Skip to content

Commit e111bf6

Browse files
security-config-sync[bot]security-config-sync[bot]
authored
chore: sync security config files from security-config
1 parent 28a60bd commit e111bf6

2 files changed

Lines changed: 182 additions & 31 deletions

File tree

‎.gitleaks.toml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,16 @@
1010
[allowlist]
1111
description = "Exclude test fixtures, mock data, sample configs, and CI resources"
1212
paths = [
13+
# Go test files (commonly contain mock credentials)
14+
'''.*_test\.go$''',
15+
16+
# JS/TS test files (.spec.ts, .test.tsx, etc.)
17+
'''.*\.spec\.(ts|tsx|js|jsx)$''',
18+
'''.*\.test\.(ts|tsx|js|jsx)$''',
19+
20+
# JS/TS test directories
21+
'''__tests__/''',
22+
1323
# Go testdata directories
1424
'''testdata/''',
1525

‎semgrep.yaml‎

Lines changed: 172 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ rules:
2121
# SECTION 1: GENERIC SECRETS DETECTION — Applies to all file types
2222
# ==========================================================================
2323

24-
- id: generic-hardcoded-secret
24+
- id: generic-hardcoded-secret # pragma: allowlist secret
2525
languages: [generic]
2626
severity: ERROR
2727
message: |
@@ -42,7 +42,7 @@ rules:
4242
4343
If this is a test fixture or example:
4444
- Add comment: # nosemgrep: generic-hardcoded-secret
45-
- Or use obviously fake values: password = "REPLACE_ME"
45+
- Or use obviously fake values: password = "FAKE"
4646
patterns:
4747
- pattern-regex: |-
4848
(?i)(password|passwd|pwd|secret|token|api[_-]?key|private[_-]?key)\s*[:=]+\s*["'][^"']{8,}["']
@@ -71,13 +71,13 @@ rules:
7171
- Enable AWS CloudTrail for key usage monitoring
7272
7373
False Positive: If this is documentation/example, replace with:
74-
AKIAIOSFODNN7EXAMPLE (official AWS example key)
74+
AKIA...EXAMPLE (redacted AWS example key)
7575
pattern-regex: 'AKIA[0-9A-Z]{16}'
7676
metadata:
7777
cwe: "CWE-798"
7878
category: "security"
7979

80-
- id: generic-aws-secret-access-key
80+
- id: generic-aws-secret-access-key # pragma: allowlist secret
8181
languages: [generic]
8282
severity: ERROR
8383
message: |
@@ -361,7 +361,7 @@ rules:
361361
category: "security"
362362
note: "Not necessarily dangerous, but aggregated roles can accumulate unexpected permissions if selectors are too broad"
363363

364-
- id: k8s-rbac-secrets-cluster-access
364+
- id: k8s-rbac-secrets-cluster-access # pragma: allowlist secret
365365
languages: [yaml]
366366
severity: WARNING
367367
message: |
@@ -498,7 +498,7 @@ rules:
498498
cwe: "CWE-653"
499499
category: "security"
500500

501-
- id: k8s-secret-in-configmap
501+
- id: k8s-secret-in-configmap # pragma: allowlist secret
502502
languages: [yaml]
503503
severity: ERROR
504504
message: |
@@ -541,7 +541,7 @@ rules:
541541
cwe: "CWE-522"
542542
category: "security"
543543

