wechat-miniprogram

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a literal, high-entropy value that appears to be a session key. The string "HyVFkGl5F5OQWJZZaNzBBg==" is a Base64-looking, high-entropy token shown as "用户的 session-key" (a secret used for signing/decryption), so it meets the secret definition and is likely sensitive.

I ignored other values that look like placeholders or example data:

• "OPENID", "APPID", "xxxx", "xxxxx", "xxxxxx", and similar lower-entropy or clearly placeholder strings — documentation placeholders or example values.
• IDs like "wxa410372c837a5f26" (service ID) and long example return keys in console comments — presented as examples/outputs, not explicit credentials to use. These are either obvious placeholders, example outputs, or low-entropy identifiers and thus not flagged.