# Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526)

The product uses environment variables to store sensitive information, but the environment is accessible to other processes or users.

- Prevalence: 보통 1개 언어 지원
- Impact: 높음 1개의 높은 심각도 규칙
- Prevention: 문서화됨 1개의 수정 예시

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Environment variables are often visible to child processes and may be logged or exposed through error messages. Storing sensitive information like credentials in environment variables can lead to information disclosure.

## Prevention

### Go

Never log or expose environment variables containing secrets

## Consequences

- 애플리케이션 데이터 읽기
- 권한 획득

## Mitigations

- 전용 시크릿 관리 시스템을 사용하세요
- 민감한 값은 환경 변수에 저장하기 전에 암호화하세요
- 프로세스 환경에 대한 접근을 제한하세요

## Detection

- Total rules: 1
- Languages: go

## Rules by Language

### Go (1 rules)

- **Environment Variable Exposure** [HIGH]: Environment variables logged or included in HTTP responses.
  - Remediation: Use environment variables for configuration only, never log or expose them.

```go
dbURL := os.Getenv("DATABASE_URL")
// Use dbURL for connection only
// Never log it: log.Printf("DB: %s", dbURL) // Wrong!
```

Learn more: https://shoulder.dev/learn/go/cwe-526/env-var-exposure