T09 · Insecure Skill Coding Practices
Warning
- Location
- references/configuration.md:37
- Finding
- Documentation Encourages Logging Sensitive Configuration Values## Vulnerability Details **File Location**: `references/configuration.md`, lines 37–60 **Vulnerability Type**: Sensitive information exposure through configuration logging **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown * `security` * `secret` (string) - Random secret used for encrypt or hash actions, like JWT creation, password hash salt, etc. * `sql` * $name (string) - Any text will used for connection name. * `enabled` (bool, default: false) - It will make this SQL connection active or not. * `driver` (string) - Define driver that used to interact to SQL server. * `dsn` (string) - Connection string that used to connect to SQL server. This format depends on driver used. * `others` * $key (string) : $value (string) ## Reading To read configuration values, you can use this: ```go fmt.Println( gowok.Config, ) ``` This shows object of configuration that serialized into `gowok.Config` struct. If you want something raw, use this: ```go fmt.Println( gowok.Config.Map(), ) ``` ``` ### Technical Analysis The documentation defines configuration fields that may contain highly sensitive material, including the `security.secret` value used for JWT creation or password hashing and SQL DSNs that commonly contain database usernames, passwords, hostnames, and database names. The same document then recommends printing either the complete configuration structure or its raw map representation. If these examples are followed in an application, all configuration fields may be written to standard output without redaction. Standard output is frequently captured by CI/CD systems, container runtimes, process supervisors, cloud logging services, and centralized observability platforms. This is an insecure coding and documentation practice because it encourages broad serialization of an object known to contain secrets. The project contents reviewed during ...[truncated 1770 chars]
- Remediation
- ## Remediation Suggestions 1. Remove examples that print the complete `gowok.Config` object or its raw map representation. 2. Replace them with examples that access and print only explicitly non-sensitive fields, such as the configured web host: ```go fmt.Println(gowok.Config.Web.Host) ``` 3. Provide a redacted diagnostic representation that masks at least: - `security.secret` - SQL DSNs - Passwords and password-like fields - API keys and tokens - Private keys and connection credentials 4. Ensure any `String`, serialization, debugging, or logging implementation for the configuration type applies redaction by default. 5. Warn users not to print raw configuration in production, CI/CD jobs, support bundles, or centralized logs. 6. Recommend loading production secrets from environment variables or a dedicated secret manager rather than storing them in a general-purpose YAML file. 7. Recommend restrictive file permissions for local configuration files and least-privilege access to application logs. 8. Add tests that verify sensitive configuration values never appear in redacted diagnostic output.