rules:
  - id: auth.csharp.oauth.hardcoded-client-secret
    languages:
      - csharp
    severity: ERROR
    message: |
      An OAuth/OIDC client secret is assigned from a hard-coded string literal
      (`options.ClientSecret = "..."`). This secret authenticates the whole
      application to the identity provider: committed to source control it is one
      search away from letting an attacker impersonate the app, redeem codes, and
      obtain tokens (CWE-798). This is a common AI-generated mistake: the literal
      secret is inlined to make the sample "just work" and never externalized.

      Read it from configuration or a secret store instead (e.g.
      `options.ClientSecret = builder.Configuration["Authentication:ClientSecret"]`
      or a value from Azure Key Vault / environment) and rotate the leaked
      secret out of source control.
    # Matches `<recv>.ClientSecret = "literal"` for any receiver. A regex
    # allow-list drops placeholders/doc stubs and `${ENV}` templates; config
    # reads are structurally excluded because they are not string literals.
    patterns:
      - pattern: $O.ClientSecret = "..."
      - pattern-not-regex: |-
          (?i)ClientSecret\s*=\s*["']\$\{?[A-Za-z_]+\}?["']
      - pattern-not-regex: |-
          (?i)ClientSecret\s*=\s*["']<[^"']*>["']
      - pattern-not-regex: |-
          (?i)ClientSecret\s*=\s*["'](?:your[-_]|example|placeholder|xxx+|todo|changeme|change[-_]?me|replace)
    paths:
      exclude:
        - "**/test/**"
        - "**/*.Tests/**"
        - "**/*.Test/**"
        - "**/samples/**"
        - "**/sandbox/**"
        - "**/example/**"
        - "**/examples/**"
        - "**/demo/**"
        - "**/benchmark/**"
    metadata:
      oauthlint-rule-id: AUTH-CSHARP-OAUTH-003
      oauthlint-doc-url: https://oauthlint.dev/rules/csharp-oauth-hardcoded-client-secret
      category: security
      cwe: CWE-798
      owasp: API2:2023
      llm-prevalence: HIGH
      technology:
        - aspnetcore
        - openid-connect
      references:
        - https://learn.microsoft.com/aspnet/core/security/app-secrets
        - https://cwe.mitre.org/data/definitions/798.html