SG-037: Cleartext Secrets in Config

Severity: LOW

Cleartext secrets in env / config files

Fires when

• An env-style KEY=value line assigns a real-looking secret value of 16+ chars
• A password / api_key / access_token / secret / client_secret assignment carries a literal value
• The value is not a placeholder or template (skips your-/change-me/example, comment lines, and phrases like random-string or minimum-N-chars)

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.