← all rules

secret/basic-auth-url

HTTP Basic Auth in URL

highSecret patternsecretCWE-798

What it detects

HTTP(S) URL with embedded username:password Basic Auth.

How it runs

Run against every text file in the repo (with a binary-content filter and a `.repoguardignore` filter for fixtures). The matched value is masked before being persisted.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.