ek9_query_sensitive_reveals

Answers first: status, revealCount, violationCount, privilegedCount, violationSites as file.ek9:LINE, then reveals[] {file, line, column, module, inConstruct, inConstructFqn, privilege}.

Category: Enquiry · Compare: EK9 IDE — "Sensitive Reveals" navigator (left dock): every Sensitive.reveal() call grouped by legality (⚠ unprivileged / in-function violations = E11090 first, then ✓ privileged), row-click navigate + Show call graph

When to use it

'Where are secrets revealed, and which reveals are illegal (E11090)' is one call with no arguments - every Sensitive.reveal() site with its privilege verdict.

When not to use it

env-var, network or filesystem capability audits, not the Sensitive type (use ek9_query_capability_usage)
just the LIST of E11090 errors, not the full reveal-site audit (use ek9_query_diagnostics)
E11090 explained rather than checked across the workspace (use ek9_explain_error)
references to some arbitrary symbol (use ek9_query_references; this tool is specific to Sensitive.reveal())

Details

Type-resolution-driven (mirrors the compiler's PrivilegedRevealOrError check): only calls that RESOLVE to Sensitive.reveal are counted, so a workspace compiled below FULL_RESOLUTION silently under-reports — run ek9_compile first for an audit-grade result. Per-reveal privilege: privileged (legal) / unprivileged (caller class lacks Privileged, E11090) / in-function (reveal in a free function, which can never be Privileged, E11090); inConstruct is 'Class.method' or the function name, inConstructFqn its qualified identity. Revealing secrets into log strings is almost always a bug even when it passes the Privileged check.

Arguments

Argument	Type	Required	What it is
`moduleFilter`	array of string		Restrict to these modules - exact names; an entry ending in '' is a prefix ('com.acme.'). A single string is accepted. Omit for workspace-wide.

Recorded calls

Real calls, recorded against small projects and checked on every build - a changed answer fails it.

Audit

Request

{ }

Response

{
  "meta" : {
    "serverMs" : "<timing>"
  },
  "moduleCount" : 1,
  "privilegedCount" : 1,
  "revealCount" : 3,
  "reveals" : [ {
    "column" : 22,
    "file" : "audit.ek9",
    "inConstruct" : "SecureVault.consume",
    "inConstructFqn" : "demo.sensitive.audit::consume",
    "line" : 14,
    "module" : "demo.sensitive.audit",
    "privilege" : "privileged"
  }, {
    "column" : 22,
    "file" : "audit.ek9",
    "inConstruct" : "LeakyService.consume",
    "inConstructFqn" : "demo.sensitive.audit::consume",
    "line" : 22,
    "module" : "demo.sensitive.audit",
    "privilege" : "unprivileged"
  }, {
...

Cut short here: 12 more lines. The whole recorded call.