Password environment variable example with empty value causes false-positive
- Dominant language
- Go
- Stars
- 29.3k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
We have an `.env.sample` in our repo to streamline configuring the application.
We add sensible defaults to make it easier.
However, the value for passwords are usually empty.
One such case is:
```shell
[...]
QUESTIONNAIRE_DB_PASSWORD=
QUESTIONNAIRE_DB_ENABLED=1
[...]
```
Running `gitleaks` on this causes the following detected leak:
```output
Finding: QUESTIONNAIRE_DB_PASSWORD=
QUESTIONNAIRE_DB_ENABLED=1
Secret: QUESTIONNAIRE_DB_ENABLED=1
RuleID: generic-api-key
Entropy: 3.825252
File: .env.sample
```
**Expected behavior**
Ideally, this would not be detected as a secret.
**Screenshots**
If applicable, add screenshots to help explain your problem.
**Basic Info (please complete the following information):**
- OS: `macOS 13.7.4`
- Gitleaks Version: `8.24.3`
**Additional context**
Add any other context about the problem here.
cc @zricethezav
Contributor guide
Research direction
Reproduce the finding with the shown .env.sample content and gitleaks 8.24.3, then trace how the generic-api-key rule handles an empty password assignment followed by QUESTIONNAIRE_DB_ENABLED=1. Done means the empty password example no longer produces this false-positive while genuine findings remain detected; add a regression test if the existing test structure supports it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100