Secret key in source code
Scan rule · RSC-SEC-053
- Security
- Severity: High
- CWE-798
- OWASP A07-2021
Searches source files for real secret patterns (Stripe, AWS, OpenAI, Anthropic, Slack, SendGrid, PEM).
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Rotate the keys and load them exclusively from server-side environment variables.