Repository navigation
fix: only flag bot/webhook APIs as exfiltration when the secret is hardcoded - #7
Merged
Merged
Conversation
…rdcoded - Telegram, Discord, Slack and Apps Script URLs are High only when the URL carries its secret; the bare API base with a runtime token is Low (`bot-api`). - New `network.hardcoded_bot_token` (High) catches Telegram bot tokens in any string, including ones split from the URL, and counts as an exfiltration endpoint. - Reading a plugin's own localStorage keys no longer counts as reading user data; dumping all of web storage is the new `storage.web_storage_dump` (Medium) and still feeds the exfiltration correlation. - Bump rules version to 2026.11.3.
bajrangCoder
force-pushed
the
fix/bot-api-false-positives
branch
from
November 10, 2026 13:41
f04f7db to
30dc990
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixed
services/T…/B…/…path, or an Apps Script id.bot-api.localStorage/sessionStoragekeys no longer counts as reading user data for the exfiltration correlation.Added
network.hardcoded_bot_token(High): a Telegram bot token in any string, including one split from the URL. It counts as an exfiltration endpoint in the correlation.storage.web_storage_dump(Medium): reading every web storage entry (Object.keys/values/entries,JSON.stringify(localStorage), spread,for…in,.key(i)). It counts as reading user data.Other
RULES_VERSIONis bumped to2026.11.3.Tests
cargo test: 84 pass, including new cases for:cargo clippy --all-targetsis clean.