P005 SecretsInDiff

Applies to: Pull requests, through the GitHub App
Severity: Error (fails the check under fail-on-warnings and fail-on-errors)
Summary: A change adds a credential.
Flags: Added lines in any file matching the R009 patterns: private key headers; AWS, GitHub, Slack, Anthropic, OpenAI, Stripe live and Google API keys; JSON Web Tokens; Password= and Pwd= values; credentials in URLs other than localhost. Placeholder values are ignored. Findings show a redacted prefix only. In code files, a Password= or Pwd= value counts only inside a string literal. In CI config files, a connection string to localhost, 127.0.0.1, (local) or . is skipped.

Before

"ConnectionStrings": { "Default": "Server=db;User Id=app;Password=Hunter2Prod;" }

"ConnectionStrings": { "Default": "" }