feat: deterministic secrets pre-scan before AI review #204

Summary

Add a deterministic secrets detection phase that runs before the AI review pass. Currently, secrets detection relies 100% on the LLM model — which is unreliable and inconsistent. A regex-based pre-scan catches known secret patterns with zero false negatives for well-defined patterns.

Motivation

• 100% reliable detection for known patterns (API keys, private keys, tokens) — no model dependency
• AI review focuses on what needs understanding (logic bugs, architecture issues) instead of pattern matching
• Industry standard — SonarQube, Gitleaks, TruffleHog all do deterministic secrets scan as a first pass
• Value prop enhancement — "AI code review + deterministic secrets scan" is a stronger pitch than "AI code review alone"

Proposed Design

Pipeline Change

Current:  diff → AI review → SARIF output
Proposed: diff → [1] Secrets pre-scan → [2] AI review → [3] Merge findings → SARIF output

New Module: src/engine/secrets_scanner.rs

pub struct SecretsScanner {
    patterns: Vec<SecretPattern>,
}

pub struct SecretPattern {
    name: String,          // e.g. "AWS Access Key"
    pattern: Regex,        // compiled regex
    severity: Severity,    // Critical, High, Medium
    confidence: f64,       // 0.0 - 1.0
}

pub struct SecretFinding {
    file: String,
    line: usize,
    pattern_name: String,
    matched_text: String,  // masked in output
    severity: Severity,
    confidence: f64,
}

Built-in Patterns (v1)

.cora.yaml Configuration

secrets:
  enabled: true                    # default: true
  fail_on_critical: true           # Critical finding → CI fail
  custom_patterns:                 # user-defined patterns
    - name: "Internal API Key"
      pattern: 'myapp_key_[A-Za-z0-9]{32}'
      severity: high
  ignore_patterns:                 # suppress false positives
    - "test_fixture_*"
  ignore_paths:
    - "**/test/**"
    - "**/*.test.*"
    - "**/fixtures/**"

Output Integration

Secrets findings merge into the same SARIF output as AI review findings, with ruleId prefixed with secrets/:

{
  "ruleId": "secrets/aws-access-key",
  "level": "error",
  "message": { "text": "AWS Access Key detected — mask with environment variable" },
  "locations": [{ "physicalLocation": { "region": { "startLine": 42 } } }]
}

Masking in Output

All matched secrets are automatically masked in review output:

• AKIA1234567890ABCDEF → AKIA****CDEF
• sk-proj-abcdef...xyz → sk-proj****

Implementation Checklist

• Create src/engine/secrets_scanner.rs with pattern matching engine
• Define built-in pattern catalog (10-15 patterns covering major providers)
• Add .cora.yaml secrets config section + parsing
• Integrate into review pipeline (pre-scan phase before AI call)
• Merge findings into existing SARIF output format
• Add --secrets-only CLI flag for standalone secrets scan mode
• Add masking for all matched secret values in output
• Write unit tests per pattern (positive + negative cases)
• Write integration test: full pipeline with secrets in diff
• Update README with secrets detection docs

Out of Scope (Future)

• Entropy-based detection (catches unknown secret formats) — v0.5+
• Custom pattern validation/compile-time checking — v0.5+
• Git history scanning (beyond diff) — separate tool concern

References

• SonarQube Secrets Detection — inspiration for deterministic pre-scan approach
• Gitleaks — pattern reference
• TruffleHog — entropy detection reference for future