Repository navigation
fix(rules): crypto/hardcoded-secret flags env reads, type names and fixtures (38/38 Critical/Major were false positives) #661
Description
Problem
crypto/hardcoded-secret (CRITICAL) fires on identifiers named secret / token / api_key / password even when no secret literal is present. Found by scanning two real Rust/TS codebases (uteke, uteke-cloud) with cora scan --no-llm: of the 38 Critical/Major findings, all 38 were false positives (validated by reading each site); 26 of them are this rule. Each Critical blocks hook.mode: block and --ci.
Reproduction (each is a single line through cora.check_snippet, all report crypto/hardcoded-secret CRITICAL)
| Snippet | Why it is not a secret |
|---|---|
webhook_secret: env::var("POLAR_WEBHOOK_SECRET") |
reads an env var |
refresh_token: typeof b.refresh_token === 'string' ? b.refresh_token : prev?.refresh_token, |
expression, copies a field |
fn with_auth(token: Option<&'static str>) -> Self { |
a type signature |
api_key: "k".into(), |
test fixture value (also "sk-test", "file-key", ...) |
"RS_CLIENT_SECRET": rs["clientSecret"], |
JSON/dict key mapping |
base_url = "{}" | api_key = "{}" |
format template |
Suspected cause
In src/engine/security_scanner.rs (crypto/hardcoded-secret), the alternative :\s*[^=\s]\S{7,} treats any 8+ non-space characters after name: as a secret value, so expressions, calls and type names match. sec-hardcoded-secret (builtin) has the same shape for test fixtures outside tests/ directories.
Proposal
After name: / name =, require a quoted string literal (or a known token prefix such as sk-, ghp_, AKIA) of plausible entropy; do not match calls (env::var(, os.environ, process.env), type annotations, member access, or .into()/.to_string() of a short literal. Keep the existing real-secret tests (real_hardcoded_secret_still_detected_after_filter).
Done when
Every snippet above is clean, real literals (password = "hunter2hunter2", api_key: "sk_live_...") are still CRITICAL, with regression tests for both.
Activity
fix(rules): secret rules ignore name: value entries with non-literal …