kingfisher-rules 3.0.0

Done dynamic on Linux job 295621 crates.io SBOM Findings (VEX)

high severity exfiltration_endpoint in library code: https://api.telegram.org/bot{{ TOKEN }}/getMe

low

Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.

Evidence

Points	Signal	Where	What
10	static:exfiltration_endpoint static · kingfisher-rules	build_support/veles.rs:370	high severity exfiltration_endpoint in library code: https://api.telegram.org/bot{{ TOKEN }}/getMe
2	static:credential_access static · kingfisher-rules	build_support/veles.rs:794	medium severity credential_access in library code: (?i)(?:\.git[/\\]config\|(?:^\|[/\\])\.git-credentials\|_history)$
2	static:included_binary static · kingfisher-rules	build_support/betterleaks.rs:506	medium severity included_binary in library code (3 places): generated/upstream-sources.json.gz (205497 bytes)
2	static:secret_environment_variable static · kingfisher-rules	build_support/betterleaks.rs:959	medium severity secret_environment_variable in library code (4 places): AWS_SECRET_ACCESS_KEY
2	static:shell_command static · kingfisher-rules	src/liquid_filters.rs:1411	medium severity shell_command in library code (4 places): {{ "hello" \| sha256 }}
1	static:build_script static · kingfisher-rules	build.rs	low severity build_script in build_script code: build.rs

Behavior

Profile

static:credential_access static:exfiltration_endpoint static:included_binary static:secret_environment_variable static:shell_command

Static findings

high exfiltration_endpoint library 1

https://api.telegram.org/bot{{ TOKEN }}/getMe build_support/veles.rs:370

medium secret_environment_variable library 4

AWS_SECRET_ACCESS_KEY build_support/betterleaks.rs:959 build_support/betterleaks.rs:2426 src/defaults.rs:514 src/defaults.rs:549

medium shell_command library 4

{{ "hello" | sha256 }} src/liquid_filters.rs:1411
{{ "hello" | sha256_b32 }} src/liquid_filters.rs:1417
{{ "hello" | sha256_b32: 4 }} src/liquid_filters.rs:1419
{{ "hello" | sha256_b32: 60 }} src/liquid_filters.rs:1421

medium included_binary library 3

generated/upstream-sources.json.gz (205497 bytes) build_support/betterleaks.rs:506
data/betterleaks-words.txt.gz (93947 bytes) src/betterleaks_filter.rs:1334
generated/builtin-rules.gz (199049 bytes) src/defaults.rs:15

medium credential_access library 1

(?i)(?:\.git[/\\]config|(?:^|[/\\])\.git-credentials|_history)$ build_support/veles.rs:794

