Description

Detects sensitive information like API keys, credentials, or tokens exposed in JSON values within source code files. This vulnerability could lead to unauthorized access or account compromise if credentials are leaked through JSON configuration files or data structures.

Detection Strategy

• Scan JSON key-value pairs in source code files

• Skip checks for 'current_key' field if found in 'google-services.json' files

• Check if values contain sensitive patterns like API keys, tokens, or credentials

• Report a vulnerability when sensitive data is found in JSON values

Vulnerable code example

import json

config = {
    "current_key": {
        "api_key": "APIKEY123"  # Security risk: Hardcoded API key in source code
    }
}

✅ Secure code example

import json
import os

config = {
    "current_key": {
        "api_key": os.environ.get('API_KEY')  # Safely load API key from environment variable
    }
}