the key in IAM, and load credentials from the environment or an instance role. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-github-token patterns: - pattern-regex: '\b(?:gh[posru]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,})\b' message: | Hardcoded GitHub token detected (personal access, OAuth, or fine-grained token). This grants access to repositories and possibly your org. Revoke it in GitHub settings and store it as an environment secret. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-google-api-key patterns: - pattern-regex: '\bAIza[0-9A-Za-z_\-]{35}\b' message: | Hardcoded Google/Firebase API key detected (AIza prefix). Restrict the key by referrer/IP in the Google Cloud console, rotate it, and move it to an environment variable. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-private-key-block patterns: - pattern-regex: '-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY-----' message: | A private key PEM block appears to be committed to source. Private keys must never live in the repository. Remove it, rotate the key pair, and load the key from a secret store or mounted file. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A02:2021] - id: hardcoded-slack-token patterns: - pattern-regex: 'xox[baprs]-[0-9A-Za-z-]{10,}' message: | Hardcoded Slack token detected (xoxb/xoxa/xoxp/xoxr/xoxs prefix). This grants access to your Slack workspace and its data. Revoke it in the Slack app settings, rotate it, and store it as an environment variable. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-slack-webhook-url patterns: - pattern-regex: 'https://hooks\.slack\.com/services/T[0-9A-Za-z_]+/B[0-9A-Za-z_]+/[0-9A-Za-z]+' message: | Hardcoded Slack incoming webhook URL detected. Anyone with this URL can post messages into your Slack workspace. Delete the webhook in Slack, recreate it, and load the URL from an environment variable. severity: HIGH languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-twilio-credential patterns: - pattern-regex: '\b(?:AC|SK)[0-9a-fA-F]{32}\b' message: | Hardcoded Twilio credential detected (Account SID AC... or API key SK...). This grants access to your Twilio account and billing. Rotate it in the Twilio console and store it as an environment variable. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-sendgrid-api-key patterns: - pattern-regex: 'SG\.[0-9A-Za-z_-]{22}\.[0-9A-Za-z_-]{43}' message: | Hardcoded SendGrid API key detected (SG. prefix). This key can send email on your behalf. Revoke it in the SendGrid dashboard, rotate it, and store it as an environment variable. severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-npm-token patterns: - pattern-regex: '\bnpm_[0-9A-Za-z]{36}\b' message: | Hardcoded npm access token detected (npm_ prefix). This token can publish packages and read private registries under your account. Revoke it on npmjs.com and store it as an environment variable (NPM_TOKEN). severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021] - id: hardcoded-pypi-token patterns: - pattern-regex: 'pypi-AgEIcHlwaS[0-9A-Za-z_-]{50,}' message: | Hardcoded PyPI API token detected (pypi-AgEIcHlwaS prefix). This token can publish packages under your PyPI account. Revoke it on pypi.org and store it as an environment variable (TWINE_PASSWORD / PYPI_TOKEN). severity: CRITICAL languages: [generic] cwe: [CWE-798] owasp: [A07:2021]