3. Sensitive path heuristic
Built-in heuristics for credential-shaped paths the curated list does not name.
| Phase | 1, static |
| Score | 0.5 - 5.0, highest single hit |
| Source | crates/grith-proxy/src/filters/sensitive_path.rs |
| Config | none - the rules are compiled in |
Where path-match is a curated list you can edit, this is the built-in complement: shapes that any reasonable observer would call sensitive, whether or not anyone added them to a list. It is not configurable, on purpose - a misconfigured file should not be able to silence credential detection.
Several rules can match one path. The highest single hit wins; they do not sum.
The rules
| Rule | Fires on | Read | Write / delete |
|---|---|---|---|
os-secret-store | Windows SAM, macOS keychains, sss cache, krb5.keytab | 4.2 | 5.0 |
grith-self-access | anything under ~/.config/grith/ | 4.5 | 5.0 |
cross-process-memory | another process's /proc/<pid>/environ or mem | 4.5 | 4.5 |
credential-directory | .ssh/, .gnupg/, .aws/, .azure/, .kube/, .docker/, .pki/, gcloud | 4.0 | 4.5 |
key-material-file | .pem, .key, .p12, .pfx, id_rsa, id_ed25519, id_dsa, id_ecdsa | 4.0 | 5.0 |
path-shadow-write | a write into a $PATH directory whose name collides with a system command | - | 4.0 |
browser-session-data | a browser profile directory; its cookie and password stores score 3.5 on read | 3.0 - 3.5 | 4.0 |
system-etc-path | the genuinely secret parts of /etc - shadow, sudoers, TLS private keys, kubeconfigs, wifi PSKs | 3.0 | 4.0 |
credential-file-shape | secrets.yaml, credentials.json, *-credentials.json | 3.5 | 4.0 |
env-file-heuristic | .env and .env.*, minus the template suffixes | 3.0 | 3.5 |
persistence-or-control-path | systemd units, cron, autostart, /boot, the docker socket | 3.0 | 4.0 |
secretish-filename | a filename containing a credential-ish whole token | 2.8 | 3.5 |
kernel-interface-path | anything else under /proc or /sys | 2.5 | 4.0 |
system-etc-write | any other /etc path, on a write | - | 3.0 |
nss-cert-store-change | a write or delete under ~/.pki/nssdb/; a read scores nothing | - | 1.5 |
system-etc-config-read | any other /etc path, on a read | 0.5 | - |
Reading /etc is mostly cheap
Most of /etc is world-readable application config - nginx, docker, postgres, pip.conf.
Reading it scores 0.5, well under the allow line, so routine service-config inspection does
not queue. Only the parts that actually hold secrets keep the 3.0 tier, and any write to
/etc stays elevated:
$ grith proxy test '{"type":"FileRead","path":"/etc/hosts"}'
Score: 0.5
Decision: ALLOW
Filter Breakdown:
+ sensitive-path-heuristic 0.5 [notice] read reads a system config pathThe weak-name rule earns its carveouts
secretish-filename is the loosest rule here, and the one most likely to be wrong. It matches
whole tokens only - authority, AUTHORS and authorize no longer trip it - and it is
suppressed for source-code extensions, documentation and build artefacts, numbered SQL
migrations, and anything inside a vendored dependency tree. A package chooses its own
filenames, so node_modules/aws-sdk/lib/credentials/sso_credentials.js carries no authority.
The carveout is scoped to the weak rule. .env, *.pem, ~/.ssh/* and /etc/shadow keep
firing everywhere including inside a dependency tree, because a real credential store planted
under node_modules/ must still score.
A write that shadows a system command
Package managers install new binaries into $PATH directories constantly, so a write there
is not suspicious by itself. A write whose basename collides with an existing system command
is:
$ grith proxy test '{"type":"FileWrite","path":"/home/u/.local/bin/curl","content_hash":""}'
Score: 4.5
Decision: QUEUE (Medium)
Filter Breakdown:
+ operation-risk 0.5 [notice] File write: /home/u/.local/bin/curl
+ sensitive-path-heuristic 4.0 [error] write writes a binary shadowing system command 'curl'See also
- 2. Static path matching
- 15. Taint tracking - what happens after a sensitive read