[Linting Rule] Secret Exfiltration

Generated from 'wiki-linter.ts' on 2026-11-06, 11:26:10 UTC (v2.17.2), do not edit directly.

This rule is a best-effort rule.

Finds secrets (environment, keyrings, config, credential files) sent to untrusted hosts, the browser, or logs, and optionally into urls, files, other processes, or language models.
This linting rule is implemented in src/linter/rules/secret-exfiltration.ts.

Linting rules can be configured by passing a configuration object to the linter query as shown in the example below. The secret-exfiltration rule accepts the following configuration options:

• controlledInputs
  input types that make a destination untrusted, including files (see fileTrust for what they hold)
• credentialNamePattern
  environment variable names that hold credentials (case-insensitive)
• credentialValuePattern
  literals that are credentials, as in no-leaked-credentials
• declassifiers
  extra functions whose result is never secret
• fileTrust
  how far the content of files is trusted not to hold secrets; untrusted content gives uncertain results
• optIn
  low-severity leaks to report
• secretFiles
  paths of files holding secrets, in addition to credential files like .Renviron
• sinks
  where secrets leave the process
• sources
  extra functions returning secrets
• trustedFiles
  paths of files trusted to hold no secrets, an empty pattern trusts none

key <- Sys.getenv("API_KEY")
server <- function(input, output, session) {
  httr2::request("https://api.example.org") |>
    httr2::req_auth_bearer_token(key)
  httr::GET(input$url, httr::add_headers(Authorization = key))
  output$debug <- renderPrint(Sys.getenv())
  message("calling with ", key)
  message("key set: ", nzchar(key))
  httr::GET(paste0("https://api.example.org/?key=", key))
}

The linting query can be used to run this rule on the above example:

[ { "type": "linter",   "rules": [ { "name": "secret-exfiltration",     "config": { "optIn": [ "url" ] } } ] } ]

Results (prettified and summarized):

Query: linter (19 ms)
   ╰ Secret Exfiltration (secret-exfiltration):
       ╰ certain:
           ╰ renderPrint shows a secret (high) at 7.19-43
           ╰ message shows a secret (medium) at 8.3-31
           ╰ httr::GET puts a secret into a url (low) at 10.3-57
       ╰ uncertain:
           ╰ httr::GET sends a secret to a destination others control (high) at 6.3-62

More examples are the test cases in test/functionality/linter/lint-secret-exfiltration.test.ts.