False positive in python/ql/src/Security/CWE-312/CleartextLogging.ql

secrets_client.describe_secret(SecretId=secret_name)
secrets_client.delete_secret(SecretId=secret_name, ForceDeleteWithoutRecovery=True)
print(f"Deleted secret '{secret_name}' in region '{region}'")
This expression logs as clear text.
This expression logs as clear text.

Variable name doesn’t represent a secret.

Start with python/ql/src/Security/CWE-312/CleartextLogging.ql and reproduce the issue using the Python snippet in the report. Trace why secret_name is treated as a secret despite the report’s naming evidence; done when this example is no longer flagged while genuine cleartext logging remains detected.

索引モデルが issue の本文から書いたものです。