rules:
  - id: auth.betterauth.hardcoded-secret
    languages:
      - javascript
      - typescript
    severity: ERROR
    message: |
      The better-auth `secret` is set to a hard-coded string literal.

      This value signs and encrypts every session cookie, CSRF token, and
      verification token better-auth issues. Committed to git it is one search
      away from compromise, letting an attacker forge sessions for any user.

      Read it from the environment instead: `secret: process.env.BETTER_AUTH_SECRET`
      (better-auth also falls back to the `BETTER_AUTH_SECRET` / `AUTH_SECRET`
      env vars automatically if you omit the option). Add the variable to
      `.env.example` with a placeholder and rotate any secret that has shipped.
    # Anchored to a `betterAuth({...})` call so a bare `secret:` on any other
    # object never fires. The value is an AST string literal (`"..."`), so
    # `process.env.*` reads are structurally excluded; the pattern-not-regex
    # allow-list drops `${ENV}` templates, `<placeholders>`, and obvious
    # scaffolding stubs (your-secret-here, changeme, todo, ...).
    patterns:
      - pattern: 'secret: "..."'
      - pattern-inside: 'betterAuth({...})'
      - pattern-not-regex: '(?i)secret\s*:\s*[''"]\$\{?[A-Za-z_]+\}?[''"]'
      - pattern-not-regex: '(?i)secret\s*:\s*[''"]<[^''"]*>[''"]'
      - pattern-not-regex: '(?i)secret\s*:\s*[''"](?:your[-_]|my[-_]|example|placeholder|xxx+|todo|fixme|test|dummy|fake|sample|changeme|change[-_]?me|redacted|replace)'
    paths:
      exclude:
        - "**/test/**"
        - "**/__tests__/**"
        - "**/*.test.*"
        - "**/*.spec.*"
        - "**/example/**"
        - "**/examples/**"
        - "**/demo/**"
    metadata:
      oauthlint-rule-id: AUTH-BETTERAUTH-001
      oauthlint-doc-url: https://oauthlint.dev/rules/betterauth-hardcoded-secret
      category: security
      cwe: CWE-798
      owasp: API8:2023
      llm-prevalence: HIGH
      technology:
        - better-auth
      references:
        - https://www.better-auth.com/docs/reference/options
        - https://cwe.mitre.org/data/definitions/798.html