/**
 * Pass: cleartext-credential-transport (CWE-523, category: security)
 *
 * Detects HTTP requests to an `http://` URL where the request body /
 * params / headers carry a credential-named identifier.
 *
 * Detection per language:
 *   Python:
 *     - `requests.post|put|patch("http://...", ..., data|json=password)`
 *     - `urllib.request.urlopen("http://...", data=password)`
 *     - `httpx.post|put|patch(...)`
 *   JS/TS:
 *     - `fetch("http://...", { body: { password } })`
 *     - `axios.post|put|patch("http://...", { password })`
 *     - `http.request({ host, ... }, ...)` with `protocol: 'http:'` or
 *       absent + body contains credential.
 *   Java:
 *     - `new URL("http://...")` + `outputStream.write(...)` carrying credential.
 *     - `HttpClient.send(...)` with `URI.create("http://...")`.
 *   Go:
 *     - `http.Post("http://...", ..., body)` w/ credential.
 *     - `http.NewRequest("POST", "http://...", body)` w/ credential.
 *
 * Negative guards (URL allowlist):
 *   - `localhost`, `127.0.0.1`, `0.0.0.0` (dev environments).
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface CleartextCredentialTransportResult {
    findings: Array<{
        line: number;
        language: string;
        api: string;
        url: string;
    }>;
}
export declare class CleartextCredentialTransportPass implements AnalysisPass<CleartextCredentialTransportResult> {
    readonly name = "cleartext-credential-transport";
    readonly category: "security";
    run(ctx: PassContext): CleartextCredentialTransportResult;
    private detect;
}
//# sourceMappingURL=cleartext-credential-transport-pass.d.ts.map