Rules / CFG054

CFG054 high-entropy value that looks like a hardcoded secret

Severity: warn OWASP: LLM02:2026 – Sensitive Information Disclosure OWASP MCP: MCP01:2025 – Token Mismanagement & Secret Exposure — provisional (MCP Top 10 v0.1)

What cfgaudit checks

CFG007 and CFG050 detect hardcoded secrets by known vendor patterns (sk-ant-…, ghp_…, AWS, …) and secret-like key names (*_TOKEN, *_SECRET, …). Those miss a bespoke, high-entropy token stored under an innocuous key name (e.g. SESSION_KEY: a8Kd92Lmz0Qw3RtY7bVx1NpC4). CFG054 is the entropy-based fallback for exactly that case.

It scans the same surfaces — settings.json env and every MCP server's env/headers — and flags a value that:

• is ≥ 20 characters, with no whitespace;
• mixes ≥ 3 character classes (lower / upper / digit / symbol) — this excludes prose, pure-hex hashes, UUIDs, and single-case identifiers;
• has Shannon entropy ≥ 4.0 bits/char; and
• is not already caught by CFG007/CFG050 (known vendor pattern or secret-like key name), and is not a $VAR/${VAR} reference, a placeholder (<your-token>, changeme, …), a path, or a URL.

It is deliberately conservative (warn) — entropy detection is heuristic, so the gates are tight to avoid false positives on checksums, IDs, and config blobs.

Trigger example

{ "env": { "SESSION_KEY": "a8Kd92Lmz0Qw3RtY7bVx1NpC4" } }

→ warn. A $VAR reference ("SESSION_KEY": "${SESSION_KEY}"), a short value, a git SHA, or a path is not flagged.

Safe alternative

Reference an environment variable instead of committing the literal:

{ "env": { "SESSION_KEY": "${SESSION_KEY}" } }

References

• CFG007 (env secret patterns/names), CFG050 (MCP env/headers secrets) — the pattern-based rules CFG054 complements
• OWASP Top 10 for MCP — MCP01 (Token Mismanagement & Secret Exposure)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation