# Detects hardcoded passwords in cache configuration
# Corpus claim: cache/credentials/password hardcoded false
# Pattern: password: "literal_string" or password = "literal_string"
#
# Violation: password: "secret123" hardcoded in source
# Correct: password: std::env::var("REDIS_PASSWORD")
#
# Consequence: Credentials leak via version control, cannot rotate without code changes

[[extractors.declarative]]
name = "hardcoded_password"
description = "Detects hardcoded password strings in cache config"
languages = ["rust"]
pattern = 'password:\s*"[^"]+"\.to_string\(\)'
claim.subject = "credentials/password"
claim.predicate = "hardcoded"
claim.value = true
confidence = 0.9
