# Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526)

The product uses environment variables to store sensitive information, but the environment is accessible to other processes or users.

- Prevalence: 中 1 言語をカバー
- Impact: ハイ 1 件の重大度ハイのルール
- Prevention: 文書化済み 1 件の修正例

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Environment variables are often visible to child processes and may be logged or exposed through error messages. Storing sensitive information like credentials in environment variables can lead to information disclosure.

## Prevention

### Go

Never log or expose environment variables containing secrets

## Consequences

- アプリケーションデータの読み取り
- 権限の取得

## Mitigations

- 専用のシークレット管理システムを使用する
- 機密値は環境変数に保存する前に暗号化する
- プロセス環境へのアクセスを制限する

## Detection

- Total rules: 1
- Languages: go

## Rules by Language

### Go (1 rules)

- **Environment Variable Exposure** [HIGH]: Environment variables logged or included in HTTP responses.
  - Remediation: Use environment variables for configuration only, never log or expose them.

```go
dbURL := os.Getenv("DATABASE_URL")
// Use dbURL for connection only
// Never log it: log.Printf("DB: %s", dbURL) // Wrong!
```

Learn more: https://shoulder.dev/learn/go/cwe-526/env-var-exposure