Detecting and Redacting Exposed Credentials in Diagnostic Responses
A diagnostic or status page accidentally includes database passwords or signing keys in its response. The verifier detects exposed secret patterns without storing raw credentials in plain text, hashes the structural witness, and compiles an outbound redaction rule.
Secret exposure occurs when diagnostic endpoints, verbose error traces, or serialized configuration objects return private signing keys, bearer tokens, or storage connection strings in server responses. Once an automated crawler or language model ingests that response, the credential is permanently compromised.
1. Interception and Rule Synthesis Schematic for SEC-LEAK
Verification sequence for SEC-LEAK: candidate probe inspection by wire rule SEC-ZD-SEC-01, differential confirmation via witness 2c95eab46a673898, and compilation of gateway contract IMMUNE-SEC-2C95EAB4.
2. In-Path Mutation Blocking and Paired Decoy Verification (SEC-LEAK)
Under rule SEC-ZD-SEC-01, the verifier never writes raw secret values to disk or external logs. Discovered token structures are immediately masked and converted into a salted structural digest before being recorded in the Streebog-256 audit chain.
On the benchmark testbed, the engine distinguishes genuine credential leaks on misconfigured diagnostic routes from benign public key fingerprints and documentation placeholders on decoy routes. All four scenarios pass with two true positives and two true negatives.
Class Identifier: SEC-LEAK (secret_exposure)
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: GET /api/v1/vuln/secrets/debug-config
Blocked Mutation: Exfiltrate live .env credentials to external sink
Stand Confusion Matrix: TP = 2, FP = 0, TN = 2, FN = 0 (FPR = 0.0%)
Wire Sandbox Rule: SEC-ZD-SEC-01
Formal Witness Hash: 2c95eab46a673898
Compiled Sentinel Rule: IMMUNE-SEC-2C95EAB4 (synthesis time 20 µs)3. Automatic Synthesis of Gateway Rule IMMUNE-SEC-2C95EAB4
Witness 2c95eab46a673898 produces contract IMMUNE-SEC-2C95EAB4 in 20 microseconds. The compiled rule blocks unauthenticated access to diagnostic routes and strips high-entropy credential fields at the proxy layer.
4. Related Benchmark Classes on the INDRA Stand
INJ-SQL: Database Query InjectionINJ-CMD: Operating System Command InjectionDIR-TRV: Filesystem Path TraversalAUTH-BOLA: Broken Object Level AuthorizationSSRF-INT: Server-Side Request Forgery and Redirect BypassHDR-SEC: Missing Transport and Framing Security HeadersDOS-RSRC: Computational Resource Exhaustion (Isolated Lab Mode)