vetkit.openapi.auth.api-key-in-query
The API description defines an API key passed in the query string. Keys in URLs end up in server, proxy and browser logs and in Referer headers.
Last updated:
Suite: Security
json, yaml
The API description defines an API key passed in the query string. Keys in URLs end up in server, proxy and browser logs and in Referer headers.
Category: SECURITY · Engine rule severity: INFO
How to fix it
Accept the key in a request header (in: header) instead.
References
Source: packages/engine/rules/sast/config.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.