/**
 * WGL038: Secret Reachable from a Merge-Request Pipeline
 *
 * Flags a user-defined secret-like variable (`*_PASSWORD`, `*_SECRET`,
 * `*_TOKEN`, `*_API_KEY`, …) referenced in a job reachable from merge-request
 * pipelines. Those pipelines can run an outside contributor's code, so a secret
 * they can read is a secret they can exfiltrate. Gate secret-using jobs to
 * protected refs, or make the variable protected so MR pipelines can't see it.
 *
 * Built-in `CI_*` variables are project-managed and excluded.
 */
import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
export declare const wgl038: PostSynthCheck;
//# sourceMappingURL=wgl038.d.ts.map