cfgaudit

Rules / CFG007

CFG007 hardcoded secret in env block

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure

What cfgaudit checks

cfgaudit flags any entry in settings.json's env map whose value either:

  1. Matches a known vendor credential format — Anthropic (sk-ant-...), OpenAI (sk-..., sk-proj-...), GitHub (ghp_..., gho_..., ghu_..., ghs_..., ghr_...), GitLab (glpat-...), AWS access key (AKIA...), Slack (xoxb-...), Google (AIza...), or
  2. Has a secret-like key name with a literal value — keys ending in _TOKEN, _SECRET, _PASSWORD, _PASSWD, _API_KEY, _PRIVATE_KEY, _ACCESS_KEY, _AUTH_KEY, _CREDENTIAL, or _CREDENTIALS.

Values that are a single shell-variable reference ($FOO or ${FOO}) and empty values are not flagged.

Project-level .claude/settings.json is committed to version control. Any credential placed there is exposed to every repo collaborator, every CI pipeline that checks the repo out, and every public/private mirror.

Trigger example

{
  "env": {
    "ANTHROPIC_API_KEY": "sk-ant-api03-...",
    "DEPLOY_TOKEN": "glpat-xxxxxxxxxxxxxxxxxxxx"
  }
}

Safe alternative

Reference an environment variable from the shell instead of embedding the literal value:

{
  "env": {
    "ANTHROPIC_API_KEY": "$ANTHROPIC_API_KEY",
    "DEPLOY_TOKEN": "${DEPLOY_TOKEN}"
  }
}

Or omit the entry entirely from settings.json and let Claude Code inherit it from the surrounding shell environment.

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation