Tracks secrets (environment, keyrings, config, credential files, tokens, password prompts) to where they leave the process.
By default, the content of any file may hold secrets (FileContent), see FileTrust.
Hashes and presence checks declassify them, authentication channels make them a Credential, and requests carrying
them return a Response, or a new secret from a token endpoint.
Network calls are no findings here, as whether sending a secret leaks it depends on the destination (see secret-exfiltration).
Tracks secrets (environment, keyrings, config, credential files, tokens, password prompts) to where they leave the process. By default, the content of any file may hold secrets (FileContent), see FileTrust. Hashes and presence checks declassify them, authentication channels make them a Credential, and requests carrying them return a Response, or a new secret from a token endpoint. Network calls are no findings here, as whether sending a secret leaks it depends on the destination (see
secret-exfiltration).