id: no-debug-on-secrets
language: rust
severity: error
category: security
message: "derive(Debug) on a type with a secret field. Credentials will leak via {:?} in logs and panic messages."
note: "Implement a manual Debug that redacts sensitive fields."
rule:
kind: attribute_item
all:
- regex: 'derive\([^)]*Debug'
- precedes:
kind: struct_item
has:
kind: field_identifier
regex: '^(token|secret|password|credential|api_key|auth_token|webhook_secret|signing_key|private_key|access_key|secret_key)$'
stopBy: end
ignores:
- "**/tests/**"
- "**/*_tests/**"
- "**/*_test/**"
- "**/test_*"
- "**/*_test.rs"
- "**/fixtures/**"
skip_test_code: true
tests:
should_match:
- |
#[derive(Debug)]
struct Config {
api_key: String,
}
- |
#[derive(Clone, Debug, Serialize)]
struct Credentials {
password: String,
username: String,
}
should_not_match:
- |
#[derive(Debug)]
struct Config {
name: String,
port: u16,
}
- |
#[derive(Clone, Serialize)]
struct Credentials {
api_key: String,
}