mcp-server-semgrep

Version:

MCP Server for Semgrep Integration - static code analysis with AI

28 lines (27 loc) • 843 B

YAML

rules:
- id: detected-slack-webhook
  patterns:
    - pattern-regex: https://hooks\.slack\.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}
    - pattern-not: https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX
  languages: [regex]
  message: Slack Webhook detected
  severity: ERROR
  metadata:
    references:
    - https://api.slack.com/messaging/webhooks
    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
    category: security
    technology:
    - secrets
    - slack
    confidence: LOW
    owasp:
    - A07:2021 - Identification and Authentication Failures
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM