False Positives for every gem-handled password assignment #145240
Replies: 2 comments
-
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
-
also, Why does it have to repeat the same message multiple times for the same line? |
Beta Was this translation helpful? Give feedback.
-
Select Topic Area
Bug
Body
in the example shown below, passwords are stored in an
encrypted_password
column and encryption is handled by the extremely commonDevise
gem.this is the correct way to assign a password with devise, but Github flags every assignment, without any regards to the very very very common use case where assignment is done directly in an in-memory-only virtual attribute, and it is stored encrypted in a completely different column
I understand it's better to have a false positive than miss it, but there's no way that I'm aware of to make the scanner stop incorrectly flagging lines at least per repo
Beta Was this translation helpful? Give feedback.
All reactions