SG-028: File Exfiltration
Severity: HIGH
Bulk file reads, credential file access, data staging via tar/zip/rsync/S3 upload
Fires when
- Broad or filesystem-wide searches for secret files (find / for .env, .pem/.key/.p12 certs, or credential dotfiles).
- Reads of sensitive dotfiles or system files (~/.aws/credentials, ~/.ssh/id_rsa, cloud CLI configs, /etc/shadow).
- Data staging that packages sensitive paths for exfil (tar/zip of home/etc, base64 of a sensitive path, dd/split).
- Bulk upload of sensitive dirs off-box via rsync/scp, curl file upload (PUT/binary), or AWS S3 / GCS.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.