Lint codes
E013
secret input used in `extract` or rendered into a URL
Error: secret input used in extract or rendered into a URL.
A version with this finding cannot be published.
#Example
The contract fixture E013-secret-in-extract reports E013 at extract.leak.selector:
{
"kaab": "1",
"inputs": {
"token": {
"type": "secret"
}
},
"steps": [
{
"goto": "https://example.com/"
}
],
"extract": {
"leak": {
"selector": "[data-token={{inputs.token}}]"
}
}
}