[
  {
    "id": "a02_hardcoded_aws_access_key",
    "strategy": "known_format",
    "pattern": "\\bAKIA[0-9A-Z]{16}\\b",
    "label": "AWS Access Key ID",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_aws_secret_key",
    "strategy": "known_format",
    "pattern": "\\b[A-Za-z0-9/+]{40}\\b(?=.*(?:aws|secret|secret_?key))",
    "ignore_case": true,
    "label": "Potential AWS Secret Access Key",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_stripe_secret",
    "strategy": "known_format",
    "pattern": "\\bsk_live_[0-9a-zA-Z]{24,}\\b",
    "label": "Stripe Live Secret Key",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_github_token",
    "strategy": "known_format",
    "pattern": "\\b(?:ghp|gho|ghs|ghr)_[0-9A-Za-z]{36,}\\b",
    "label": "GitHub Personal Access Token",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_google_api_key",
    "strategy": "known_format",
    "pattern": "\\bAIza[0-9A-Za-z\\-_]{35}\\b",
    "label": "Google API Key",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_sendgrid_key",
    "strategy": "known_format",
    "pattern": "\\bSG\\.[0-9A-Za-z\\-_]{22}\\.[0-9A-Za-z\\-_]{43}\\b",
    "label": "SendGrid API Key",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_slack_token",
    "strategy": "known_format",
    "pattern": "\\bxox[baprs]-[0-9A-Za-z\\-]{10,}\\b",
    "label": "Slack Token",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_connection_string",
    "strategy": "known_format",
    "pattern": "(?:mongodb|postgres|postgresql|mysql|redis|amqp|mssql|oracle)(?:\\+[a-z]+)?://[^:@\\s\"'`]{1,64}:[^@\\s\"'`]{4,128}@",
    "ignore_case": true,
    "label": "Database Connection String with Embedded Credentials",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_private_key_pem",
    "strategy": "known_format",
    "pattern": "-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",
    "label": "Private Key (PEM block)",
    "cwe": "CWE-321",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_jwt_secret",
    "strategy": "known_format",
    "pattern": "(?:jwt|jsonwebtoken).*?(?:secret|key)\\s*[=:]\\s*[\"'`](?P<val>[^\"'`]{12,})[\"'`]",
    "ignore_case": true,
    "label": "Hardcoded JWT Secret",
    "cwe": "CWE-321",
    "owasp": "A02",
    "severity": "critical",
    "confidence": "high",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Secret in Source Code \u2014 {label} in {file_path}",
    "description_template": "A {label} pattern was detected hardcoded directly in the source file at line {line}. Hardcoded credentials are readable by anyone with repository access (including git history) and cannot be rotated without a code change and redeployment.",
    "recommendation_template": "1. Immediately rotate the exposed {label}.\n2. Remove the hardcoded value from source code.\n3. Load it at runtime from environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager).\n4. Add the file to .gitignore if it is a config file that must contain secrets.\n5. Scan git history for prior exposure: `git log -p | grep -i secret`",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_hardcoded_credential_assignment",
    "strategy": "variable_assignment",
    "name_pattern": "(?:^|[\\s,({[=:])(?P<name>[a-zA-Z_][a-zA-Z0-9_]*(?:password|passwd|pwd|secret|api_?key|auth_?token|access_?token|private_?key|jwt_?secret|client_?secret|signing_?key|encryption_?key|db_?pass|database_?pass|mongo_?pass)[a-zA-Z0-9_]*)\\s*[=:]\\s*(?P<q>[\"'`])(?P<val>[^\"'`\\n]{6,200})(?P=q)",
    "ignore_case": true,
    "placeholder_pattern": "^(?:your[-_]?.*|changeme|placeholder|example.*|todo.*|xxx+|dummy.*|sample.*|fake.*|mock.*|test.*|<[^>]+>|\\*+|password|secret|token|key|none|null|undefined|replace.*|insert.*|here|put.?your.*|my.?password|my.?secret|[a-z_]+_here|enter.?your|type.?your)$",
    "env_ref_pattern": "process\\.env\\.|os\\.environ|os\\.getenv|\\$\\{|getenv\\(|System\\.getenv|ENV\\[|config\\[|secrets\\.|vault\\.",
    "cwe": "CWE-798",
    "owasp": "A02",
    "severity": "high",
    "confidence": "medium",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Hardcoded Credential Assignment \u2014 '{name}' in {file_path}",
    "description_template": "The variable '{name}' appears to hold a credential and is assigned a non-placeholder string literal at line {line}. If this is a real secret, it is exposed to anyone with access to the source code or git history.",
    "recommendation_template": "Replace the hardcoded value of '{name}' with an environment variable:\n  # Python: {name} = os.environ['VAR_NAME']\n  # Node.js: const {name} = process.env.VAR_NAME\nStore the actual value in a .env file (gitignored) locally and in a secrets manager in production.",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"
    ]
  }
]
