From f370027252b767be7ef69e6aae6af0d73a979e91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juraci=20Paix=C3=A3o=20Kr=C3=B6hling?= Date: Fri, 3 Apr 2026 16:31:20 +0200 Subject: [PATCH] feat: add sensitive data detection rules (RES-010, SPA-006, LOG-003) Propose three new Critical rules that detect sensitive data leaking through telemetry attributes and log record bodies, covering PII, financial identifiers, credentials, and health information. Closes #51 Co-Authored-By: Claude Opus 4.6 (1M context) --- rules/LOG-003.md | 27 +++++++++++++++++++++++++++ rules/RES-010.md | 26 ++++++++++++++++++++++++++ rules/SPA-006.md | 27 +++++++++++++++++++++++++++ 3 files changed, 80 insertions(+) create mode 100644 rules/LOG-003.md create mode 100644 rules/RES-010.md create mode 100644 rules/SPA-006.md diff --git a/rules/LOG-003.md b/rules/LOG-003.md new file mode 100644 index 0000000..afd5443 --- /dev/null +++ b/rules/LOG-003.md @@ -0,0 +1,27 @@ +**Rule ID:** LOG-003 + +**Description:** Log record bodies do not contain sensitive data such as PII, financial identifiers, credentials, or health information. + +**Rationale:** Telemetry data is typically stored in observability backends with broader access than production databases. When log record bodies contain sensitive data, it creates compliance risks (GDPR, HIPAA, PCI-DSS) and security vulnerabilities. Application logs frequently dump user context, request payloads, or error messages that include credentials, PII, or other sensitive fields. This is especially common when using structured logging frameworks that automatically serialize request or user objects. OpenTelemetry Semantic Conventions [explicitly discourage](https://opentelemetry.io/docs/specs/semconv/general/attributes/#sensitive-information) recording sensitive information in telemetry. + +**Target:** Log + +**Criteria:** Log record body values MUST NOT contain patterns that match common sensitive data formats, including but not limited to: + +- Email addresses (e.g., `user@example.com`) +- Credit card numbers (sequences of 13-19 digits matching Luhn validation) +- Social security numbers or national ID numbers (e.g., `123-45-6789`) +- Bearer tokens, API keys, or other credentials (e.g., `Bearer eyJ...`, `sk-...`, `AKIA...`) +- Passwords or secrets in key-value patterns (e.g., `password=...`, `secret=...`, `token=...`) +- Financial identifiers such as bank account numbers or tax IDs + +This rule applies to the log record body when it is a string value, as well as to string values within structured (map or array) log record bodies. + +**Examples:** + +- "Log record body contains `Failed login for user alice@example.com from 10.0.0.1`, which includes an email address." +- "Log record body contains `Payment processed for card 4111-1111-1111-1111`, which matches a credit card number pattern." +- "Log record body contains `Authorization: Bearer eyJhbGciOiJIUzI1NiIs...`, which includes an authentication token." +- "Log record body contains `{"user": {"ssn": "123-45-6789", "name": "Alice"}}`, which includes a social security number." + +**Impact:** Critical diff --git a/rules/RES-010.md b/rules/RES-010.md new file mode 100644 index 0000000..db1a782 --- /dev/null +++ b/rules/RES-010.md @@ -0,0 +1,26 @@ +**Rule ID:** RES-010 + +**Description:** Resource attribute values do not contain sensitive data such as PII, financial identifiers, credentials, or health information. + +**Rationale:** Telemetry data is typically stored in observability backends with broader access than production databases. When resource attributes contain sensitive data, it creates compliance risks (GDPR, HIPAA, PCI-DSS) and security vulnerabilities. A common leakage vector is `process.command_args`, where credentials are passed as CLI flags (e.g., `-Djavax.net.ssl.trustStorePassword=SECRET`). Custom resource attributes may also inadvertently capture environment variables or configuration values containing secrets. OpenTelemetry Semantic Conventions [explicitly discourage](https://opentelemetry.io/docs/specs/semconv/general/attributes/#sensitive-information) recording sensitive information in telemetry attributes. + +**Target:** Resource + +**Criteria:** Resource attribute values MUST NOT contain patterns that match common sensitive data formats, including but not limited to: + +- Email addresses (e.g., `user@example.com`) +- Credit card numbers (sequences of 13-19 digits matching Luhn validation) +- Social security numbers or national ID numbers (e.g., `123-45-6789`) +- Bearer tokens, API keys, or other credentials (e.g., `Bearer eyJ...`, `sk-...`, `AKIA...`) +- Passwords or secrets in key-value patterns (e.g., `password=...`, `secret=...`, `token=...`, `trustStorePassword=...`) +- Financial identifiers such as bank account numbers or tax IDs + +This rule applies to all string-typed resource attribute values, including individual elements of array-typed attributes such as `process.command_args`. + +**Examples:** + +- "Resource attribute `process.command_args` contains value `-Djavax.net.ssl.trustStorePassword=MyS3cret!`, which includes a credential." +- "Resource attribute `process.command_args` contains value `-Dspring.datasource.password=hunter2`, which includes a password in a key-value pattern." +- "Resource attribute `custom.config` contains value `api_key=sk-proj-abc123def456`, which includes an API key." + +**Impact:** Critical diff --git a/rules/SPA-006.md b/rules/SPA-006.md new file mode 100644 index 0000000..c3cb446 --- /dev/null +++ b/rules/SPA-006.md @@ -0,0 +1,27 @@ +**Rule ID:** SPA-006 + +**Description:** Span attribute values do not contain sensitive data such as PII, financial identifiers, credentials, or health information. + +**Rationale:** Telemetry data is typically stored in observability backends with broader access than production databases. When span attributes contain sensitive data, it creates compliance risks (GDPR, HIPAA, PCI-DSS) and security vulnerabilities. Common leakage vectors include `db.query.text` with embedded user data, `url.full` with PII in query parameters, `http.request.header.*` with authorization headers or cookies, and custom attributes capturing unsanitized request or response payloads. OpenTelemetry Semantic Conventions [explicitly discourage](https://opentelemetry.io/docs/specs/semconv/general/attributes/#sensitive-information) recording sensitive information in telemetry attributes. + +**Target:** Span + +**Criteria:** Span attribute values MUST NOT contain patterns that match common sensitive data formats, including but not limited to: + +- Email addresses (e.g., `user@example.com`) +- Credit card numbers (sequences of 13-19 digits matching Luhn validation) +- Social security numbers or national ID numbers (e.g., `123-45-6789`) +- Bearer tokens, API keys, or other credentials (e.g., `Bearer eyJ...`, `sk-...`, `AKIA...`) +- Passwords or secrets in key-value patterns (e.g., `password=...`, `secret=...`, `token=...`) +- Financial identifiers such as bank account numbers or tax IDs + +This rule applies to all string-typed span attribute values. Attribute keys such as `enduser.id` are excluded from pattern matching when their values are opaque, non-reversible identifiers. + +**Examples:** + +- "Span attribute `db.query.text` contains value `SELECT * FROM users WHERE email='alice@example.com'`, which includes an email address." +- "Span attribute `url.full` contains value `https://api.example.com/users?ssn=123-45-6789`, which includes a social security number." +- "Span attribute `http.request.header.authorization` contains value `Bearer eyJhbGciOiJIUzI1NiIs...`, which includes an authentication token." +- "Span attribute `custom.payment_info` contains value `4111-1111-1111-1111`, which matches a credit card number pattern." + +**Impact:** Critical