SG-009: Obfuscation: Base64
Severity: MEDIUM
Base64-encoded strings >50 chars in non-documentation fields
Fires when
- A run of 50+ base64-like characters decodes cleanly to mostly-printable text (not random noise)
- The decoded text contains a suspicious keyword: curl, wget, bash, exec, eval, credential, token, key, ignore, system, override, or disregard
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.