Commit graph

462 commits

Author SHA1 Message Date
Mick Grove
c856373fb5 updated confluent rule with a checksum. Added zuplo rule with a checksum 2025-11-09 08:42:16 -08:00
Mick Grove
1ee9e804b0 updated confluent rule with a checksum. Added zuplo rule with a checksum 2025-11-08 16:01:58 -08:00
Mick Grove
0c07f3729f fixing rules 2025-11-08 15:03:53 -08:00
Mick Grove
065b26a220 fixing rules 2025-11-08 10:48:00 -08:00
Mick Grove
76a7422666 Added checksum comparisons to pattern_requirements, new suffix, crc32, and base62 Liquid filters, and verbose logging so mismatched checksums are skipped with context rather than reported as findings. 2025-11-07 18:49:03 -08:00
Mick Grove
bd13877b0d Added checksum comparisons to pattern_requirements, new suffix, crc32, and base62 Liquid filters, and verbose logging so mismatched checksums are skipped with context rather than reported as findings. 2025-11-07 16:31:52 -08:00
Mick Grove
12730bb609 Added checksum comparisons to pattern_requirements, new suffix, crc32, and base62 Liquid filters, and verbose logging so mismatched checksums are skipped with context rather than reported as findings. 2025-11-07 16:31:24 -08:00
Mick Grove
5b9c4743a5 updated ci 2025-11-06 16:22:35 -08:00
Mick Grove
724690dba8 updated ci 2025-11-06 09:11:24 -08:00
Mick Grove
563c1a4be0 updated ci 2025-11-05 22:35:29 -08:00
Mick Grove
c9555422b4 updated ci 2025-11-05 18:30:21 -08:00
Mick Grove
dc02abac63 Added an optional exclude_words list to PatternRequirements so matches containing case-insensitive placeholder words are filtered out, with accompanying tests to cover the new behavior. 2025-11-05 17:19:11 -08:00
Mick Grove
046ac6a052 Added an optional exclude_words list to PatternRequirements so matches containing case-insensitive placeholder words are filtered out, with accompanying tests to cover the new behavior. 2025-11-04 13:07:24 -08:00
Mick Grove
c89841a958 Added an optional exclude_words list to PatternRequirements so matches containing case-insensitive placeholder words are filtered out, with accompanying tests to cover the new behavior. 2025-11-04 14:16:23 -05:00
Mick Grove
3b3a4e5030 Added an optional exclude_words list to PatternRequirements so matches containing case-insensitive placeholder words are filtered out, with accompanying tests to cover the new behavior. 2025-11-04 14:15:04 -05:00
Mick Grove
8c9a0ad771 Automatically set --no-dedup whenever --manage-baseline is supplied so baseline management retains every occurrence of a finding 2025-11-04 14:06:35 -05:00
Mick Grove
c0e4910d1f pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set.
Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean.
2025-11-04 13:55:31 -05:00
Mick Grove
d7ae80a948 updated README 2025-10-31 16:34:09 -07:00
Mick Grove
5074342e12 updated README 2025-10-31 16:32:35 -07:00
Mick Grove
1196fcd6bd updated README 2025-10-31 16:22:48 -07:00
Mick Grove
45de80a3e7 updated README 2025-10-31 16:21:23 -07:00
Mick Grove
ea60add5e3 fixed bug in bash installer 2025-10-31 15:02:30 -07:00
Mick Grove
96f268d638 updated for v1.61.0 2025-10-30 22:50:41 -07:00
Mick Grove
ef45ead4b1 updated smoke_branch tests 2025-10-26 11:53:29 -07:00
Mick Grove
701c08814f updated smoke_branch tests 2025-10-26 00:13:40 -07:00
Mick Grove
d99f7af005 updated smoke_branch tests 2025-10-26 00:13:31 -07:00
Mick Grove
8dd17650f8 - Fixed local filesystem scans to keep open_path_as_is enabled when opening Git repositories and only disable it for diff-based scans.
- Created Linux and Windows specific installer script
- Updated diff-focused scanning so --branch-root-commit can be provided alongside --branch, letting you diff from a chosen commit while targeting a specific branch tip (still defaulting back to the --branch ref when the commit is omitted).
