[
  {
    "id": "a02_sensitive_data_plaintext_render",
    "check_type": "plaintext_render",
    "pattern": "<(?:label|span|p|div|h[1-6]|td|th|li|code|pre|blockquote)[^>]*>[^<{]*\\{[^{}()]*(?:password|passwd|pwd|secret|token|api_?key|credential)[^{}()]*\\}",
    "ignore_case": true,
    "multiline": false,
    "severity": "critical",
    "confidence": "high",
    "owasp": "A02",
    "cwe": "CWE-312",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Sensitive Field Rendered as Plaintext in UI \u2014 {file_path}",
    "description_template": "A sensitive field (password, secret, token, or key) is rendered directly as visible text content in the UI at line {line}. The value is exposed in the DOM, readable by any JavaScript on the page, browser DevTools, logging proxies, and screen readers.\nSnippet: {snippet}",
    "recommendation": "1. Never render password or secret values as visible text in the UI.\n2. If you need to show that a password is set, display a masked placeholder (e.g., '\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022') instead of the actual value.\n3. Ensure passwords are hashed server-side (bcrypt/argon2) and never returned in API responses \u2014 the client should never have access to the plaintext password.",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/",
      "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html"
    ]
  },
  {
    "id": "a02_sensitive_field_in_cleartext_input",
    "check_type": "cleartext_input",
    "pattern": "value=\\{[^}]*(?:password|passwd|pwd|secret|token|api_?key|credential)[^}]*\\}",
    "ignore_case": true,
    "type_password_pattern": "type\\s*=\\s*[\"']password[\"']",
    "context_window": 400,
    "severity": "high",
    "confidence": "medium",
    "owasp": "A02",
    "cwe": "CWE-359",
    "title_template": "OWASP A02:2021 (Cryptographic Failures): Sensitive Field Bound to Unmasked Input \u2014 {file_path}",
    "description_template": "A sensitive field value is bound to a form input that is NOT of type 'password' at line {line}. The value is displayed in cleartext (visible to the user and in the DOM). If this is a password or secret, it should either be hidden or not available client-side at all.\nSnippet: {snippet}",
    "recommendation": "1. For password edit forms, use type='password' on the input element to mask the value.\n2. Better: do not pre-populate password fields with the stored password hash \u2014 leave them empty and only update the password if the user enters a new one.\n3. Avoid returning password hashes or secrets from API endpoints used by the frontend.",
    "references": [
      "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"
    ]
  }
]
