rules:
- id: secure-parameter-for-secrets
  patterns:
  - pattern: param $NAME string
  - pattern-not-inside: |
      @secure()
      param $NAME string
  - metavariable-regex:
      metavariable: $NAME
      regex: (?i).*(password|secret|token)
  message: >-
    Mark sensitive parameters with the @secure() decorator.
    This avoids logging the value or displaying it in the Azure portal, Azure CLI, or Azure PowerShell.
  metadata:
    category: security
    technology:
    - bicep
    cwe:
    - 'CWE-532: Insertion of Sensitive Information into Log File'
    references:
    - https://cwe.mitre.org/data/definitions/532.html
    - https://docs.microsoft.com/en-us/azure/azure-resource-manager/bicep/scenarios-secrets
    owasp:
    - A09:2021 - Security Logging and Monitoring Failures
    - A09:2025 - Security Logging & Alerting Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages:
  - generic
  paths:
    include:
    - '*.bicep'
  severity: WARNING