VNX-615: Inclusion of Sensitive Information in Source Code Comments
Reports a comment (whole-line, block or trailing) in Go, Java, JavaScript/TypeScript or Python that records a credential value (password, secret, API key, token) rather than describing one.
| Field | Value |
|---|---|
| Rule ID | VNX-615 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Go, Java, JavaScript / TypeScript, Python |
| CWE | CWE-615 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | comments information-exposure-comments cwe-615 |
| Source | internal/sast/rules/vnx-615.rego |
Overview
VNX-615 maps to CWE-615: Inclusion of Sensitive Information in Source Code Comments. It reports a comment, including a line inside a /* ... */ block and a trailing comment after code (a whole-line comment is # in Python; //, /* */, * or <!-- --> elsewhere) where a credential name (password, passwd, passphrase, secret, client_secret, api_key, access/auth/api/refresh token, private key, secret/access key, *_pass) is followed by : or = and a literal of six or more characters containing a digit or a symbol.
Not reported: parameter documentation and prose (@param password the user's password, password: must be 12 characters), references to the environment, settings or a function call (os.Getenv(...), process.env.X, settings.API_KEY), placeholders (changeme, xxxxxxxx, ********, <your password>, ${VAR}), URLs, credentials in code (hard-coded credential rules cover those) and provider-format tokens (the secrets rules cover those).
Why This Matters
Comments ship with the source, are copied into forks and bundles, and stay in version history after the line is deleted. A password left in a comment is disclosed to everyone who can read the repository.
What Gets Flagged
# password = "R3port!ng2023"// String password = "Adm1n@2024";
/* passwd=letmein99 for the staging box */ * api_key: 4f9a2c71e8b3d6a0conn = connect(password=os.environ["DB_PASSWORD"]) # old password: Pr0d#Db2023Remediation
- Remove the comment and rotate the credential: it is in history already.
- Keep credentials in a secrets manager or environment variables, and document the variable name instead of its value.
- For a confirmed false positive, add a
// vulnetix-ignore: VNX-615comment on the line.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-615
// nosec vnx-615Or record an ignore rule: vulnetix ignore add --rule vnx-615 --reason "...". See Suppressing findings.