rules:
- id: bash-hardcoded-password
  message: >-
    Detected hardcoded password in script. Hardcoded credentials pose a
    significant security risk. Use environment variables, secret management
    systems, or configuration files with proper permissions instead.
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://owasp.org/www-community/vulnerabilities/Use_of_hard-coded_password
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: PASSWORD=...
    - pattern: PASS=...
    - pattern: PWD=...
    - pattern: PASSWD=...
    - pattern: HARDCODED_PASSWORD=...
    - pattern: |
        password="..."
    - pattern: |
        pass="..."
    - pattern: |
        HARDCODED_PASSWORD=...

- id: bash-hardcoded-secret-key
  message: >-
    Detected hardcoded secret key or API key in script. Hardcoded secrets
    should never be stored in code. Use environment variables or secure
    secret management systems.
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: SECRET_KEY=...
    - pattern: API_KEY=...
    - pattern: APIKEY=...
    - pattern: ACCESS_KEY=...
    - pattern: SECRET=...
    - pattern: |
        SECRET_KEY=...
    - pattern: |
        API_KEY=...

- id: bash-plaintext-password-storage
  message: >-
    Detected writing password or sensitive data to plaintext file. Sensitive
    data should never be stored in plaintext. Use encrypted storage or
    system keychains.
  metadata:
    cwe:
    - 'CWE-256: Unprotected Storage of Credentials'
    - 'CWE-312: Cleartext Storage of Sensitive Information'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    references:
    - https://cwe.mitre.org/data/definitions/256.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: echo "$..." > ~/.password
    - pattern: echo "$..." > .password
    - pattern: echo "$..." > password.txt
    - pattern: |
        echo "$$password" > ...
    - pattern: |
        echo "$password" > ~/.password

- id: bash-mysql-hardcoded-password
  message: >-
    Detected hardcoded password in MySQL command. Database credentials
    should never be hardcoded. Use .my.cnf file or environment variables.
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    category: security
    technology:
    - bash
    - mysql
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://dev.mysql.com/doc/refman/8.0/en/password-security-user.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: mysql ... -p"..."
    - pattern: mysql ... --password="..."
    - pattern: mysqladmin ... -p"..."

- id: bash-sensitive-data-logging
  message: >-
    Detected logging of potentially sensitive data (password, token, key).
    Sensitive information should never be logged. Remove or redact sensitive
    data from logs.
  metadata:
    cwe:
    - 'CWE-532: Insertion of Sensitive Information into Log File'
    owasp:
    - A09:2021 - Security Logging and Monitoring Failures
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://owasp.org/www-community/vulnerabilities/Information_exposure_through_log_files
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: |
        echo "... password $$..." >> ...
    - pattern: |
        echo "... token $$..." >> ...
    - pattern: |
        echo "... key $$..." >> ...
    - pattern: |
        echo "... secret $$..." >> ...
    - pattern: |
        logger "... password $$..."
    - pattern: |
        logger "... token $$..."

- id: bash-environment-secrets-exposure
  message: >-
    Detected exposure of environment variables that may contain secrets.
    Logging or displaying environment variables can leak sensitive information.
  metadata:
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    references:
    - https://cwe.mitre.org/data/definitions/200.html
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: env | grep -i secret
    - pattern: env | grep -i password
    - pattern: env | grep -i key
    - pattern: printenv | grep ...
