cfgaudit

Rules / CFG042

CFG042 permissions.deny does not restrict private key / certificate files

Severity: error OWASP: LLM02:2026 – Sensitive Information Disclosure

What cfgaudit checks

Private-key and certificate files expose cryptographic material that cannot be rotated without replacing the associated infrastructure. cfgaudit flags a permissions.deny block that exists but does not cover these formats:

*.pem, *.key, *.p12, *.pfx, *.jks

The finding lists exactly which extensions are uncovered, so partial coverage (e.g. only *.pem present) still reports the remaining gaps. A wildcard like Read(**/*.pem) counts as covering .pem. A completely absent permissions.deny block is reported by CFG006, not here.

A deny-all entry suppresses this finding entirely: Read(*) / Read(**) / Read(**/*) (any version), or the bare "*" deny-all-tools glob on Claude Code ≥ 2.1.166 (a no-op on older releases, so the finding still fires there; treated as covering when the version is unknown).

Trigger example

{
  "permissions": {
    "deny": ["Read(.env)", "Read(**/*.pem)"]
  }
}

→ error (.key, .p12, .pfx, .jks still uncovered).

Safe alternative

{
  "permissions": {
    "deny": [
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/*.p12)",
      "Read(**/*.pfx)",
      "Read(**/*.jks)"
    ]
  }
}

References

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation