Skip to content

secret-prop

Id
@azure-tools/typespec-azure-resource-manager/secret-prop

RPC-v1-13: Check that property with names indicating sensitive information(e.g. contains auth, password, token, secret, etc.) are marked with @secret decorator.

Marking these fields lets ARM and SDK tooling identify sensitive values and handle them according to security guidelines.

Impact

Section titled “Impact”
  • Area: SDK, API

Returning a secret in a response violates the RPC contract unless the property is genuinely not a secret.

LintDiff Equivalent

Section titled “LintDiff Equivalent”

This rule corresponds to the LintDiff rule XMSSecretInResponse.

❌ Incorrect

Section titled “❌ Incorrect”
model Data {
  userPassword: string;
  apiKey: string;
}

✅ Correct

Section titled “✅ Correct”
model Data {
  @secret
  userPassword: string;


  apiKey: apiKey;
}

Or create a reusable scalar marked with @secret:

@secret
scalar apiKey extends string;

Suppression

Section titled “Suppression”

Suppress only if the property is not actually a secret; otherwise mark it as a password type or with the @secret decorator.