Passive Scan Rule: Credential Leak Detection

[aasthasahni9]

Adds a new passive community script, Credential Exposure Detector, to identify exposed credentials in HTTP traffic.

What this PR does
Introduces a passive script to detect exposed credentials such as:
API keys
Client secrets
OAuth access tokens
Scans the following locations:
HTTP response bodies
Request URL paths
URL query parameters
Supports multiple content types, including:
Swagger / OpenAPI JSON
HTML pages
Other response formats
Why this is needed
Credentials are commonly exposed due to:

Public or misconfigured API documentation
Debug or test endpoints
Passing sensitive values via GET requests or URL parameters
This passive script helps identify secret leakage caused by insecure configuration or deployment practices without actively modifying traffic.

Recommended remediation
Remove hardcoded secrets from responses and URLs
Restrict access to sensitive documentation (e.g., Swagger/OpenAPI)
Avoid passing credentials in URL paths or query parameters
Use secure authentication mechanisms such as Authorization headers or secure cookies over HTTPS
Integrate secret‑scanning tools into CI/CD pipelines and enforce access controls
References
OWASP Non‑Human Identities Top 10 – Secret Leakage https://owasp.org/www-project-non-human-identities-top-10/2025/2-secret-leakage/
CWE‑200: Exposure of Sensitive Information https://cwe.mitre.org/data/definitions/200.html
OWASP Secrets Management Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
Gitleaks https://github.com/gitleaks/gitleaks

Testing
✅ Script loaded successfully in ZAP
✅ Passive scan triggered as expected
✅ Build and VerifyScripts checks pass
✅ Spotless formatting applied
Author
Aastha Sahni

[psiinon]

Checkmarx One – Scan Summary & Details – dda8c2ea-9a1d-4e06-a6ea-d06b81b54914

---

New Issues (9)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Last User Is 'root'	/docker-wrapper: 10	details Leaving the last user as root can cause security risks. Change to another user after running the commands that need privileges
2		Hardcoded_Password_in_Connection_String	other/api/sdlc-integration/core/scan_module/scan.py: 219	details The application contains hardcoded connection details, "PASS: ", at line 219 of /other/api/sdlc-integration/core/scan_module/scan.py. This conn... Attack Vector
3		Use_of_Broken_or_Risky_Cryptographic_Algorithm	payloadgenerator/associated_fields.py: 34	details In , the application protects sensitive data using a cryptographic algorithm, hexdigest, that is considered weak or even trivially broken, in /payl... Attack Vector
4		Filtering_Sensitive_Logs	other/api/sdlc-integration/core/scan_module/scan.py: 218	details The application logs various user events, and in method  writes sensitive user details to debug, in /other/api/sdlc-integration/core/scan_module/... Attack Vector
5		Filtering_Sensitive_Logs	other/api/sdlc-integration/core/scan_module/scan.py: 243	details The application logs various user events, and in method  writes sensitive user details to debug, in /other/api/sdlc-integration/core/scan_module/... Attack Vector
6		MAINTAINER Instruction Being Used	/docker-wrapper: 3	details The MAINTAINER instruction sets the Author field of the generated images. The LABEL instruction is a much more flexible version of this and you sh...
7		Unpinned Actions Full Length Commit SHA	/codeql.yml: 31	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
8		Unpinned Actions Full Length Commit SHA	/codeql.yml: 34	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
9		Unpinned Actions Full Length Commit SHA	/codeql.yml: 35	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR