rules:
  - id: php-weak-ecc-curve
    patterns:
      - pattern-either:
          - pattern: openssl_pkey_new([..., "curve_name" => $CURVE, ...])
          - pattern: openssl_pkey_new([..., 'curve_name' => $CURVE, ...])
    message: Quantum-vulnerable ECC curve detected
    severity: WARNING
    languages:
      - php
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_risk_score: 85
