sa-token-api-security

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the provided files for literal, high-entropy values that could be usable credentials.

Flagged:

• references/api-sign.md line 29: "kQwIOrYvnXmSDkwEiFngrKidMcdrgKor" — looks like a random/secret string used as a config secret-key (not a placeholder or truncated), so it meets the definition of a secret.
• references/temp-token.md line 53: "JfdDSgfCmPsDfmsAaQwnXk" — appears as a jwt-secret-key example, also high-entropy and not a placeholder.

Ignored / not flagged:

• "AK-xxx", "app1Secret", "app2Secret", "AK-xxx" occurrences — these are obvious placeholders/example values and are purposely excluded.
• Simple example values like numeric IDs, short words, or code examples (SaTempUtil.createToken(...) tokens generated at runtime) — not literal credentials in the repo.