A codeql sensitive configuration detection problem

Question

My company's development project uses yml files as configuration files. How can I use codeql to detect whether these yml files contain sensitive information such as plain text passwords?

When I created the codeql database, I used the parameter --language=go, yaml, but I don't know how to query the yaml database and whether this method is the right solution.

Answer 1

github.com/github/codeql/issues/16755

I asked the same question on github and got the solution. This should be solved. We just need to create a javascript database and check the yaml configuration file through the javascript standard library provided by Codelql