Ccodemod

codemod/secure-param-defaults-audit

Read-only audit of deployment JSON templates for top-level secureString and secureObject parameters that incorrectly include defaultValue, with findings, metrics, and remediation guidance.

deploymentsecuritytemplatescode-miningreporting
Public
0 executions
Apply to Repository

Run locally

npx codemod @codemod/secure-param-defaults-audit

@codemod/secure-param-defaults-audit

Read-only audit of deployment JSON templates for top-level secureString and secureObject parameters that incorrectly include defaultValue, with findings, metrics, and remediation guidance.

What It Does

  • Scans **/*.json deployment templates only.
  • Inspects only the top-level parameters object.
  • Reports one finding per top-level parameter whose type is exactly secureString or secureObject and that also declares defaultValue.
  • Emits file-level metrics for files with findings plus per-type and per-parameter counters.
  • Never rewrites source files.

Detection Rules

The codemod treats a JSON file as a deployment template when it has a top-level parameters object and template markers such as:

  • a deployment template $schema
  • a top-level resources array
  • top-level variables or outputs
  • contentVersion together with typed parameter definitions

Each finding includes stable metadata such as:

  • filePath
  • paramName
  • secureType
  • jsonPointer
  • line and column
  • remediation guidance

Recommended remediation: remove the defaultValue and provide the secret at deployment time through a secure parameter file, a key-management reference, or CI/CD secret injection.

Exclusions

  • non-JSON files
  • non-template JSON documents
  • deployment parameter files that use the deployment-parameters schema
  • nested objects coincidentally named parameters
  • parameter types other than exact secureString and secureObject
  • secure parameters that omit defaultValue
  • defaultValue mentions that only appear in metadata, descriptions, or examples

Metrics

  • deployment_templates_scanned
  • deployment_secure_param_defaultvalue_files
  • deployment_secure_param_defaultvalue_findings
  • deployment_securestring_defaultvalue_findings
  • deployment_secureobject_defaultvalue_findings

Current parser mode uses JSSG's JSON language, so malformed JSON files do not reach the transform. The optional unparsable-file metric from the spec is therefore not emitted by this package.

Usage

bash

Development

bash

License

MIT

Ready to contribute?

Build your own codemod and share it with the community.

Publish a codemodJoin the community