rules:
  - id: dart-use-of-md5-quantum
    patterns:
      - pattern-regex: "\\bcrypto\\.md5\\b|\\bmd5\\.convert\\b|\\bMd5\\(\\)"
    message: >-
      QUANTUM VULNERABILITY: MD5 is cryptographically broken and quantum-vulnerable
      via Grover's algorithm. Use sha256 or sha512 from package:crypto instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: dart-use-of-sha1-quantum
    patterns:
      - pattern-regex: "\\bcrypto\\.sha1\\b|\\bsha1\\.convert\\b|\\bSha1\\(\\)"
    message: >-
      QUANTUM VULNERABILITY: SHA-1 is deprecated and quantum-vulnerable via
      Grover's algorithm. Use sha256 or sha512 from package:crypto instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: dart-use-of-rsa-quantum
    patterns:
      - pattern-regex: "\\bRSAKeyGeneratorParameters\\b|\\bRSAEngine\\(\\)|\\bRSABlindedEngine\\(\\)|\\bRSASigner\\b"
    message: >-
      QUANTUM VULNERABILITY: RSA is broken by Shor's algorithm regardless of
      key size. Plan migration to post-quantum alternatives.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: dart-use-of-ec-quantum
    patterns:
      - pattern-regex: "\\bECKeyGeneratorParameters\\b|\\bECDomainParameters\\b|\\bECDSASigner\\b|\\bECPublicKey\\b|\\bECPrivateKey\\b"
    message: >-
      QUANTUM VULNERABILITY: ECC/ECDSA/ECDH is broken by Shor's algorithm.
      Plan migration to CRYSTALS-Dilithium or CRYSTALS-Kyber.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: dart-use-of-des-quantum
    patterns:
      - pattern-regex: "\\bDESEngine\\(\\)|\\bCBCBlockCipher\\(DESEngine\\(\\)\\)|\\bECBBlockCipher\\(DESEngine\\(\\)\\)"
    message: >-
      QUANTUM VULNERABILITY: DES has only 56-bit key strength and is completely
      broken. Grover's algorithm reduces this to 28-bit quantum security.
      Use AES-256 instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: dart-use-of-3des-quantum
    patterns:
      - pattern-regex: "\\bDESedeEngine\\(\\)|\\bCBCBlockCipher\\(DESedeEngine\\(\\)\\)"
    message: >-
      QUANTUM VULNERABILITY: 3DES provides only 112-bit classical security.
      Grover's algorithm reduces this to 56-bit quantum security.
      Use AES-256 instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: dart-use-of-rc4-quantum
    patterns:
      - pattern-regex: "\\bRC4Engine\\(\\)"
    message: >-
      QUANTUM VULNERABILITY: RC4 is a broken stream cipher banned by RFC 7465.
      Use AES-256-GCM instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_risk_score: 10

  - id: dart-use-of-dh-quantum
    patterns:
      - pattern-regex: '\bDHKeyGeneratorParameters\b|\bDHParameters\b|\bKeyGenerator\(''DH''\)'
    message: >-
      QUANTUM VULNERABILITY: Diffie-Hellman key exchange is broken by Shor's
      algorithm. Migrate to CRYSTALS-Kyber (ML-KEM) for post-quantum key
      encapsulation.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: dart-use-of-dsa-quantum
    patterns:
      - pattern-regex: '\bDSAKeyGeneratorParameters\b|\bDSAParameters\b|\bKeyGenerator\(''DSA''\)'
    message: >-
      QUANTUM VULNERABILITY: DSA is broken by Shor's algorithm. Migrate to
      ML-DSA (CRYSTALS-Dilithium) or SLH-DSA (SPHINCS+).
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: dart-aes-ecb-mode
    patterns:
      - pattern-regex: "\\bECBBlockCipher\\("
    message: >-
      SECURITY VULNERABILITY: AES-ECB mode provides no semantic security --
      identical plaintext blocks produce identical ciphertext blocks, leaking
      data patterns. Use GCM or CBC mode with a random IV instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: false
      quantum_risk_score: 7

  - id: dart-weak-random-quantum
    patterns:
      - pattern-regex: "\\bRandom\\(\\)"
    message: >-
      Non-cryptographic PRNG (dart:math Random()) used for security-sensitive
      output -- values are predictable. Use Random.secure() for any token,
      key, or nonce generation.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter]
      cwe:
        - "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: false
      quantum_risk_score: 7

  - id: dart-hardcoded-crypto-key
    patterns:
      - pattern-regex: "KeyParameter\\(\\s*Uint8List\\.fromList\\(\\["
    message: >-
      SECURITY VULNERABILITY: Hard-coded cryptographic key detected. Keys
      embedded directly in source code are trivially extractable from the
      compiled app binary. Load keys from a secure keystore or environment
      configuration instead.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, pointycastle]
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 8
