{"record":{"id":"ae0d529b490e5dee","repo":"davila7/claude-code-templates","slug":"sem-e011","errorCode":"SEM_E011","errorMessage":"Hardcoded password detected","messagePattern":"Hardcoded password detected","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli-tool/src/validation/validators/SemanticValidator.js","lineNumber":115,"sourceCode":"      {\n        pattern: /output\\s+raw\\s+(code|text|data)/gi,\n        code: 'SEM_W003',\n        message: 'Raw output request (potential data exfiltration)',\n        severity: 'low'\n      },\n      {\n        pattern: /(repeat|echo)\\s+after\\s+me/gi,\n        code: 'SEM_W004',\n        message: 'Repetition instruction (potential prompt leakage)',\n        severity: 'low'\n      }\n    ];\n\n    // Sensitive data patterns\n    this.SENSITIVE_DATA_PATTERNS = [\n      {\n        pattern: /(?:password|passwd|pwd)\\s*[:=]\\s*[^\\s]+/gi,\n        code: 'SEM_E011',\n        message: 'Hardcoded password detected',\n        severity: 'critical'\n      },\n      {\n        pattern: /(?:api[_-]?key|apikey)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi,\n        code: 'SEM_E012',\n        message: 'Hardcoded API key detected',\n        severity: 'critical'\n      },\n      {\n        pattern: /(?:secret|token)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi,\n        code: 'SEM_E013',\n        message: 'Hardcoded secret/token detected',\n        severity: 'critical'\n      }\n    ];\n  }\n","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/davila7/claude-code-templates/blob/a0851ed10c7c60463dac8cfaaca124cf32d5804d/cli-tool/src/validation/validators/SemanticValidator.js#L97-L133","documentation":"SEM_E011 is a critical finding from checkSensitiveData: the regex /(?:password|passwd|pwd)\\s*[:=]\\s*[^\\s]+/gi matched the component content. The validator refuses content that appears to embed a literal password via key:value or key=value syntax, since components are distributed publicly and any committed credential is compromised.","triggerScenarios":"validate() where content contains 'password: something', 'passwd=abc', or 'pwd: x' followed by any non-whitespace value. Note the value can be a placeholder like $PASSWORD or '${pwd}' and still match because the regex accepts any non-space token.","commonSituations":"YAML frontmatter or config examples in agent/command markdown that hardcode 'password: mysecret123'; environment-variable docs like 'password: <your-password-here>' also match since the pattern does not require a quoted literal.","solutions":["Replace the literal with an environment variable reference and a key name only, e.g. 'password: use $DB_PASSWORD (set it in your shell)' — but note any non-space token matches, so prefer rephrasing to 'set the DB_PASSWORD env var' with no key:value shape","Remove the credential from the markdown entirely and document where to configure it","If a real secret was committed, rotate it immediately — it is compromised"],"exampleFix":"# before\npassword: SuperSecret123\n# after\nSet the DB_PASSWORD environment variable before running (never inline it).","handlingStrategy":"validation","validationCode":"const credRegex = /(?:password|passwd|pwd)\\s*[:=]\\s*[^\\s]+/gi;\nconst hits = component.content.match(credRegex) ?? [];\nconst real = hits.filter(h => !/[<>$\\{(]|env|placeholder|example/i.test(h));\nif (real.length) throw new Error('hardcoded credential');","typeGuard":null,"tryCatchPattern":"try { const r = await validator.validate(component); } catch (e) { /* inspect r/finding, strip secret, rotate */ }","preventionTips":["Never write key:value credentials in markdown; document env var names only","Use secret scanners (gitleaks/trufflehog) in CI","Rotate any credential that ever appears in a file"],"tags":["hardcoded-credentials","security","static-analysis"],"backgroundTag":"hardcoded-secret-detected","analyzedSha":"a0851ed10c7c60463dac8cfaaca124cf32d5804d","analyzedAt":"2026-08-28T14:11:56.058Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}