Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

False positive for `ballerina:14` when a secret-named variable is assigned the result of a function call

Open
  • Is something wrong?
#105 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
58/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Domain
security, tooling

Research direction

Locate the implementation and tests for rule ballerina:14, then reproduce the report using the Ballerina snippet in the issue. Trace how the rule distinguishes fixed values from function-call results and add coverage for the runtime-computed assignment. Done means the example produces no ballerina:14 issue while fixed secret assignments remain reported.

Written by the indexing model from the issue text.

Description

Type/Bug
Description

Rule ballerina:14 (Non configurable secrets are security-sensitive) reports secret-named variables whose value is computed at runtime by a function call. A value returned from a function isn't a fixed secret, and it can't sensibly be made configurable, so this is a false positive.

The rule's description says it targets "a secret that is assigned a fixed value". A runtime-computed value doesn't fit that.

Steps to Reproduce

Scan a Ballerina file containing:

byte[] sharedSecret = check decapsulateMlKem768(encapsulationResult.encapsulatedSecret, privateKey);
Actual Behavior

Raises a ballerina:14 issue.

Expected Behavior

No issue should be reported. sharedSecret comes from a KEM decapsulation at runtime. It isn't hardcoded, it doesn't need rotating through config, and a derived key should never come from config at all.

Version

0.12.0

Environment Details (with versions)

No response

Dominant language
Java
Stars
15
Forks
12
Avg merge
12h 17m
Merged PRs (30d)
13

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ballerina-platform/static-code-analysis-tool

All issues in ballerina-platform/static-code-analysis-tool

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.