Skip to content

Add password GET submission check (#142) - #218

Open
jthack wants to merge 2 commits into
mainfrom
issue-142-password-get-submission
Open

Add password GET submission check (#142)#218
jthack wants to merge 2 commits into
mainfrom
issue-142-password-get-submission

Conversation

@jthack

@jthack jthack commented Oct 23, 2025

Copy link
Copy Markdown
Contributor

Summary

  • add passive detector that inspects GET queries for password-like parameter names
  • highlight parameter names and lengths in the finding description to avoid leaking secrets
  • register the check in the backend registry and enable it in the Balanced passive preset

Testing

  • pnpm lint
  • pnpm typecheck
  • pnpm test -- --match 'Password submitted using GET'

Closes #142

@jthack
jthack requested a review from a team as a code owner October 23, 2025 13:09
@jthack
Expand password-get-submission test coverage (4→14 tests)
3be95f6 
Add comprehensive test coverage for password detection in GET requests:
- Detection: passwd, pwd, passcode, separators, brackets, multiple params
- False Positives: POST/PUT methods, bypass/passport keywords
- Edge Cases: empty values, no query string, security guidance
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Password submitted using GET method

1 participant

@jthack