Rust DoctorRepository · Security
CI step compiles with a secret in scope
rust_doctor::repo::secret_in_build_step
Move the secret to the one step that needs it and compile in a step without it; publish with cargo publish --no-verify after verifying the package in a step that holds no token.
- Category
- Security
- Default level
- warn
- Tier
- P1
- Producer
- Repository
- Diff scope
- line
Not a defect when
Every dependency compiled in the step is vendored or pinned and audited, or the secret grants nothing a build script could abuse, such as a read-only token for a public resource.
What it reads
What git tracks.
Tier
Serious: worth interrupting other work for.
The tier bounds how severe a rule may be; its category bounds the tier.Diff scope
The changed line itself.
What--scope contextual looks at to decide whether a change caused the finding.Change it
Turn it off, or make it blocking, without touching the code it flags:
rust-doctor --rule rust_doctor::repo::secret_in_build_step=off .
rust-doctor --rule rust_doctor::repo::secret_in_build_step=error .