SG-095: Secret Egress to External Sink

Severity: MEDIUM

Credential/secret moved to an external git remote, scp/rsync host, HTTP POST, or DNS channel

Fires when

• A git remote is added with credentials embedded in the URL (token@host).
• scp or rsync moves a secret path (.env, id_rsa, .pem, credentials, .aws/.ssh) to a remote host, or reaches an external host with StrictHostKeyChecking disabled.
• curl or wget POSTs an env/secret/tmp payload to an external URL, or a base64-encoded payload is smuggled through a dig/nslookup/host DNS lookup.
• aws s3 cp/sync/mv sends a secret to an s3:// bucket, or gh gist/release upload uploads a secret.

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.

Research

• https://attack.mitre.org/tactics/TA0010/