544-
- id: yaml-hardcoded-secret
544+
- id: yaml-hardcoded-secret # pragma: allowlist secret
545545
languages: [yaml]
546546
severity: WARNING
547547
message: |
@@ -560,20 +560,62 @@ rules:
560560
languages: [yaml]
561561
severity: WARNING
562562
message: |
563-
Pod explicitly enables automountServiceAccountToken (CWE-200).
563+
Workload explicitly enables automountServiceAccountToken (CWE-200).
564564
565565
When enabled, the ServiceAccount token is mounted into the pod at
566566
/var/run/secrets/kubernetes.io/serviceaccount/token. If the pod is
567567
compromised, the attacker can use this token to access the Kubernetes API.
568568
569569
Remediation: Set automountServiceAccountToken: false if the pod doesn't
570570
need Kubernetes API access (most application pods don't).
571-
patterns:
572-
- pattern: |
573-
automountServiceAccountToken: true
574-
- pattern-inside: |
575-
kind: Pod
576-
...
571+
pattern-either:
572+
# Match Pod directly
573+
- patterns:
574+
- pattern: |
575+
automountServiceAccountToken: true
576+
- pattern-inside: |
577+
kind: Pod
578+
...
579+
# Match Deployment, StatefulSet, DaemonSet, ReplicaSet pod template
580+
- patterns:
581+
- pattern: |
582+
automountServiceAccountToken: true
583+
- pattern-inside: |
584+
kind: $KIND
585+
...
586+
spec:
587+
...
588+
template:
589+
...
590+
- metavariable-regex:
591+
metavariable: $KIND
592+
regex: (Deployment|StatefulSet|DaemonSet|ReplicaSet)
593+
# Match Job pod template
594+
- patterns:
595+
- pattern: |
596+
automountServiceAccountToken: true
597+
- pattern-inside: |
598+
kind: Job
599+
...
600+
spec:
601+
...
602+
template:
603+
...
604+
# Match CronJob pod template (nested under jobTemplate)
605+
- patterns:
606+
- pattern: |
607+
automountServiceAccountToken: true
608+
- pattern-inside: |
609+
kind: CronJob
610+
...
611+
spec:
612+
...
613+
jobTemplate:
614+
...
615+
spec:
616+
...
617+
template:
618+
...
577619
metadata:
578620
cwe: "CWE-200"
579621
category: "security"
@@ -582,7 +624,7 @@ rules:
582624
languages: [yaml]
583625
severity: WARNING
584626
message: |
585-
Pod uses default ServiceAccount (CWE-250).
627+
Workload uses default ServiceAccount (CWE-250).
586628
587629
The default ServiceAccount may have more permissions than needed.
588630
Each workload should use a dedicated ServiceAccount with minimal RBAC
@@ -594,12 +636,14 @@ rules:
594636
metadata:
595637
name: my-app-sa
596638
pattern-either:
639+
# Match Pod directly — explicit default
597640
- pattern: |
598641
kind: Pod
599642
...
600643
spec:
601644
...
602645
serviceAccountName: default
646+
# Match Pod directly — no SA specified
603647
- patterns:
604648
- pattern: |
605649
kind: Pod
@@ -608,6 +652,90 @@ rules:
608652
...
609653
- pattern-not: |
610654
serviceAccountName: $SA
655+
# Match controllers — explicit default
656+
- patterns:
657+
- pattern: |
658+
spec:
659+
...
660+
template:
661+
...
662+
spec:
663+
...
664+
serviceAccountName: default
665+
- pattern-inside: |
666+
kind: $KIND
667+
...
668+
- metavariable-regex:
669+
metavariable: $KIND
670+
regex: (Deployment|StatefulSet|DaemonSet|ReplicaSet|Job)
671+
# Match controllers — no SA specified (implicit default)
672+
- patterns:
673+
- pattern: |
674+
spec:
675+
...
676+
template:
677+
...
678+
spec:
679+
...
680+
- pattern-not: |
681+
spec:
682+
...
683+
template:
684+
...
685+
spec:
686+
...
687+
serviceAccountName: $SA
688+
- pattern-inside: |
689+
kind: $KIND
690+
...
691+
- metavariable-regex:
692+
metavariable: $KIND
693+
regex: (Deployment|StatefulSet|DaemonSet|ReplicaSet|Job)
694+
# Match CronJob — explicit default
695+
- patterns:
696+
- pattern: |
697+
spec:
698+
...
699+
jobTemplate:
700+
...
701+
spec:
702+
...
703+
template:
704+
...
705+
spec:
706+
...
707+
serviceAccountName: default
708+
- pattern-inside: |
709+
kind: CronJob
710+
...
711+
# Match CronJob — no SA specified (implicit default)
712+
- patterns:
713+
- pattern: |
714+
spec:
715+
...
716+
jobTemplate:
717+
...
718+
spec:
719+
...
720+
template:
721+
...
722+
spec:
723+
...
724+
- pattern-not: |
725+
spec:
726+
...
727+
jobTemplate:
728+
...
729+
spec:
730+
...
731+
template:
732+
...
733+
spec:
734+
...
735+
serviceAccountName: $SA
736+
- pattern-inside: |
737+
kind: CronJob
738+
...
611739
metadata:
612740
cwe: "CWE-250"
613741
category: "security"
@@ -616,10 +744,10 @@ rules:
616744
# SECTION 4: GITHUB ACTIONS SECURITY — Workflow files
617745
# ==========================================================================
618746

