Scan rule · RSC-SEC-099
Multiple secret families in the same build (composite)
SecuritySeverity: HighCWE-798OWASP A07-2021
Fires when at least two independent secrets (service-role key, database connection, credentials, provider keys, git history) were found in the same run.
Scan tier
External scan (anonymous)Source code from source mapsRepo access (deep scan)
How to fix it
Rotate every listed secret, remove it from bundle and source, and enforce the public/secret split in the build — no public prefix for secrets, secret scanning in CI.