Skip to content

docs: document hardcoded-secret detection scope and the all-letter YAML limit #640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ajianaz merged 1 commit into from
Oct 9, 2026
Merged

docs: document hardcoded-secret detection scope and the all-letter YAML limit #640

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

### Changed

- **Documented what the hardcoded-secret check flags and its one known limit** (all-letter unquoted YAML values), and closed that item as not planned (#625, #635).

### Fixed

- **A `rules_engine:` section without `enabled: true` no longer disables the built-in rules.** `enabled` now defaults to `true` when the section is present, so `rules_engine: { max_findings: 0 }` only changes the cap; set `enabled: false` to turn the engine off (#638).
Expand Down
8 changes: 8 additions & 0 deletions docs/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -371,6 +371,14 @@ cora runs a static security scan on added lines before the AI review. 11 built-i

Test files are automatically skipped. Findings are injected into the LLM prompt as additional context.

#### What the hardcoded-secret check does (and does not) flag

The check looks for a secret-named key (`password`, `secret`, `token`, `api_key`, ...) assigned a **literal** value, and ignores values that are references:

- **Flagged:** quoted literals (`password = "..."`, typed declarations, Go `:=`, JSON `"password": "..."`), SQL `PASSWORD '...'`, literal defaults inside env reads (`os.getenv("X", "literal")`, `process.env.X || "literal"`), shell `${VAR:-literal}`, bare values in `.env` / `.properties` / `.ini` / shell / YAML files when they look like a secret.
- **Not flagged:** env reads and other expressions (`process.env.X`, `os.getenv("X")`), identifiers and member accesses, `${VAR}` / `$VAR` interpolation, empty strings, UI bindings, placeholders such as `%s` / `$1` / `{{ x }}`.
- **Known limit:** an unquoted YAML value made only of letters (`password: correcthorsebattery`) is not flagged. It cannot be told apart from a reference to another key (`secret: kubernetes`, `token: optional`) without flooding Kubernetes/Compose files with false positives. Quote the value, or give it a digit or symbol, and it is detected. Use `cora-ignore: <rule>` (see below) for a finding you accept.

## Language-Specific Analyzers

cora detects the languages in your diff and injects tailored review guidance:
Expand Down
Loading