Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

False positive for ballerina:14 (Non configurable secrets) when a secret-named parameter defaults to nil ()

Open
  • Is something wrong?
#104 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
java
Domain
security, tooling

Research direction

Start by reproducing the ballerina:14 scan with the provided decodeRsaPrivateKeyFromKeyFile example and locate the implementation of rule ballerina:14. Check how secret-named parameters are evaluated when their default is nil (), then verify the example produces no finding while fixed secret defaults remain reported.

Written by the indexing model from the issue text.

Description

Type/Bug
Description

Rule ballerina:14 (Non configurable secrets are security-sensitive) flags a defaultable function parameter whose name looks like a secret, even when its default value is nil (). A nil default means "no value supplied". It isn't a fixed secret, so this shouldn't be reported.

Steps to Reproduce

Scan a Ballerina file containing:

public isolated function decodeRsaPrivateKeyFromKeyFile(string keyFile, string? keyPassword = ())
                                                        returns PrivateKey|Error = @java:Method {
    'class: "io.ballerina.stdlib.crypto.nativeimpl.Decode"
} external;

(Found in the ballerina/crypto module.)

Actual Behavior

A ballerina:14 issue is raised.

Expected Behavior

No issue should be reported. keyPassword = () only makes the parameter optional, and callers still pass the real value at runtime. No secret is hardcoded and nothing needs rotating.

This pattern is common in standard library and connector APIs, so the false positive will appear in many projects.

Version

0.12.0

Environment Details (with versions)

No response

Dominant language
Java
Stars
15
Forks
12
Avg merge
12h 17m
Merged PRs (30d)
13

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ballerina-platform/static-code-analysis-tool

All issues in ballerina-platform/static-code-analysis-tool

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.