Checks · SEC-001

SEC-001 · Secret committed in repo (current tree)

Why it matters

A key in the current files can be copied by anyone who can read the repository, and often by anyone who can read the deployed site.

How we detect it

A secret scanner walks the current tree and matches known key formats.

How we fix it

Move the value to an environment variable, add the name to .env.example, ignore the secret file, and rotate the key with its provider.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret
• SEC-005 · AI provider key used from browser