SG-002: Credential Exfiltration
Severity: CRITICAL
Env var reads of sensitive credentials combined with outbound HTTP calls
Fires when
- Sensitive credential ($AWS_KEY, ~/.ssh, /etc/passwd) sent to an outbound HTTP call on the same line
- Destination host is not the credential's vendor (e.g., api.anthropic.com, github.com, amazonaws.com)
- curl/wget posts a dotenv file (@.env, @.npmrc) to an external host
Related CVEs
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.