Skip to content

Multiple secret families in the same build (composite)

Scan rule · RSC-SEC-099

  • Security
  • Severity: High
  • CWE-798
  • OWASP A07-2021

Fires when at least two independent secrets (service-role key, database connection, credentials, provider keys, git history) were found in the same run.

Scan tier

  • External scan (anonymous)
  • Source code from source maps
  • Repo access (deep scan)

How to fix it

Rotate every listed secret, remove it from bundle and source, and enforce the public/secret split in the build — no public prefix for secrets, secret scanning in CI.

Scan your own app for free

More rules in this dimension