2025-10-25 17:25:29 -07:00
Mick Grove
a3bddfbea8 - Fixed local filesystem scans to keep open_path_as_is enabled when opening Git repositories and only disable it for diff-based scans.
- Created Linux and Windows specific installer script
- Updated diff-focused scanning so --branch-root-commit can be provided alongside --branch, letting you diff from a chosen commit while targeting a specific branch tip (still defaulting back to the --branch ref when the commit is omitted).
2025-10-25 17:13:16 -07:00
Mick Grove
3627323cb0 - Fixed local filesystem scans to keep open_path_as_is enabled when opening Git repositories and only disable it for diff-based scans.
- Created Linux and Windows specific installer script
- Updated diff-focused scanning so --branch-root-commit can be provided alongside --branch, letting you diff from a chosen commit while targeting a specific branch tip (still defaulting back to the --branch ref when the commit is omitted).
2025-10-25 17:12:51 -07:00
Mick Grove
fc73ba35a0
Merge pull request #135 from mongodb/development v1.60.0
v1.60.0
2025-10-23 22:22:57 -07:00
Mick Grove
bc21307ed2 Fixed bug in test when run on Windows 2025-10-23 22:04:01 -07:00
Mick Grove
52a898e93c
Merge pull request #134 from mongodb/development
v1.60.0
2025-10-23 21:48:51 -07:00
Mick Grove
e7d2638799 Fixed bug in test when run on Windows 2025-10-23 21:28:37 -07:00
Mick Grove
884fb2c599 Fixed bug in test when run on Windows 2025-10-23 21:04:26 -07:00
Mick Grove
eab6c2d1a4
Merge pull request #131 from mongodb/development
v1.60.0
2025-10-23 18:49:33 -07:00
Mick Grove
706caebef0 added tests for --branch and --since-commit feature 2025-10-23 17:37:40 -07:00
Mick Grove
1ca9c023ac added tests for --branch and --since-commit feature 2025-10-23 17:27:40 -07:00
Mick Grove
10c952495f added tests for --branch and --since-commit feature 2025-10-23 17:02:51 -07:00
Mick Grove
b58f5d8086 added tests for --branch and --since-commit feature 2025-10-23 17:02:31 -07:00
Mick Grove
01460fe00c updated anthropic rule 2025-10-23 15:02:30 -07:00
Mick Grove
a655bc8803 updated maxmind rule 2025-10-22 18:49:20 -07:00
Mick Grove
190ea2be88 updated readme with docker pulls shield 2025-10-22 17:00:15 -07:00
Mick Grove
4b366964df - Added provider-specific kingfisher scan subcommands (for example kingfisher scan github …) that translate into the legacy flags under the hood. The new layout keeps backwards compatibility while removing the wall of provider options from kingfisher scan --help.
- Updated the README so every provider example (GitHub, GitLab, Bitbucket, Azure Repos, Gitea, Hugging Face, Slack, Jira, Confluence, S3, GCS, Docker) uses the new subcommand style.
- Restored the direct kingfisher scan /path/to/dir flow for local filesystem scans while adding a --list-only switch to each provider subcommand so repository enumeration no longer requires the standalone github repos, gitlab repos, etc. commands.
- Removed the legacy top-level provider commands (kingfisher github, kingfisher gitlab, kingfisher gitea, kingfisher bitbucket, kingfisher azure, kingfisher huggingface) now that enumeration lives under kingfisher scan <provider> --list-only.
- Fixed kingfisher scan github … (and other provider-specific subcommands) so they no longer demand placeholder path arguments before the CLI accepts the request.
- Removed the --bitbucket-username, --bitbucket-token, and --bitbucket-oauth-token flags in favour of KF_BITBUCKET_* environment variables when authenticating to Bitbucket.
2025-10-22 16:36:02 -07:00
Mick Grove
6b094a8fba - Added provider-specific kingfisher scan subcommands (for example kingfisher scan github …) that translate into the legacy flags under the hood. The new layout keeps backwards compatibility while removing the wall of provider options from kingfisher scan --help.
