rules:
- id: python-logger-credential-disclosure
  patterns:
  - pattern: |
      logger.$LOGGER_CALL($FORMAT_STRING,...)
  - metavariable-regex:
      metavariable: $LOGGER_CALL
      regex: (info|error|exception)
  - metavariable-regex:
      metavariable: $FORMAT_STRING
      regex: (?i).*(api.key|secret|credential|token).*\%s.*
  message: >-
    Logger call may be exposing a secret credential in $FORMAT_STRING
  severity: WARNING
  languages: [python]
  metadata:
    category: security
    technology:
    - python