rules:

  # ?? Weak hash algorithms ?????????????????????????????????????????????????????

  - id: dotenv-weak-hash-algorithm
    languages: [generic]
    severity: WARNING
    message: >
      Weak hash algorithm configured: '$1'. MD5 and SHA-1 are cryptographically
      broken and vulnerable to quantum attacks. Use SHA-256 or stronger.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      confidence: HIGH
    pattern-regex: >-
      (?i)(?:\w*HASH(?:ING|_ALGORITHM|_TYPE|_FUNC)?|DIGEST(?:_ALGORITHM)?|CHECKSUM(?:_ALGORITHM)?|PASSWORD_HASH)\s*=\s*(md5|sha[-_]?1)\b

  # ?? Weak symmetric ciphers ???????????????????????????????????????????????????

  - id: dotenv-weak-symmetric-cipher
    languages: [generic]
    severity: ERROR
    message: >
      Weak cipher configured: '$1'. DES, RC4, and AES-ECB mode are broken
      and should not be used. Use AES-256-GCM or ChaCha20-Poly1305.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      confidence: HIGH
    pattern-regex: >-
      (?i)(?:CIPHER(?:_ALGORITHM)?|SYMMETRIC_CIPHER|ENCRYPTION_ALGORITHM|CIPHER_SUITE)\s*=\s*(des(?!ede)\b|rc4|3des|triple.?des|aes[-_]?(?:128|192|256)?[-_]?ecb)

  # ?? Weak key derivation ??????????????????????????????????????????????????????

  - id: dotenv-weak-key-derivation
    languages: [generic]
    severity: WARNING
    message: >
      Weak key derivation function configured: '$1'. PBKDF1 is deprecated.
      Use PBKDF2, bcrypt, or Argon2.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-916: Use of Password Hash With Insufficient Computational Effort"
      confidence: HIGH
    pattern-regex: >-
      (?i)(?:KEY_DERIV(?:ATION)?|KDF|PASSWORD_KDF)\s*=\s*(pbkdf1|md5crypt|crypt(?:\b|$))

  # ?? Insufficient RSA/DH key size ?????????????????????????????????????????????

  - id: dotenv-small-rsa-key-size
    languages: [generic]
    severity: ERROR
    message: >
      RSA/DH key size of '$1' bits is insufficient. Keys smaller than 2048 bits
      are considered weak; use 3072 or 4096 bits for quantum resistance.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-326: Inadequate Encryption Strength"
      confidence: HIGH
    pattern-regex: >-
      (?i)(?:RSA|DH|DSA|EC)(?:_KEY)?_(?:SIZE|BITS|LEN(?:GTH)?|PARAM_BITS)\s*=\s*(512|768|1024|1536)\b

  # ?? Insecure TLS version ?????????????????????????????????????????????????????

  - id: dotenv-insecure-tls-version
    languages: [generic]
    severity: ERROR
    message: >
      Insecure TLS version configured: '$1'. TLS 1.0 and 1.1 are deprecated
      (RFC 8996). Configure TLS 1.2 minimum; prefer TLS 1.3.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-326: Inadequate Encryption Strength"
      confidence: HIGH
    pattern-regex: >-
      (?i)TLS(?:_MIN)?_VERSION\s*=\s*(TLSv?1(?:\.0|\.1)?|SSLv[23])\b

  # ?? TLS peer verification disabled ???????????????????????????????????????????

  - id: dotenv-tls-verify-disabled
    languages: [generic]
    severity: ERROR
    message: >
      TLS peer verification is disabled. This exposes connections to
      man-in-the-middle attacks. Set TLS_VERIFY_PEER=true.
    metadata:
      quantum_vulnerable: false
      category: security
      subcategory: [vuln]
      cwe: "CWE-295: Improper Certificate Validation"
      confidence: HIGH
    pattern-regex: >-
      (?i)(?:TLS_VERIFY(?:_PEER)?|SSL_VERIFY(?:_PEER)?|VERIFY_SSL|VERIFY_TLS)\s*=\s*(false|0|no|off)\b

  # ?? Weak ciphers in cipher suite list ????????????????????????????????????????

  - id: dotenv-weak-cipher-in-suite
    languages: [generic]
    severity: WARNING
    message: >
      Cipher suite includes broken algorithms (RC4, DES, export ciphers, or NULL).
      Remove all weak ciphers and use only AES-256-GCM or ChaCha20-Poly1305.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      confidence: MEDIUM
    pattern-regex: >-
      (?i)(?:ALLOWED_CIPHERS|CIPHER_SUITE|TLS_CIPHERS)\s*=\s*[^\n]*(?:RC4|DES-CBC|NULL|EXPORT|EXP-)

  # ?? AES with insufficient key size (config value) ????????????????????????????

  - id: dotenv-aes-weak-key-size
    languages: [generic]
    severity: WARNING
    message: >
      AES-128 key configured. AES-128 provides only 64 bits of post-quantum
      security (Grover's algorithm halves symmetric key strength). Use AES-256.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-326: Inadequate Encryption Strength"
      confidence: MEDIUM
    pattern-regex: >-
      (?i)(?:AES_KEY(?:_SIZE|_LEN(?:GTH)?|_BITS)?|SYMMETRIC_KEY_SIZE)\s*=\s*(?:128|16)\b

  # ?? Hardcoded AES-128 key (32 hex chars = 128 bits) ??????????????????????????

  - id: dotenv-hardcoded-aes128-key
    languages: [generic]
    severity: ERROR
    message: >
      Hardcoded AES-128 key detected. AES-128 provides only 64 bits of
      post-quantum security. Rotate this key and use AES-256 (64 hex chars).
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-321: Use of Hard-coded Cryptographic Key"
      confidence: MEDIUM
    pattern-regex: >-
      (?i)(?:\w*(?:AES|ENCRYPT(?:ION)?|SYMMETRIC)\w*_KEY)\s*=\s*([0-9a-f]{32})(?![0-9a-f])

  # ?? Hardcoded DES key ?????????????????????????????????????????????????????????

  - id: dotenv-hardcoded-des-key
    languages: [generic]
    severity: ERROR
    message: >
      DES key detected. DES is a classically broken cipher (56-bit key, broken by
      brute force since 1998) and offers no quantum resistance. Replace with AES-256.
    metadata:
      quantum_vulnerable: true
      category: cryptography
      subcategory: [vuln]
      cwe: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      confidence: HIGH
    pattern-regex: >-
      (?i)(?:\w*DES\w*)_(?:KEY|SECRET|TOKEN|PASS(?:WORD)?)\s*=\s*\S+
