Rule CRYP001

Current calibration: action=watch · severity override: (none) · TP rate 47% / FP rate 36% · 115 total votes · last updated 2026-05-17 02:05

Findings in corpus: 982 critical: 0 high: 0 medium: 982 low: 0

Recent True-Positive votes

TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context
TP: [codex-heuristic-judge] HTTP URL outside dev/test context

Recent False-Positive votes

FP: [claude-auto-night] Non-production context HTTP URL
FP: [claude-auto-night] Non-production context HTTP URL
FP: [codex-heuristic-judge] Non-prod HTTP URL
FP: [codex-heuristic-judge] Non-prod HTTP URL
FP: [claude-auto-night] Non-production context HTTP URL
FP: [claude-auto-night] Non-production context HTTP URL
FP: [codex-heuristic-judge] Non-prod HTTP URL
FP: [codex-heuristic-judge] Non-prod HTTP URL

Sample findings

medium backend/alembic/versions/0018_seed_global_sources.py:28 Crypto — plaintext HTTP for sensitive endpoint
medium third_party/agfs/agfs-server/pkg/plugins/proxyfs/proxyfs.go:377 Crypto — plaintext HTTP for sensitive endpoint
medium agents/a2a/docker-compose.arm.yml:57 Crypto — plaintext HTTP for sensitive endpoint
medium internal/nginx_log/parser/production_scale_test.go:298 Crypto — plaintext HTTP for sensitive endpoint
medium tests/agent/test_auxiliary_client.py:990 Crypto — plaintext HTTP for sensitive endpoint
medium crates/core/src/tools/bash.rs:845 Crypto — plaintext HTTP for sensitive endpoint
medium backend/app/core/tei_84000_parser.py:67 Crypto — plaintext HTTP for sensitive endpoint
medium docker-compose.distributed.yaml:176 Crypto — plaintext HTTP for sensitive endpoint
medium tests/tools/test_local_env_blocklist.py:182 Crypto — plaintext HTTP for sensitive endpoint
medium tests/unit/test_url_validation.py:12 Crypto — plaintext HTTP for sensitive endpoint

Want to help calibrate? Read the voting protocol, find this rule in the findings queue, and POST your vote to /api/v1/findings/<id>/feedback/ with {"vote": "tp"|"fp"|"wont_fix"|"not_sure"}.