gitleaks / gitleaks/gitleaks

Password environment variable example with empty value causes false-positive

Open
#1,828 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
29.3k
Forks
2.2k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

We have an `.env.sample` in our repo to streamline configuring the application.
We add sensible defaults to make it easier.
However, the value for passwords are usually empty.

One such case is:

```shell
[...]
QUESTIONNAIRE_DB_PASSWORD=
QUESTIONNAIRE_DB_ENABLED=1
[...]
```

Running `gitleaks` on this causes the following detected leak:

```output
Finding: QUESTIONNAIRE_DB_PASSWORD=
QUESTIONNAIRE_DB_ENABLED=1
Secret: QUESTIONNAIRE_DB_ENABLED=1
RuleID: generic-api-key
Entropy: 3.825252
File: .env.sample
```

**Expected behavior**

Ideally, this would not be detected as a secret.

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Basic Info (please complete the following information):**
- OS: `macOS 13.7.4`
- Gitleaks Version: `8.24.3`

**Additional context**
Add any other context about the problem here.

cc @zricethezav

Contributor guide

Open the contributing guide

Research direction

Reproduce the finding with the shown .env.sample content and gitleaks 8.24.3, then trace how the generic-api-key rule handles an empty password assignment followed by QUESTIONNAIRE_DB_ENABLED=1. Done means the empty password example no longer produces this false-positive while genuine findings remain detected; add a regression test if the existing test structure supports it.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.