feat(auth): flag placeholder & default credentials (PLACEHOLDER_CREDENTIAL)

[dmchaledev]

Summary

Closes a real false-negative on the scanner's core auth checks: a long placeholder or default credential passes the gate today.

NO_AUTH accepts any non-empty apiKey/token as proof that auth is configured, and WEAK_API_KEY only checks length (and exempts JWTs). So a config shipped with an unfilled credential like "your-api-key-here-replace-before-prod" (37 chars, not a JWT) satisfies both and produces zero findings — the gate goes green on a server anyone can authenticate to with a publicly-known value.

Repro (built CLI at current main)

// placeholder.json
{ "transport": { "url": "https://x.example.com", "tls": true,
    "auth": { "type": "apikey", "apiKey": "your-api-key-here-replace-before-prod" } },
  "rateLimit": { "enabled": true } }

$ node dist/cli.js placeholder.json --format=table
Found 0 finding(s): 0 critical, 0 high, 0 medium, 0 low   →  PASSED   # placeholder credential, not flagged

After this change the same config reports a HIGH PLACEHOLDER_CREDENTIAL.

Change

New HIGH PLACEHOLDER_CREDENTIAL rule (src/rules/auth-rules.ts) inspecting transport.auth.apiKey and transport.auth.token for:

• Unresolved template markers — <your-key>, {{API_KEY}}, ${TOKEN}
• Filler / repeated-character values — e.g. xxxxxxxx, 00000000
• Known default/weak secrets — changeme, password, admin, root, secret, … (matched against the whole normalized value)
• High-signal placeholder phrases — your-api-key, replace-me, insert-your-key, placeholder, redacted, … (multi-character substrings only — no bare key/token/test)

Matching is deliberately anchored to keep the false-positive rate near zero:

• A real random-looking key is not flagged (kZ8f3Qw9Lx2Vt7Rb1Np6Yc4Md0Ha5Ue → clean).
• A JWT is not flagged — the bundled examples/secure-config.json stays clean and still PASSED.

The matched value is a placeholder/default (not a real secret), so a short slice is safely included in evidence to locate the offending field.

Scope / safety

• Additive only — no change to existing rules, output schema, or public API. The new RuleId is auto-picked up by the CLI/--rule allowlists and SARIF.
• Requires a config file, so URL mode is unaffected (it isn't in URL_EVALUABLE_RULES).
• Complements rather than overlaps WEAK_API_KEY: short placeholders still trip WEAK_API_KEY on length; the gap this closes is long placeholders that pass length.

Tests / verification

• npx tsc --noEmit ✅ · npm run lint (0 warnings) ✅ · npm test ✅ 132 passed (was 118) · npm run build ✅
• Added a PLACEHOLDER_CREDENTIAL suite: the long-placeholder regression (asserts WEAK_API_KEY does not fire on the same value), a parametrized case per detection category, independent apiKey+token flagging, and no-false-positive guards for a random key, a JWT, and an absent credential.
• CLI smoke-tested: the placeholder config now emits the HIGH finding; examples/secure-config.json remains clean.

Note on backlog overlap

Independent of the open backlog — the three open EXPOSED_SECRETS PRs (#28/#35/#38) concern hardcoded real secrets and their redaction; #26 concerns credential length; #39 concerns the mcpServers stdio schema. None address placeholder/default credentials.

🤖 Generated with Claude Code

https://claude.ai/code/session_013FP2Zbbft758mDMK2Edcbd

---

Generated by Claude Code