error secret-leak

What it means#

A secret<T> is hidden from logs and traces and printed as ***; reveal() is the only way to read it (§13.3). The analyzer follows the revealed value and reports when it reaches a log call, string interpolation or a response, where it would defeat that protection.

Example#

fn login(token: secret<str>) io {
  print("token is {token.reveal()}")      // <- secret-leak
}

secret-leak

How to fix#

fn login(token: secret<str>) io {
  print("token is {token}")
}

Pass the secret itself (it prints as ***) and call reveal() only at the point where the plain value is needed, such as a cryptographic function.

See also#

• unused
• effects