Security Risk
Detects SQL injection patterns, weak crypto algorithms (MD5, SHA1, DES), dangerous APIs (Assembly.Load, Process.Start), and credential exposure.
Why this rule exists
These are not theoretical risks. SQL injection, MD5 password hashes, and unvalidated Process.Start calls are still the top sources of breach disclosures every year.
Code example
+ var sql = $"SELECT * FROM Users WHERE Email = '{email}'";
+ using var hash = MD5.Create();+ var sql = "SELECT * FROM Users WHERE Email = @Email";
+ cmd.Parameters.AddWithValue("@Email", email);
+ var hash = SHA256.HashData(Encoding.UTF8.GetBytes(input));Configuration
Disable or adjust the severity of this rule in .gauntletci.json:
{
"rules": {
"GCI0012": { "enabled": true, "severity": "Block" }
}
}See Configuration for the full schema.
Related rules
Hardcoding and Configuration
Detects hardcoded IPs, URLs, connection strings, secrets, and environment names committed to source.
Insecure Random in Security Context
Detects System.Random instantiation within 5 lines of security-sensitive identifiers such as token, apikey, salt, or password. System.Random is not cryptographically secure.
PII Entity Logging Leak
Detects PII-sensitive terms (email, SSN, password, etc.) appearing inside log calls in added lines.
Implemented in src/GauntletCI.Core/Rules/Implementations/GCI0012_*.cs.
Eric Cogen -- Founder, GauntletCI
Twenty years in .NET production. Most of those years, the bugs that hurt me were not the ones tests caught. They were the assumptions I did not know I was making: a removed guard clause, a renamed method that still did the old thing, a catch {} that turned a page into a silent dashboard lie. GauntletCI is the checklist I wish I had run before every commit. It runs the rules I learned the hard way, so you do not have to.