[
  {
    "id": "CRYPTO001",
    "pattern": "md5\\s*\\(|hashlib\\.md5|MessageDigest\\.getInstance\\s*\\(\\s*[\"']MD5[\"']\\)",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Insecure crypto (expanded)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO002",
    "pattern": "Math\\.random\\s*\\(\\)",
    "flags": "",
    "category": "insecure_crypto",
    "description": "Insecure crypto (expanded)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO003",
    "pattern": "MD5\\.Create\\s*\\(\\)|MD5\\.HashData\\s*\\(|createHash\\s*\\(\\s*['\"]md5['\"]\\)",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "MD5/SHA1 via language-specific APIs",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO004",
    "pattern": "crypto\\/md5|use\\s+md5\\b|md5::compute|crypto\\/sha1|use\\s+sha1\\b",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "MD5/SHA1 via language-specific APIs",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO005",
    "pattern": "MessageDigest\\.getInstance\\s*\\(\\s*[\"']SHA-?1[\"']\\)|SHA1\\s*\\(\\)|sha1\\s*\\(",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "MD5/SHA1 via language-specific APIs",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO006",
    "pattern": "MD5\\.Create\\s*\\(\\)",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO007",
    "pattern": "DES\\.Create\\s*\\(\\)|new HMACSHA1\\s*\\(",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO008",
    "pattern": "CipherMode\\.ECB",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO009",
    "pattern": "new Random\\s*\\(\\)",
    "flags": "",
    "category": "insecure_crypto",
    "description": "C# insecure crypto: MD5/DES/SHA1/Random/ECB",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO010",
    "pattern": "md5\\s*\\(\\s*\\$(?:_POST|password|user_pass)\\b",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "PHP insecure crypto",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO011",
    "pattern": "\\bmd5\\s*\\(\\s*rand\\s*\\(\\s*\\)\\s*\\)|sha1\\s*\\(\\s*\\w+\\s*\\.\\s*time\\s*\\(",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "PHP insecure crypto",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO012",
    "pattern": "mcrypt_encrypt\\s*\\(\\s*MCRYPT_DES",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "PHP insecure crypto",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO013",
    "pattern": "\"crypto\\/md5\"|md5\\.Sum\\s*\\(|md5\\.New\\s*\\(",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Go insecure crypto",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO014",
    "pattern": "\"math\\/rand\"|rand\\.Intn\\s*\\(|rand\\.Seed\\s*\\(",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Go insecure crypto",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO015",
    "pattern": "\"crypto\\/des\"|des\\.NewCipher\\s*\\(",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Go insecure crypto",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO016",
    "pattern": "\"crypto\\/sha1\"|sha1\\.New\\s*\\(|hmac\\.New\\s*\\(\\s*sha1\\.New",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Go insecure crypto",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO017",
    "pattern": "rsa\\.GenerateKey\\s*\\([^,]+,\\s*(?:512|1024)\\s*\\)",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Go insecure crypto",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO018",
    "pattern": "getInstance\\s*\\(\\s*[\"']DES\\b",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Kotlin/Java: DES cipher usage",
    "language": [
      "kotlin",
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO019",
    "pattern": "private\\s+static\\s+final\\s+String\\s+\\w*(?:ALGORITHM|ALGO|CIPHER)\\w*\\s*=\\s*[\"']DES[\"']|static\\s+final\\s+String\\s+\\w*(?:ALGORITHM|ALGO|CIPHER)\\w*\\s*=\\s*[\"']DES[\"']",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Kotlin/Java: DES cipher usage",
    "language": [
      "kotlin",
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO020",
    "pattern": "==\\s*received_sig\\b|received_sig\\s*==|provided\\s*==\\s*stored\\b",
    "flags": "",
    "category": "insecure_crypto",
    "description": "Python: timing attack via == comparison, low-iteration PBKDF2",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO021",
    "pattern": "pbkdf2_hmac\\s*\\(\\s*[\"'](?:sha1|md5)[\"'][^)]*,\\s*1000\\s*\\)",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "Python: timing attack via == comparison, low-iteration PBKDF2",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO022",
    "pattern": "\\w*(?:Sig|Signature)\\w*\\s*={2,3}\\s*\\w+|={2,3}\\s*\\w*(?:Sig|Signature)\\w*\\b",
    "flags": "",
    "category": "insecure_crypto",
    "description": "(also matches == after loose-equality mutation of ===)",
    "language": [
      "typescript"
    ],
    "severity": "high"
  },
  {
    "id": "CRYPTO023",
    "pattern": "provided\\w*\\s*={2,3}\\s*stored\\w*|stored\\w*\\s*={2,3}\\s*provided\\w*",
    "flags": "i",
    "category": "insecure_crypto",
    "description": "(also matches == after loose-equality mutation of ===)",
    "language": [
      "typescript"
    ],
    "severity": "high"
  }
]