// Security: Secrets and credentials (Score: 0.9, Red highlight)
  secrets: {
    score: 0.9,
    highlightClass: 'secret',
    patterns: [
      { regex: /(['"][a-zA-Z0-9]{32,}['"])/g, desc: 'Long alphanumeric strings' },
      { regex: /\b(api[_-]?key|secret|password|token|auth)\s*[:=]\s*['"][^'"]+['"]/gi, desc: 'Credential assignments' },
      { regex: /\b(sk-[a-zA-Z0-9]{32,}|pk-[a-zA-Z0-9]{32,})\b/g, desc: 'API keys (OpenAI, Stripe, etc)' },
      { regex: /\b([0-9a-f]{40,64})\b/g, desc: 'Hex keys (SHA hashes, tokens)' },
      { regex: /-----BEGIN (PRIVATE|RSA|OPENSSH) KEY-----/g, desc: 'Private keys' },
      { regex: /\b(ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{36,}\b/g, desc: 'GitHub tokens' },
      { regex: /\b(AKIA[0-9A-Z]{16})\b/g, desc: 'AWS access keys' }
    ]
  },
  
  // Security: Dangerous functions (Score: 0.85, Orange highlight)
  dangerous_functions: {
    score: 0.85,
    highlightClass: 'danger',
    patterns: [
      { regex: /\b(eval|exec|execFile|spawn)\s*\(/g, desc: 'Code execution', languages: ['javascript', 'typescript', 'python', 'ruby'] },
      { regex: /\b(innerHTML|outerHTML|document\.write|execScript)\b/g, desc: 'DOM injection', languages: ['javascript', 'typescript'] },
      { regex: /\b(system|shell_exec|passthru|proc_open)\s*\(/g, desc: 'Shell execution', languages: ['php'] },
      { regex: /\b(__import__|compile|globals|locals)\s*\(/g, desc: 'Dynamic imports', languages: ['python'] },
      { regex: /\b(eval|instance_eval|class_eval|module_eval)\b/g, desc: 'Dynamic evaluation', languages: ['ruby'] },
      { regex: /\b(Runtime\.getRuntime|ProcessBuilder)\b/g, desc: 'Process execution', languages: ['java'] },
      { regex: /\bsystem\s*\(/g, desc: 'System calls', languages: ['c', 'cpp', 'rust'] }
    ]
  },
  
  // Security: Weak cryptography (Score: 0.75, Yellow highlight)
  weak_crypto: {
    score: 0.75,
    highlightClass: 'warning',
    patterns: [
      { regex: /\b(md5|sha1|des|rc4)\b/gi, desc: 'Weak hash algorithms' },
      { regex: /Math\.random\(\)/g, desc: 'Insecure random', languages: ['javascript', 'typescript'] },
      { regex: /\brandom\(\)/g, desc: 'Insecure random', languages: ['php', 'python'] },
      { regex: /\bnew\s+Random\(\)/g, desc: 'Insecure random', languages: ['java', 'csharp'] }
    ]
  },