rules:
  - id: rust-hardcoded-api-key
    patterns:
      - pattern-regex: "(?i)(api[_-]?key|apikey)\\s*[:=]\\s*[\"'][^\"']{8,}[\"']"
      - pattern-not-regex: "(?i)(example|placeholder|dummy|test|mock|fake|xxxx|YOUR_)"
    message: "Potential hardcoded API key detected. Use environment variables or a secret vault."
    severity: ERROR
    languages: [rust]
    paths:
      include:
        - src/

  - id: rust-hardcoded-password
    patterns:
      - pattern-regex: "(?i)(password|passwd|pwd)\\s*[:=]\\s*[\"'][^\"']{4,}[\"']"
      - pattern-not-regex: "(?i)(example|placeholder|dummy|test|mock|fake|xxxx|YOUR_)"
    message: "Potential hardcoded password detected. Use environment variables or a secret vault."
    severity: ERROR
    languages: [rust]
    paths:
      include:
        - src/

  - id: rust-hardcoded-token
    patterns:
      - pattern-regex: "(?i)(token|secret|auth)\\s*[:=]\\s*[\"'][^\"']{16,}[\"']"
      - pattern-not-regex: "(?i)(example|placeholder|dummy|test|mock|fake|xxxx|YOUR_)"
    message: "Potential hardcoded token/secret detected. Use environment variables or a secret vault."
    severity: ERROR
    languages: [rust]
    paths:
      include:
        - src/

  - id: rust-aws-access-key
    pattern-regex: "AKIA[0-9A-Z]{16}"
    message: "AWS access key ID detected. Use IAM roles or environment variables."
    severity: ERROR
    languages: [rust]
    paths:
      include:
        - src/

  - id: rust-private-key
    pattern-regex: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"
    message: "Private key detected in source code. Never commit private keys."
    severity: ERROR
    languages: [rust]
    paths:
      include:
        - src/
