Sensitive access followed by an outside-workspace write
A session refers to a credential-related file and then writes outside its recognized workspace.
Why it is risky
Section titled “Why it is risky”Copying a secret into an unrelated directory can make it available to another process, user, or later upload.
Example
Section titled “Example”After opening a project secret file, an agent writes a copy into an unrelated shared directory.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”This advanced rule relates an earlier reference to a credential-related file with a later recognized write outside the workspace in the same session.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_ADV_CREDENTIAL_READ_THEN_WRITE_OUTSIDE_WORKSPACE | exfiltration_sequence | Requires Pro | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Review the content written, the destination access controls, and the task authorization. Remove unintended copies and rotate secrets if access expanded beyond the intended audience.
False positives
Section titled “False positives”An approved backup or configuration migration can have this shape. The earlier path reference does not prove that a secret was read or included in the later write.
False negatives
Section titled “False negatives”Missing working-directory metadata, unrecognized write targets, activity spread out over time, or secret copies inside an allowed workspace may be missed.
Technical details
Section titled “Technical details”The finding links the two calls by their order in the session, without comparing the source contents with the destination contents. It requires a loaded advanced rule bundle.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.