Skip to content

service_role key in source code

Scan rule · RSC-SEC-052

  • Security
  • Severity: High
  • CWE-798

Decodes JWTs in source files and reports the `service_role` claim; on the syntax tree it also reports client files that read the key from the environment (comments do not count).

Scan tier

  • Source code from source maps
  • Repo access (deep scan)

How to fix it

Rotate the key, remove it from code, and read it server-side from the environment only.

Scan your own app for free

More rules in this dimension