- Updated the README so every provider example (GitHub, GitLab, Bitbucket, Azure Repos, Gitea, Hugging Face, Slack, Jira, Confluence, S3, GCS, Docker) uses the new subcommand style.
- Restored the direct kingfisher scan /path/to/dir flow for local filesystem scans while adding a --list-only switch to each provider subcommand so repository enumeration no longer requires the standalone github repos, gitlab repos, etc. commands.
- Removed the legacy top-level provider commands (kingfisher github, kingfisher gitlab, kingfisher gitea, kingfisher bitbucket, kingfisher azure, kingfisher huggingface) now that enumeration lives under kingfisher scan <provider> --list-only.
- Fixed kingfisher scan github … (and other provider-specific subcommands) so they no longer demand placeholder path arguments before the CLI accepts the request.
- Removed the --bitbucket-username, --bitbucket-token, and --bitbucket-oauth-token flags in favour of KF_BITBUCKET_* environment variables when authenticating to Bitbucket.
2025-10-22 16:35:26 -07:00
Mick Grove
87ebc7f010 - Added provider-specific kingfisher scan subcommands (for example kingfisher scan github …) that translate into the legacy flags under the hood. The new layout keeps backwards compatibility while removing the wall of provider options from kingfisher scan --help.
- Updated the README so every provider example (GitHub, GitLab, Bitbucket, Azure Repos, Gitea, Hugging Face, Slack, Jira, Confluence, S3, GCS, Docker) uses the new subcommand style.
- Restored the direct kingfisher scan /path/to/dir flow for local filesystem scans while adding a --list-only switch to each provider subcommand so repository enumeration no longer requires the standalone github repos, gitlab repos, etc. commands.
- Removed the legacy top-level provider commands (kingfisher github, kingfisher gitlab, kingfisher gitea, kingfisher bitbucket, kingfisher azure, kingfisher huggingface) now that enumeration lives under kingfisher scan <provider> --list-only.
- Fixed kingfisher scan github … (and other provider-specific subcommands) so they no longer demand placeholder path arguments before the CLI accepts the request.
- Removed the --bitbucket-username, --bitbucket-token, and --bitbucket-oauth-token flags in favour of KF_BITBUCKET_* environment variables when authenticating to Bitbucket.
2025-10-22 16:30:32 -07:00
Mick Grove
5f8baed46c - Added provider-specific kingfisher scan subcommands (for example kingfisher scan github …) that translate into the legacy flags under the hood. The new layout keeps backwards compatibility while removing the wall of provider options from kingfisher scan --help.
- Updated the README so every provider example (GitHub, GitLab, Bitbucket, Azure Repos, Gitea, Hugging Face, Slack, Jira, Confluence, S3, GCS, Docker) uses the new subcommand style.
- Restored the direct kingfisher scan /path/to/dir flow for local filesystem scans while adding a --list-only switch to each provider subcommand so repository enumeration no longer requires the standalone github repos, gitlab repos, etc. commands.
- Removed the legacy top-level provider commands (kingfisher github, kingfisher gitlab, kingfisher gitea, kingfisher bitbucket, kingfisher azure, kingfisher huggingface) now that enumeration lives under kingfisher scan <provider> --list-only.
- Fixed kingfisher scan github … (and other provider-specific subcommands) so they no longer demand placeholder path arguments before the CLI accepts the request.
- Removed the --bitbucket-username, --bitbucket-token, and --bitbucket-oauth-token flags in favour of KF_BITBUCKET_* environment variables when authenticating to Bitbucket.
2025-10-22 16:24:09 -07:00
Mick Grove
3a9c444c0f
Merge pull request #129 from amone-bit/main
update: just sort and dedup once
2025-10-21 09:01:53 -07:00
amone
7ddaa2bfc9 update: just sort and dedup once 2025-10-21 16:36:05 +08:00
Mick Grove
8f7772b3cc
Merge pull request #127 from mongodb/development v1.59.0
v1.59.0
2025-10-20 21:19:15 -07:00
Mick Grove
dd37bfbbca - Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch.
- Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform
2025-10-20 19:36:50 -07:00