SG-096: Secret Written to Served Path
Severity: MEDIUM
Secret artifact copied into a web-served / public directory
Fires when
- A secret artifact (.env, credentials, key, token, .pem) is copied, moved, or written (cp/mv/cat/tee/install) into a web-served / public directory (public, static, www, dist, build, _site, .well-known, etc.).
- A shell redirect writes a secret file into a served directory (e.g. > public/secret.txt).
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.