cc_audit/config/
template.rs1use super::types::Config;
4
5impl Config {
6 pub fn generate_template() -> String {
8 r#"# cc-audit Configuration File
9# Place this file as .cc-audit.yaml in your project root
10
11# =============================================================================
12# RULE SEVERITY CONFIGURATION (v3.0.0)
13# =============================================================================
14# Controls how findings affect CI exit code.
15# - error: Causes CI failure (exit 1) - DEFAULT for all rules
16# - warn: Report only, does not cause CI failure (exit 0)
17# - ignore: Completely skip the rule (no report)
18#
19# Priority: ignore > warn > default
20
21severity:
22 # Default severity for all rules
23 default: error
24
25 # Rules to treat as warnings only (report but don't fail CI)
26 # warn:
27 # - PI-001 # Prompt injection patterns
28 # - PI-002
29 # - OB-001 # Obfuscation patterns
30
31 # Rules to completely ignore (no report)
32 # ignore:
33 # - OP-001 # Overpermission
34
35# =============================================================================
36# SCAN CONFIGURATION
37# =============================================================================
38scan:
39 # Output format: terminal, json, sarif, html, markdown
40 # format: terminal
41
42 # Strict mode: show medium/low severity findings and treat warnings as errors
43 strict: false
44
45 # Scan type: skill, hook, mcp, command, rules, docker, dependency, subagent, plugin
46 # scan_type: skill
47
48 # Recursive scan (enabled by default)
49 recursive: true
50
51 # CI mode: non-interactive output
52 ci: false
53
54 # Verbose output
55 verbose: false
56
57 # Minimum confidence level: tentative, firm, certain
58 # min_confidence: tentative
59
60 # Skip comment lines when scanning
61 skip_comments: false
62
63 # Show fix hints in terminal output
64 fix_hint: false
65
66 # Disable malware signature scanning
67 no_malware_scan: false
68
69 # Watch mode: continuously monitor files for changes
70 watch: false
71
72 # Path to a custom malware signatures database (JSON)
73 # malware_db: ./custom-malware.json
74
75 # Path to a custom rules file (YAML format)
76 # custom_rules: ./custom-rules.yaml
77
78 # Output file path (for HTML/JSON/SARIF output)
79 # output: ./report.html
80
81 # Enable deep scan with deobfuscation
82 deep_scan: false
83
84 # Auto-fix issues (where possible)
85 fix: false
86
87 # Preview auto-fix changes without applying them
88 fix_dry_run: false
89
90 # Warn-only mode: treat all findings as warnings (always exit 0)
91 warn_only: false
92
93 # Minimum severity level to include: critical, high, medium, low
94 # min_severity: high
95
96 # Minimum rule severity to treat as errors: error, warn
97 # min_rule_severity: error
98
99 # Strict secrets mode: disable dummy key heuristics for test files
100 strict_secrets: false
101
102 # ---------------------------------------------------------------------------
103 # CVE Scan Options (v1.1.0)
104 # ---------------------------------------------------------------------------
105 # Disable CVE vulnerability scanning
106 no_cve_scan: false
107
108 # Path to a custom CVE database (JSON)
109 # cve_db: ./custom-cve.json
110
111 # ---------------------------------------------------------------------------
112 # Remote Scanning Options (v1.1.0)
113 # ---------------------------------------------------------------------------
114 # Remote repository URL to scan
115 # remote: https://github.com/user/repo
116
117 # Git reference to checkout (branch, tag, commit)
118 # git_ref: main
119
120 # GitHub authentication token (also reads from GITHUB_TOKEN env var)
121 # remote_auth: ghp_xxxxxxxxxxxx
122
123 # Number of parallel clones for batch scanning
124 # parallel_clones: 4
125
126 # ---------------------------------------------------------------------------
127 # Badge Options (v1.1.0)
128 # ---------------------------------------------------------------------------
129 # Generate a badge for the scan result
130 badge: false
131
132 # Badge format: markdown, html, json
133 # badge_format: markdown
134
135 # Show summary only (useful for batch scanning)
136 summary: false
137
138 # ---------------------------------------------------------------------------
139 # Client Scan Options (v1.1.0)
140 # ---------------------------------------------------------------------------
141 # Scan all installed AI coding clients (Claude Code, Cursor, etc.)
