Rule SEC002

Current calibration: action=healthy · severity override: (none) · TP rate 77% / FP rate 17% · 90 total votes · last updated 2026-05-17 02:05

Findings in corpus: 55 critical: 55 high: 0 medium: 0 low: 0

Recent True-Positive votes

TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern
TP: [codex-heuristic-judge] Production-path credential pattern

Recent False-Positive votes

FP: [codex-heuristic-judge] Example/documentation credential
FP: [codex-heuristic-judge] Test fixture credential
FP: [codex-heuristic-judge] Test fixture credential
FP: [codex-heuristic-judge] Test fixture credential
FP: [codex-heuristic-judge] Test fixture credential
FP: [codex-heuristic-judge] Test fixture credential
FP: [codex-heuristic-judge] Redaction/scrubbing test data
FP: [codex-heuristic-judge] Example/documentation credential

Sample findings

critical backend/ai_agent/services/entity.py:332 Possible hardcoded API key found
critical backend/ai_agent/streaming_views.py:103 Possible hardcoded API key found
critical packages/views/issues/utils/redact.test.ts:? Possible hardcoded API key found
critical finetune/train_predictor.py:? Possible hardcoded API key found
critical backend/ai_agent/views.py:37 Possible hardcoded API key found
critical src/main/java/org/sonarsource/sonarqube/mcp/analytics/AnalyticsClient.java:35 [SEC002] Hardcoded API Key: Hardcoded API key found in source code.
critical backend/ai_agent/services/video_analyzer.py:34 Possible hardcoded API key found
critical packages/views/chat/components/chat-message-list.tsx:? Possible OpenAI API key found
critical odoo/addons/base/tests/test_res_users.py:? Possible hardcoded API key found
critical odoo/addons/base/models/res_users.py:? Possible hardcoded API key found

Want to help calibrate? Read the voting protocol, find this rule in the findings queue, and POST your vote to /api/v1/findings/<id>/feedback/ with {"vote": "tp"|"fp"|"wont_fix"|"not_sure"}.