# Required fields
id: string                    # Unique policy identifier
name: string                  # Human-readable name
description: string           # Detailed description

# Optional fields
severity: error | warning | info  # Default: error
enabled: boolean                  # Default: true
version: string                   # Policy version (semver)
extends: string                   # Parent policy ID

# Pattern matching
patterns:
  - type: regex | ast | semantic
    value: string               # Pattern definition
    message: string             # Violation message
    languages: [string]         # Limit to specific languages
    files: [string]             # Limit to file patterns

# Fix suggestions
suggestions:
  - string                      # Suggested remediation

# Auto-fix configuration
fix:
  type: replace | insert | delete
  pattern: string               # What to find
  replacement: string           # What to replace with

# File handling
ignore:
  - string                      # Glob patterns to skip

include:
  - string                      # Only check these patterns

# Metadata
tags:
  - string                      # Categorization tags

frameworks:
  - string                      # Related compliance frameworks

references:
  - url: string                 # External documentation
    title: string

id: no-hardcoded-secrets

name: No Hardcoded Secrets

description: |
  Detects hardcoded secrets, API keys, passwords, and other sensitive
  credentials in source code. These should be stored in environment
  variables or a secrets manager instead.

severity: error    # Blocks merges
severity: warning  # Reports but allows
severity: info     # Informational only

enabled: true   # Active
enabled: false  # Disabled

version: "1.2.0"

extends: no-hardcoded-secrets

# Override or add to inherited config
severity: warning
patterns:
  - type: regex
    value: "additional_pattern"

patterns:
  - type: regex
    value: "password\\s*=\\s*['\"][^'\"]+['\"]"
    message: "Hardcoded password detected"
    flags: "i"  # Case-insensitive

patterns:
  - type: ast
    language: javascript
    value: |
      CallExpression[callee.name="eval"]
    message: "eval() usage detected"

patterns:
  - type: semantic
    value: "sql-string-concatenation"
    message: "Potential SQL injection vulnerability"

patterns:
  - type: regex
    value: "fmt\\.Print"
    languages:
      - go
    message: "Use structured logging instead of fmt.Print"

patterns:
  - type: regex
    value: "TODO"
    files:
      - "src/**/*.ts"
      - "!src/**/*.test.ts"
    message: "TODO comment found"

fix:
  type: replace
  pattern: "console\\.log\\((.*)\\)"
  replacement: "logger.info($1)"

fix:
  type: insert
  position: before  # or after
  pattern: "^import"
  content: "import { logger } from './logger';\n"

fix:
  type: delete
  pattern: "console\\.log\\(.*\\);?\\n?"

ignore:
  - "**/*.test.ts"
  - "**/*.spec.ts"
  - "**/node_modules/**"
  - "**/dist/**"
  - "**/__mocks__/**"

include:
  - "src/**/*.ts"
  - "lib/**/*.ts"

tags:
  - security
  - secrets
  - owasp

frameworks:
  - nist-ssdf:PW
  - owasp-asvs:V14
  - cis-controls:16.4

references:
  - url: https://owasp.org/Top10/A03_2021-Injection/
    title: OWASP Top 10 - Injection
  - url: https://cwe.mitre.org/data/definitions/798.html
    title: CWE-798 - Hardcoded Credentials

id: no-sql-injection
name: No SQL Injection
description: |
  Detects potential SQL injection vulnerabilities from string
  concatenation or interpolation in SQL queries.

severity: error
enabled: true
version: "1.0.0"

patterns:
  - type: regex
    value: "(SELECT|INSERT|UPDATE|DELETE).*\\$\\{.*\\}"
    languages: [javascript, typescript]
    message: "SQL query with string interpolation detected"

  - type: regex
    value: "(SELECT|INSERT|UPDATE|DELETE).*\\+\\s*\\w+"
    languages: [javascript, typescript, java]
    message: "SQL query with string concatenation detected"

  - type: ast
    language: python
    value: |
      Call[func.attr="execute"][args[0].type="JoinedStr"]
    message: "SQL query with f-string detected"

suggestions:
  - "Use parameterized queries instead"
  - "Use an ORM or query builder"

fix:
  type: replace
  pattern: "\\$\\{(\\w+)\\}"
  replacement: "?"

ignore:
  - "**/*.test.*"
  - "**/migrations/**"

tags:
  - security
  - injection
  - owasp

frameworks:
  - nist-ssdf:PW
  - owasp-asvs:V5
  - cis-controls:16.4

references:
  - url: https://owasp.org/Top10/A03_2021-Injection/
    title: OWASP Top 10 - Injection