rules:
  - id: ruby-weak-rsa-key-size
    patterns:
      - pattern: OpenSSL::PKey::RSA.new($SIZE)
      - metavariable-comparison:
          metavariable: $SIZE
          comparison: $SIZE < 2048
    message: >-
      Weak RSA key size detected ($SIZE bits). RSA keys smaller than 2048 bits
      are vulnerable to quantum attacks. Use minimum 2048 bits, preferably 3072+ bits.
    severity: ERROR
    languages:
      - ruby
    metadata:
      quantum_vulnerable: true
      cwe: "CWE-326"