low build_script build_script 1

build.rs build.rs

low foreign_functions library 1

extern block src/rule_cache_security_macos.rs:10

info url_literal library 54

\u{a}[[rules]]\u{a}id = "v2-token"\u{a}description = "Synthetic v2 token"\u{a}regex = '(cf[ua]t_[A-Za-z0-9]{48})'\u{a}filter = 'lower(finding["match"]) contains "client"'\u{a}validate = '''\u{a}let ac… build_support/betterleaks.rs:2043
[[rules]]\u{a}id='scope-test'\u{a}regex='token'\u{a}{validation}{field}='http.delete("https://example.invalid")' build_support/betterleaks.rs:2093
[extend]\u{a}url='https://example.invalid/config.toml' build_support/betterleaks.rs:2181
let r = http.get("https://example.test", {"Authorization": "Bearer " + finding["secret"]}); r.status == 200 ? {"result": "valid"} : validate.unknown(r) build_support/betterleaks.rs:2418
\u{a}[[rules]]\u{a}id = "mongodb-connection-string-test"\u{a}description = "MongoDB connection string test"\u{a}regex = '''(?P<secret>mongodb://[^\s]+)'''\u{a} build_support/betterleaks.rs:2592
\u{a}[[rules]]\u{a}id = "tls-mode-typo-test"\u{a}description = "TLS mode typo test"\u{a}regex = '''(?P<secret>mongodb://[^\s]+)'''\u{a} build_support/betterleaks.rs:2615
\u{a}[[rules]]\u{a}id = "gcp-api-key"\u{a}description = "Google API key"\u{a}regex = '''(?P<secret>AIza[a-zA-Z0-9_-]{35})'''\u{a}validate = '''let r = http.get("https://example.test"); r.status == 200… build_support/betterleaks.rs:2741
\u{a}[[rules]]\u{a}id = "provider-token"\u{a}description = "Provider token"\u{a}regex = '''token_[a-z]+'''\u{a}validate = '''http.get("https://unsafe.example")'''\u{a} build_support/betterleaks.rs:2766
\u{a}version: 1\u{a}rules:\u{a} provider-token:\u{a} validation_override: 'http.get("https://safe.example")'\u{a} build_support/betterleaks.rs:2774
value: https://safe.example build_support/betterleaks.rs:2784
\u{a}[[rules]]\u{a}id = "private-key"\u{a}description = "Private key"\u{a}regex = '''(-----BEGIN PRIVATE KEY-----)'''\u{a}\u{a}[[rules]]\u{a}id = "mongodb-connection-string"\u{a}description = "MongoDB… build_support/betterleaks.rs:2846
https://raw.githubusercontent.com/google/osv-scalibr build_support/veles.rs:7
https://circleci.com/api/v1.1/project/scalibr-validation-nonexistent-a8f3c2d9 build_support/veles.rs:228
https://api.deno.com/organization build_support/veles.rs:241
https://api.digitalocean.com/v2/account build_support/veles.rs:251
https://discord.com/api/v10/users/@me build_support/veles.rs:262
https://api.x.ai/v1/api-key build_support/veles.rs:275
https://registry.npmjs.org/-/whoami build_support/veles.rs:289
https://openrouter.ai/api/v1/auth/key build_support/veles.rs:298
https://api.getpostman.com/me build_support/veles.rs:318
https://api.postman.com/collections/aaaaaaaa-aaaaaaaa-aaaa-aaaa-aaaaaaaaaaaa?access_key={{ TOKEN | url_encode }} build_support/veles.rs:331
https://api.sendgrid.com/v3/user/account build_support/veles.rs:344
https://identity.bitwarden.com/connect/token build_support/veles.rs:470
https://api.cloudflare.com/client/v4/zones build_support/veles.rs:496
https://api.heroku.com/account build_support/veles.rs:512
https://hub.docker.com/v2/auth/token/ build_support/veles.rs:532
https://auth.idp.hashicorp.com/oauth2/token build_support/veles.rs:588
https://packagist.com/api/packages/ build_support/veles.rs:619
https://slack.com/api/auth.test build_support/veles.rs:749
https://[^:\s]+:[^\s@]+@ build_support/veles.rs:769
https://(?P<GIT_USERNAME>[^:\s]+):(?P<GIT_PASSWORD>[^\s@]+)@ build_support/veles.rs:770
https://bitbucket.org/{{ TOKEN | split: '@bitbucket.org/' | last }}/info/refs?service=git-upload-pack build_support/veles.rs:801
https://git-codecommit.{{ TOKEN | split: '@git-codecommit.' | last }}/info/refs?service=git-upload-pack build_support/veles.rs:804
https://git.{{ TOKEN | split: '@git.' | last }}/info/refs?service=git-upload-pack build_support/veles.rs:807
https://{{ SALESFORCE_INSTANCE }}/services/oauth2/token build_support/veles.rs:828
https://login.salesforce.com/services/oauth2/token build_support/veles.rs:873
mongodb+srv://$(MONGODB_USERNAME):{password}@cluster.invalid/db src/defaults.rs:212
mongodb://$(MONGODB_USERNAME):r4nd0mLiteralSecret@cluster.invalid/db src/defaults.rs:216
mongodb://alice:r4nd0mLiteralSecret@$(MONGODB_HOST)/db src/defaults.rs:217
mongodb://alice:literal$(suffix)@cluster.invalid/db src/defaults.rs:218
mongodb://alice:dollar%24literal@cluster.invalid/db src/defaults.rs:219
https://user:password@bitbucket.org/team/repo.git src/defaults.rs:752
\u{a}type: Betterleaks\u{a}content:\u{a} expression: 'let r = http.get("https://example.invalid"); r.status == 200 ? {"result": "valid"} : validate.unknown(r)'\u{a} analyze: 'analysis.capabilities({… src/rule.rs:1884
type: Betterleaks\u{a}content:\u{a} expression: 'let r = http.delete("https://example.invalid"); r.status == 204 ? {"result": "revoked"} : revoke.unknown(r)'\u{a} src/rule.rs:1896
https://primary.example/identity src/rule.rs:1909 src/rule.rs:1911 src/rule.rs:1952 src/rule.rs:1954
https://secondary.example/identity src/rule.rs:1912
https://primary.example src/rule.rs:1935 src/rule.rs:1936
method: GET\u{a}url:\u{a} - https://primary.example/identity\u{a} src/rule.rs:1950
https://{{ APPID }}-dsn.algolia.net/1/keys/{{ TOKEN }} src/rules.rs:387
https://hooks\.slack\.com/services/ src/rules_database.rs:1555

info unsafe_code library 4

6 unsafe blocks, functions or impls src/rule_cache_security_macos.rs:24
22 unsafe blocks, functions or impls src/rule_cache_security_windows.rs:50
2 unsafe blocks, functions or impls src/rules_database.rs:1069
1 unsafe blocks, functions or impls src/scanner_pool.rs:76

Run: check

failed

Ended: agent reported the end
Guest: exit code 101
Run time: 418 ms
VM restore: 60 ms
Payload: 19251 files, 476.0 MiB
Files opened: 821

Processes 1

Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.

Process	Arguments	Start	Took	Exit
cargo /usr/local/bin/cargo	check --locked --offline	5 ms	406 ms	25856

Network 0

No network activity.

Files 0

Secrets opened

None.

Written outside the build directories

None.

Scratch disk 0

Files: 7
Directories: 12
Size: 56.6 KiB
Compiled units: 0

Nothing outside the build areas.

Output

Standard error

error: rustc 1.98.1 is not supported by the following packages:
  kingfisher-core@1.0.5 requires rustc 1.99
  kingfisher-rules@3.0.0 requires rustc 1.99
  kingfisher-rules@3.0.0 requires rustc 1.99
  kingfisher-rules@3.0.0 requires rustc 1.99
Either upgrade rustc or select compatible dependency versions with
`cargo update <name>@<current-ver> --precise <compatible-ver>`
where `<compatible-ver>` is the latest version supporting rustc 1.98.1

Timeline

When	From	To	Event	Worker
2026-10-28 03:20 UTC	Discovered	Fetched	fetched	fetcher-12688
2026-10-28 03:20 UTC	Fetched	ReadyForSandbox	static_analysis_completed	static-12726
2026-10-28 03:20 UTC	ReadyForSandbox	Running	sandbox_started	orchestrator-12760-slot2
2026-10-28 03:20 UTC	Running	DynamicallyAnalyzed	sandbox_completed	orchestrator-12760-slot2
2026-10-28 03:20 UTC	DynamicallyAnalyzed	Scored	scored	analyzer-12816
2026-10-28 03:20 UTC	Scored	Done	finalized	analyzer-12816