# E013

secret input used in `extract` or rendered into a URL

**Error**: secret input used in `extract` or rendered into a URL.

A version with this finding cannot be published.

## Example

The contract fixture `E013-secret-in-extract` reports `E013` at `extract.leak.selector`:

```json
{
  "kaab": "1",
  "inputs": {
    "token": {
      "type": "secret"
    }
  },
  "steps": [
    {
      "goto": "https://example.com/"
    }
  ],
  "extract": {
    "leak": {
      "selector": "[data-token={{inputs.token}}]"
    }
  }
}
```