All rules

R009 SecretsInRulesFile

Applies to
Rules files (CLAUDE.md, AGENTS.md, .mdc, .cursorrules, Copilot instructions, GEMINI.md, .windsurfrules)
Severity
Error (−10 per finding, max −30)
Summary
The file contains a credential.
Flags
Private key headers; AWS, GitHub, Slack, Anthropic, OpenAI, Stripe live and Google API keys; JSON Web Tokens; Password= and Pwd= values; credentials in URLs other than localhost. Code blocks included. Values with placeholder markers (xxxx, ..., <, >, {, }, $, *, your, example, changeme) and the example passwords pass, passwd, pwd, abc123, 123456, 12345678, qwerty are ignored. Findings show a redacted prefix only.
Measured false-positive rate
Not measured: no findings in the 755-file corpus. Methodology

Before

- Connect with Server=db;User Id=app;Password=Hunter2Prod;

After

- Read the connection string from the ConnectionStrings__Default environment variable.

Fix