wechat-miniprogram

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for high-entropy literal values that could be usable credentials.
• I flagged the base64-looking string "HyVFkGl5F5OQWJZZaNzBBg==" because it is a high-entropy, literal session_key shown in examples (a session_key is sensitive and can be used to verify/decrypt user data). Even though it appears in an example context, it is a concrete, random-looking secret value embedded in the docs and therefore meets the definition of a secret.
• I ignored obvious placeholders and low-sensitivity examples such as 'xxxx', 'xxxxx', 'xxxxxx', 'OPENID', 'APPID', 'wxa410372c837a5f26' (service id / example AppID-like strings), and other illustrative values (URLs, avatar paths, unit-id='xxxx', etc.). These are either placeholders, identifiers that are not secret credentials, or simple example values and therefore are not flagged per the "WHAT TO IGNORE" rules.