feat: Enhance PII classification and improve ISMS checks for secret handling

Author: cdmx-in

CHANGELOG.md

@@ -21,11 +21,17 @@
   categories (ifsc, upi, cvv, iban, imei, caste, bank+account, blood+group, …).
 - Per-category summary in Check 1, with a GDPR Art. 9 note when
   health-biometric fields are present.
+- **"default secret fallback" rule**: catches `process.env.JWT_SECRET ||
+  'your-secret-key'` — a placeholder used as the runtime default is the bug.
 - `PRIVCHECK_MODEL` env var to override the Check 2 model.
 - Runnable demo in `examples/` with its generated evidence pack.
 - Test workflow on push/PR (ubuntu/windows × Python 3.10/3.12).
 
 ### Fixed
+- Check 4 precision (validated on a real codebase): advice-like patterns
+  (TLS/crypto/config) inside comment lines no longer flag; generic
+  secret-named assignments in test files are treated as fixtures (vendor
+  tokens still flag everywhere — a real key in a test is still a leak).
 - Single-line `CREATE TABLE (...);` no longer poisons SQL scanner state.
 - Skipped directories (`node_modules`, …) are pruned before descent instead
   of walked and filtered — large JS repos scan dramatically faster.

privcheck/isms.py

@@ -74,8 +74,21 @@
                     |NODE_TLS_REJECT_UNAUTHORIZED\W{0,3}0
                     |sslmode=disable
                     |SSL_VERIFYPEER\W{1,4}(false|0))"""), False),
+    # env-var lookup falling back to a literal default secret (the classic
+    # `process.env.JWT_SECRET || 'your-secret-key'`) — the placeholder filter
+    # doesn't apply here: a placeholder USED as the runtime default is the bug
+    ("default secret fallback", "A.5.17 Authentication information",
+     re.compile(r"""(?ix)\benv(?:\.|\[["'])\w*(secret|token|key|passw)\w*(?:["'\]])?
+                    \s*(?:\|\||\?\?)\s*["'][^"']{6,}["']"""), True),
 ]
 _DEBUG_TRUE = re.compile(r"^\s*DEBUG\s*=\s*True\b")  # Django settings*.py only
+# comment leaders — advice-like patterns (TLS/crypto/config) in comments are
+# docs, not deviations; secrets stay flagged even in comments (commented-out
+# creds are still a leak)
+_COMMENT = re.compile(r"^\s*(#|//|--|\*|<!--|;)")
+# generic secret-named assignments in test code are fixtures, not leaks;
+# fixed-prefix vendor tokens still flag everywhere (a real key in a test IS a leak)
+_TEST_PATH = re.compile(r"(?i)(^|/)(tests?|__tests__|fixtures)/|\.(test|spec)\.|(^|/)test_|_test\.")
 
 
 @dataclass
@@ -122,10 +135,16 @@ def check(root: str | Path) -> IsmsResult:
             continue
         result.files_scanned += 1
         is_settings = name.startswith("settings") and p.suffix == ".py"
+        is_test = bool(_TEST_PATH.search(rel))
         for n, line in enumerate(p.read_text(errors="replace").splitlines(), 1):
             if "privcheck-ignore" in line:
                 continue
+            in_comment = bool(_COMMENT.match(line))
             for issue, control, rx, redact in RULES:
+                if in_comment and not redact:
+                    continue  # advice patterns in comments are docs, not code
+                if issue == "hardcoded secret" and is_test:
+                    continue  # test fixtures; vendor-token rules still apply
                 if m := rx.search(line):
                     if issue == "hardcoded secret" and _PLACEHOLDER.match(m.group(2)):
                         continue

privcheck/pii.py

@@ -33,6 +33,7 @@
     "msisdn": "contact", "imei": "network-identifier",
     "nationality": "demographics", "marital": "demographics",
     "religion": "demographics", "caste": "demographics",
+    "avatar": "identity", "password": "credential",
 }
 # pairs that flag only in combination (avoids "pan" in "company", bare "name")
 PAIR_CATEGORIES = {
@@ -45,6 +46,9 @@
     ("bank", "account"): "financial", ("credit", "card"): "financial",
     ("card", "number"): "financial", ("blood", "group"): "health-biometric",
     ("national", "id"): "government-id", ("mac", "address"): "network-identifier",
+    ("user", "agent"): "network-identifier",
+    ("google", "id"): "identity", ("facebook", "id"): "identity",
+    ("github", "id"): "identity", ("oauth", "id"): "identity",
 }
 
 _CAMEL = re.compile(r"(?<=[a-z0-9])(?=[A-Z])")

privcheck/test_checks.py

@@ -25,6 +25,10 @@ def test_classify_tokens():
     assert pii.classify("creditCardNumber") == "financial"
     assert pii.classify("blood_group") == "health-biometric"
     assert pii.classify("maritalStatus") == "demographics"
+    assert pii.classify("avatarUrl") == "identity"
+    assert pii.classify("googleId") == "identity"
+    assert pii.classify("userAgent") == "network-identifier"
+    assert pii.classify("password") == "credential"
     # non-PII must not flag
     assert pii.classify("company") is None       # contains "pan" as substring only
     assert pii.classify("name") is None          # bare name is too noisy
@@ -169,6 +173,23 @@ def test_isms_check(tmp_path):
     assert all(f.control.startswith("A.") for f in r.findings)
 
 
+def test_isms_precision(tmp_path):
+    # advice patterns in comments are docs, not deviations
+    _write(tmp_path, "docker-compose.yml", "# do NOT use NODE_TLS_REJECT_UNAUTHORIZED=0\n")
+    # generic secrets in test files are fixtures; vendor tokens still flag there
+    _write(tmp_path, "src/auth.test.ts", textwrap.dedent("""\
+        const password = "P@ssw0rd@123";
+        const key = "AIza""" + "A" * 35 + '";\n'))
+    # env fallback to a literal default secret is the bug, placeholder or not
+    _write(tmp_path, "src/config.js",
+           "const secret = process.env.JWT_SECRET || 'your-secret-key';\n")
+    got = {(f.file, f.issue) for f in isms.check(tmp_path).findings}
+    assert ("docker-compose.yml", "TLS verification disabled") not in got
+    assert ("src/auth.test.ts", "hardcoded secret") not in got
+    assert ("src/auth.test.ts", "Google API key") in got
+    assert ("src/config.js", "default secret fallback") in got
+
+
 def test_sql_single_line_create_does_not_leak(tmp_path):
     _write(tmp_path, "m.sql", """\
         CREATE TABLE t (id INT);