Credentials Beyond Declared Tool Needs

What Foo Guard detects

A tool declares supplied credential references that are not in its required list. This is a declaration mismatch, not evidence that credentials were transmitted or used.

When this rule triggers

The rule triggers when A tool declares supplied credential references that are not in its required list. This is a declaration mismatch, not evidence that credentials were transmitted or used.

Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.

How to fix

Remove unnecessary bindings at the execution boundary. Verify the tool's actual requirements before correcting the declaration; do not broaden the required list merely to silence the finding.

Remove unnecessary bindings at the execution boundary. Verify the tool's actual requirements before correcting the declaration; do not broaden the required list merely to silence the finding.

Verify the change

Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.

Test the affected workflow in an isolated environment, including an operation that should be denied. Keep related findings in view: fixing this rule does not automatically resolve other identity, permission, tool, or audit risks.