mcp-server-semgrep/semgrep-rules/ruby/rails/security/brakeman/check-secrets.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: check-secrets
  patterns:
  - pattern: $VAR = "$VALUE"
  - metavariable-regex:
      metavariable: $VAR
      regex: (?i)password|secret|(rest_auth_site|api)_key$
  - metavariable-regex:
      metavariable: $VALUE
      regex: .+
  message: >-
    Found a Brakeman-style secret - a variable with the name password/secret/api_key/rest_auth_site_key
    and a non-empty string literal value.
  languages:
  - ruby
  severity: WARNING
  metadata:
    technology:
    - ruby
    - rails
    category: security
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp:
    - A01:2021 - Broken Access Control
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_secrets.rb
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
    - https://github.com/presidentbeef/brakeman/blob/3f5d5d5f00864cdf7769c50f5bd26f1769a4ba75/test/apps/rails3.1/app/controllers/users_controller.rb
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM