Description

This detector identifies when sensitive information such as passwords, API keys, tokens, or other confidential data is embedded directly in URL strings within TypeScript code. Exposing sensitive data in URLs creates security risks as URLs may be logged, cached, or transmitted in plaintext, potentially leading to credential exposure or data leaks.

Detection Strategy

• Scans TypeScript source code for URL string literals and template literals

• Analyzes URL parameters, query strings, and path segments for patterns indicating sensitive data

• Detects common sensitive parameter names like 'password', 'token', 'key', 'secret', 'auth', or similar variations

• Identifies hardcoded sensitive values embedded directly in URL construction

• Reports vulnerabilities when URLs contain parameters or segments that appear to expose confidential information

• Triggers on both static URL strings and dynamically constructed URLs using template literals

Vulnerable code example

import express from "express";

const app = express();
app.use(express.json());

app.get("/login", (req, res) => {
  const password = req.query.password;
  ...

✅ Secure code example

import express from "express";

const app = express();
app.use(express.json());

app.post("/login", (req, res) => {
  const password = req.body.password;
  ...