rules:
- id: detect-insecure-websocket
  pattern-regex: ws:\/\/
  languages: [regex]
  message: Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
  metadata:
    asvs:
      section: 'V13: API and Web Service Verification Requirements'
      control_id: 13.5.1 Insecure WebSocket
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x21-V13-API.md#v135-websocket-security-requirements
      version: '4'
    category: security
    technology:
    - regex
  severity: ERROR