.env file committed
Scan rule · RSC-SEC-055
- Security
- Severity: High
- CWE-538
Detects a `.env` with real values in the source tree (not `.env.example`).
Scan tier
- Source code from source maps
- Repo access (deep scan)
How to fix it
Add it to `.gitignore`, purge it from history, and rotate the keys.