From d4177e4a4fcbc01b8938811f9b560d0e5e8e2323 Mon Sep 17 00:00:00 2001 From: ajianaz Date: Fri, 9 Oct 2026 14:11:51 +0700 Subject: [PATCH] docs: document hardcoded-secret detection scope and the all-letter YAML limit (#625, #635) Co-Authored-By: Claude Sonnet 5.5 --- CHANGELOG.md | 4 ++++ docs/configuration.md | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0f47131..ce90c75 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- **Documented what the hardcoded-secret check flags and its one known limit** (all-letter unquoted YAML values), and closed that item as not planned (#625, #635). + ### Fixed - **A `rules_engine:` section without `enabled: true` no longer disables the built-in rules.** `enabled` now defaults to `true` when the section is present, so `rules_engine: { max_findings: 0 }` only changes the cap; set `enabled: false` to turn the engine off (#638). diff --git a/docs/configuration.md b/docs/configuration.md index 4f1eba7..759a934 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -371,6 +371,14 @@ cora runs a static security scan on added lines before the AI review. 11 built-i Test files are automatically skipped. Findings are injected into the LLM prompt as additional context. +#### What the hardcoded-secret check does (and does not) flag + +The check looks for a secret-named key (`password`, `secret`, `token`, `api_key`, ...) assigned a **literal** value, and ignores values that are references: + +- **Flagged:** quoted literals (`password = "..."`, typed declarations, Go `:=`, JSON `"password": "..."`), SQL `PASSWORD '...'`, literal defaults inside env reads (`os.getenv("X", "literal")`, `process.env.X || "literal"`), shell `${VAR:-literal}`, bare values in `.env` / `.properties` / `.ini` / shell / YAML files when they look like a secret. +- **Not flagged:** env reads and other expressions (`process.env.X`, `os.getenv("X")`), identifiers and member accesses, `${VAR}` / `$VAR` interpolation, empty strings, UI bindings, placeholders such as `%s` / `$1` / `{{ x }}`. +- **Known limit:** an unquoted YAML value made only of letters (`password: correcthorsebattery`) is not flagged. It cannot be told apart from a reference to another key (`secret: kubernetes`, `token: optional`) without flooding Kubernetes/Compose files with false positives. Quote the value, or give it a digit or symbol, and it is detected. Use `cora-ignore: ` (see below) for a finding you accept. + ## Language-Specific Analyzers cora detects the languages in your diff and injects tailored review guidance: