[Linting Rule] No Leaked Credentials

Generated from 'wiki-linter.ts' on 2026-10-27, 10:46:55 UTC (v2.16.6), do not edit directly.

This rule is a best-effort rule.

Finds hardcoded credentials assigned to variables or passed as arguments whose names suggest they hold passwords, tokens, or API keys, handed to authentication functions, or whose values match known credential formats (AWS, GitHub, Slack, Stripe, Google, JWT, SSH, URLs with passwords).
This linting rule is implemented in src/linter/rules/no-leaked-credentials.ts.

Linting rules can be configured by passing a configuration object to the linter query as shown in the example below. The no-leaked-credentials rule accepts the following configuration options:

• credentialCallPattern
  Pattern matched (case-insensitively) against function names whose unnamed arguments are credentials, like httr::authenticate
• credentialNamePattern
  Pattern matched (case-insensitively) against variable names to identify potential credential assignments
• credentialValuePattern
  Pattern matched against string literal values to detect known credential formats (e.g., AWS access key IDs, GitHub tokens)

password <- "s3cr3t"

The linting query can be used to run this rule on the above example:

[ { "type": "linter",   "rules": [ { "name": "no-leaked-credentials",     "config": {} } ] } ]

Results (prettified and summarized):

Query: linter (2 ms)
   ╰ No Leaked Credentials (no-leaked-credentials):
       ╰ uncertain:
           ╰ Possible hardcoded credential in password at 1.1-8

More examples are the test cases in test/functionality/linter/lint-no-leaked-credentials.test.ts.