SG-008: Data Exfiltration Pattern

Severity: HIGH

Webhook URLs, IP-based URLs, DNS exfiltration patterns

Fires when

• The file contains a webhook or public-broadcast exfil-service URL (Slack/Discord webhooks, ntfy.sh, pipedream, serveo, localtunnel, ngrok, requestcatcher, webhook.site, beeceptor).
• A raw public-IP URL (loopback, RFC-1918 private, link-local, and Tailscale ranges excluded) or a bash /dev/tcp or /dev/udp out-of-band channel appears.
• A base64-encoded string is used as a DNS subdomain label of an attacker hostname (encoded-label.domain.tld); source-filename shapes like Component.vue are excluded.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.