619-
- id: github-actions-hardcoded-secret
747+
- id: github-actions-hardcoded-secret # pragma: allowlist secret
620748
languages: [yaml]
621749
severity: ERROR
622-
message: |
750+
message: | # pragma: allowlist secret
623751
Hardcoded secret in GitHub Actions workflow.
624752
625753
Security Risk: Secrets in workflows are visible in git history and to all collaborators.
@@ -645,6 +773,10 @@ rules:
645773
patterns:
646774
- pattern-not: ${{ secrets.$SECRET }}
647775
- pattern-not: ${{ env.$ENV }}
776+
paths:
777+
include:
778+
- "**/.github/workflows/*.yml"
779+
- "**/.github/workflows/*.yaml"
648780
metadata:
649781
cwe: "CWE-798"
650782
category: "security"
@@ -678,11 +810,11 @@ rules:
678810
env:
679811
TITLE: ${{ github.event.pull_request.title }}
680812
patterns:
681-
- pattern-regex: 'run:.*\$\{\{\s*github\.(head_ref|event\.(issue|pull_request|discussion|review|review_comment|comment)\.(title|body|head\.ref|head\.label)|event\.head_commit\.message|event\.commits\[\d+\]\.message)\s*\}\}'
813+
- pattern-regex: 'run:\s*(?:[|>][-+]?\n(?:[ \t]+[^\n]*\n)*|[^\n]*)\$\{\{\s*github\.(head_ref|event\.(issue|pull_request|discussion|review|review_comment|comment)\.(title|body|head\.ref|head\.label)|event\.head_commit\.message|event\.commits\[\d+\]\.message)\s*\}\}'
682814
paths:
683815
include:
684-
- ".github/workflows/*.yml"
685-
- ".github/workflows/*.yaml"
816+
- "**/.github/workflows/*.yml"
817+
- "**/.github/workflows/*.yaml"
686818
metadata:
687819
cwe: "CWE-78"
688820
owasp: "A03:2021 - Injection"
@@ -716,12 +848,11 @@ rules:
716848
- If checkout is needed, use merge commit: refs/pull/${{ github.event.number }}/merge
717849
- Add persist-credentials: false to limit token scope
718850
patterns:
719-
- pattern-regex: 'pull_request_target'
720-
- pattern-regex: 'ref:\s*\$\{\{.*pull_request\.head\.(sha|ref)\s*\}\}'
851+
- pattern-regex: 'pull_request_target[\s\S]*?uses:\s*actions/checkout@[^\n]*\n(\s+[\w-]+:.*\n)*\s+ref:\s*\$\{\{[^\}]*pull_request\.head\.(sha|ref)\s*\}\}'
721852
paths:
722853
include:
723-
- ".github/workflows/*.yml"
724-
- ".github/workflows/*.yaml"
854+
- "**/.github/workflows/*.yml"
855+
- "**/.github/workflows/*.yaml"
725856
metadata:
726857
cwe: "CWE-829"
727858
category: "security"
@@ -920,13 +1051,23 @@ rules:
9201051
patterns:
9211052
- pattern-either:
9221053
- pattern: |
923-
const $VAR = "password"
924-
- pattern: |
925-
const $VAR = "secret"
1054+
$VAR := $VALUE
9261055
- pattern: |
927-
const $VAR = "token"
1056+
const $VAR = $VALUE
9281057
- pattern: |
929-
var $VAR = "Bearer ..."
1058+
var $VAR = $VALUE
1059+
- metavariable-regex:
1060+
metavariable: $VAR
1061+
regex: (?i)(password|passwd|secret|token|api[_-]?key|private[_-]?key|credentials?)
1062+
- metavariable-regex:
1063+
metavariable: $VALUE
1064+
regex: '"[^"]{8,}"'
1065+
- pattern-not: |
1066+
$VAR := os.Getenv("...")
1067+
- pattern-not: |
1068+
var $VAR = os.Getenv("...")
1069+
- pattern-not: |
1070+
$VAR, $_ := os.LookupEnv("...")
9301071
metadata:
9311072
cwe: "CWE-798"
9321073
owasp: "A07:2021"
@@ -1673,7 +1814,7 @@ rules:
16731814
metadata:
16741815
category: "security"
16751816

1676-
- id: dockerfile-secret-in-env
1817+
- id: dockerfile-secret-in-env # pragma: allowlist secret
16771818
languages: [dockerfile]
16781819
severity: ERROR
16791820
message: |
@@ -1726,7 +1867,7 @@ rules:
17261867
Remediation: Always quote variables in file operations:
17271868
rm "$FILE" # correct
17281869
rm $FILE # dangerous
1729-
pattern-regex: '(rm|cp|mv|eval|chmod|chown|kill|pkill)\s+[^|;]*(?<!["''\\])\$[A-Za-z_][A-Za-z0-9_]*'
1870+
pattern-regex: '(rm|cp|mv|eval|chmod|chown|kill|pkill)\s+[^|;]*(?<!["''\\])\$(?:\{[A-Za-z_][A-Za-z0-9_]*(?:[:\-\+\?=][^}]*)?\}|[A-Za-z_][A-Za-z0-9_]*)'
17301871
metadata:
17311872
cwe: "CWE-78"
17321873
category: "security"

0 commit comments

Comments
 (0)