{
  "rule_ids": [
    "dotfile_overwrite",
    "sensitive_env_export"
  ],
  "severity": "HIGH",
  "command_redacted": "# Check if the GITHUB_TOKEN is exported and usable by git\nexport GITHUB_TOKEN=[R...",
  "findings": [
    {
      "rule_id": "dotfile_overwrite",
      "severity": "HIGH",
      "title": "Dotfile overwrite detected",
      "description": "Command redirects output to a dotfile in the home directory, which could overwrite shell configuration",
      "evidence": [
        {
          "type": "command_pattern",
          "pattern": "redirect to dotfile",
          "matched": "echo \"https://nhivo2504:$[REDACTED:Email Address]\" > ~/.git-credentials"
        }
      ],
      "mitre_id": "T1546.004"
    },
    {
      "rule_id": "sensitive_env_export",
      "severity": "HIGH",
      "title": "Sensitive credential exported: GITHUB_TOKEN",
      "description": "Setting GITHUB_TOKEN exposes a sensitive credential that may be logged in shell history",
      "evidence": [
        {
          "type": "env_var",
          "name": "GITHUB_TOKEN",
          "value_preview": "[REDACTED]"
        }
      ],
      "mitre_id": "T1552.001"
    }
  ],
  "timestamp": "2026-07-14T06:23:50.336151892+00:00"
}