CTX-X005: Secret or credential in context or MCP config
blocker · deterministic · autofix: none · beta
Why it matters
Context files are shared with model providers and committed to version control.
How to fix
Rotate the secret and load it from the environment.
Source
CWE-798
Measured precision
The benchmark corpus produced no findings for this rule yet, so its precision is not established and it stays beta.
Suppress
<!-- ctx-ignore CTX-X005: reason -->