Scan rule · RSC-SEC-052
service_role key in source code
SecuritySeverity: HighCWE-798
Decodes JWTs in source files and reports the `service_role` claim; on the syntax tree it also reports client files that read the key from the environment (comments do not count).
Scan tier
Source code from source mapsRepo access (deep scan)
How to fix it
Rotate the key, remove it from code, and read it server-side from the environment only.