microsoft-teams-hardened

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned for high-entropy, directly usable credentials. I found a meeting passcode and meeting code included verbatim in the example meeting response:
• "passcode": "qh37NK9V" — an 8-character alphanumeric value that looks random and can grant access to the meeting; this meets the definition of a secret and is explicitly flagged by the guardrails as sensitive.
• "meetingCode": "28636743235745" — a numeric join code (14 digits) that can also grant meeting access and should be treated as sensitive.

Ignored items and why:

• All occurrences of MATON_API_KEY are placeholders (e.g., "YOUR_API_KEY" or environment variable references) — documentation placeholders, not real keys.
• GUIDs and IDs (e.g., connection_id, team IDs, tenantId, channel IDs) are identifiers, not credentials — they do not by themselves grant access.
• Truncated values with "..." (join URLs, some IDs) are redacted/placeholder and are ignored per rules.
• Example emails, timestamps, message IDs, and numeric IDs (message id as timestamp) are not secrets.

Because the meeting passcode and meeting code are literal values that provide access, they should be treated as hardcoded secrets.