AshCredo.Check.Warning.SensitiveAttributeExposed (ash_credo v0.17.1)

Basics

This check has a base priority of high and works with any version of Elixir.

Explanation

Attributes containing sensitive data should be marked with sensitive?: true. This prevents them from leaking into logs, error messages, and inspections.

attribute :password_hash, :string, sensitive?: true

The sensitive_names param accepts atoms (exact name match) and regexes (matched against the attribute name), for example [:ssn, ~r/_token$/].

The check excludes test directories by default, since throwaway resources in test support often use sensitive field names without holding real data. Override excluded_paths to scope the check differently.

Limitations

The check scans the source AST, so it only sees attributes written literally in the attributes block. It cannot see attributes contributed by Spark transformers or extensions, such as AshAuthentication's :hashed_password, and will not flag them even when they are unmarked.

The check also only inspects the attribute entity: belongs_to foreign keys cannot be marked sensitive? directly (declare the column as an explicit attribute if you need that), and timestamps are not sensitive data, so neither is flagged.

Check-Specific Parameters

Use the following parameters to configure this check:

:sensitive_names

Attribute names considered sensitive. Atom entries match exactly; Regex entries (for example ~r/_token$/) match against the attribute name.

This parameter defaults to [:password, :hashed_password, :password_hash, :password_digest, :token, :access_token, :secret, :client_secret, :totp_secret, :api_key, :private_key, :ssn].

:excluded_paths

List of paths or regexes to exclude from this check. Defaults to test directories, since fake sensitive attributes are common in test resources.

This parameter defaults to [~r/\/test\//, "test"].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.