rules:
- id: hardcoded-jwt-key
  metadata:
    cwe: 'CWE-798: Use of Hard-coded Credentials'
    owasp: 'A2: Broken Authentication'
    category: security
    technology:
    - jwt
  pattern-either:
  - pattern: |
      $X = []byte("...")
      ...
      $Y := $TOKEN.SignedString($X)
  - pattern: |
      $TOKEN.SignedString([]byte("..."))
  message: JWT token is hardcoded
  languages: [go]
  severity: WARNING