AshCredo.Check.Warning.SensitiveAttributeExposed (ash_credo v0.17.0)

Basics

This check has a base priority of high and works with any version of Elixir.

Explanation

Attributes containing sensitive data should be marked with sensitive?: true. This prevents them from being leaked in logs, error messages, and inspections.

attribute :password_hash, :string, sensitive?: true

The sensitive_names param accepts atoms (exact name match) and regexes (matched against the attribute name), e.g. [:ssn, ~r/_token$/].

Test directories are excluded by default, since throwaway resources in test support often name attributes after sensitive fields without carrying real data. Override excluded_paths to scope the check differently.

Limitations

This check scans the source AST, so it only sees attributes written literally in the attributes block. It cannot see attributes contributed by Spark transformers or extensions - for example AshAuthentication's :hashed_password - and so will not flag them even when they are unmarked. It also only inspects the attribute entity: belongs_to foreign keys cannot be marked sensitive? directly (declare the column as an explicit attribute if you need that), and timestamps are not sensitive data, so neither is flagged.

Check-Specific Parameters

Use the following parameters to configure this check:

:sensitive_names

Attribute names considered sensitive. Atom entries match exactly; Regex entries (e.g. ~r/_token$/) match against the attribute name.

This parameter defaults to [:password, :hashed_password, :password_hash, :password_digest, :token, :access_token, :secret, :client_secret, :totp_secret, :api_key, :private_key, :ssn].

:excluded_paths

List of paths or regexes to exclude from this check. Defaults to test directories, since fake sensitive attributes are common in test resources.

This parameter defaults to [~r/\/test\//, "test"].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.