142 all_clients: false
143
144 # Specific client to scan: claude, cursor, windsurf, vscode
145 # client: claude
146
147 # ---------------------------------------------------------------------------
148 # SBOM Options (v1.2.0)
149 # ---------------------------------------------------------------------------
150 # Generate SBOM (Software Bill of Materials)
151 sbom: false
152
153 # SBOM output format: cyclonedx, spdx
154 # sbom_format: cyclonedx
155
156 # Include npm dependencies in SBOM
157 sbom_npm: false
158
159 # Include Cargo dependencies in SBOM
160 sbom_cargo: false
161
162# =============================================================================
163# BASELINE CONFIGURATION (Drift Detection / Rug Pull Prevention)
164# =============================================================================
165baseline:
166 # Create a baseline snapshot when scanning
167 enabled: false
168
169 # Check for drift against saved baseline
170 check_drift: false
171
172 # Path to save baseline to
173 # save_to: ./.cc-audit-baseline.json
174
175 # Path to baseline file to compare against
176 # compare_with: ./.cc-audit-baseline.json
177
178# =============================================================================
179# WATCH MODE CONFIGURATION
180# =============================================================================
181watch:
182 # Debounce duration in milliseconds
183 debounce_ms: 300
184
185 # Poll interval in milliseconds
186 poll_interval_ms: 500
187
188# =============================================================================
189# IGNORE CONFIGURATION
190# =============================================================================
191# Uses regex patterns to determine which paths to ignore during scanning.
192# Each pattern is matched against the full path of the file.
193ignore:
194 # Regex patterns to ignore
195 # Examples:
196 # - "node_modules" # Simple directory name match
197 # - "/tests?/" # Match /test/ or /tests/
198 # - "\\.test\\.(js|ts)$" # Match .test.js or .test.ts files
199 # - "\\.(log|tmp|bak)$" # Match files by extension
200 patterns:
201 # Build outputs
202 - "/(target|dist|build|out|_build)/"
203 # Frameworks
204 - "/(\\.next|\\.nuxt|\\.output|\\.svelte-kit|\\.astro|\\.remix|\\.gatsby|\\.expo|storybook-static)/"
205 # Package managers
206 - "/(node_modules|\\.pnpm|\\.yarn|bower_components)/"
207 # Version control
208 - "/(\\.git|\\.svn|\\.hg)/"
209 # IDEs
210 - "/(\\.idea|\\.vscode|\\.eclipse|\\.settings)/"
211 # Deployment
212 - "/(\\.vercel|\\.netlify|\\.amplify|\\.serverless)/"
213 # Cache/Bundlers
214 - "/(\\.cache|\\.parcel-cache|\\.vite|\\.turbo|\\.esbuild|\\.rpt2_cache|tmp|temp)/"
215 # Python
216 - "/(__pycache__|\\.pytest_cache|\\.mypy_cache|\\.ruff_cache|\\.venv|venv|\\.tox|\\.nox|__pypackages__|site-packages|\\.eggs)/"
217 # Ruby
218 - "/\\.bundle/"
219 # Java/Gradle
220 - "/(\\.gradle|\\.mvn)/"
221 # Go
222 - "/vendor/"
223 # Coverage
224 - "/(coverage|\\.nyc_output|htmlcov|\\.coverage)/"
225 # Misc
226 - "/(logs|\\.docker)/"
227
228# =============================================================================
229# RULE CONFIGURATION
230# =============================================================================
231
232# Rule IDs to disable
233# disabled_rules:
234# - "PE-001"
235# - "EX-002"
236
237# Text file detection configuration
238# text_files:
239# # Additional file extensions to treat as text
240# extensions:
241# - custom
242# - special
243#
244# # Additional special file names
245# special_names:
246# - CUSTOMFILE
247
248# Custom rules (YAML format)
249# rules:
250# - id: "CUSTOM-001"
251# name: "Custom Rule Name"
252# severity: "high" # critical, high, medium, low, info
253# category: "exfiltration" # exfiltration, privilege_escalation, persistence, etc.
254# patterns:
255# - 'pattern_to_match'
256# message: "Description of the issue"
257# confidence: "firm" # tentative, firm, certain
258# fix_hint: "How to fix this issue"
259
260# Custom malware signatures
261# malware_signatures:
262# - id: "MW-CUSTOM-001"
263# name: "Custom Malware Signature"
264# description: "Description of what this detects"
265# pattern: "malware_pattern"
266# severity: "critical"
267# category: "exfiltration"
268# confidence: "firm"
269"#
270 .to_string()
271 }
272}