sa-token

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the provided files for literal, high-entropy values that look like real credentials.
• Flagged: references/config.md line [138] (sa-token.sign.secret-key: kQwIOrYvnXmSDkwEiFngrKidMcdrgKor). This is a high-entropy secret value shown in a configuration example for an API signing secret key (i.e., a credential-like config field), so it meets the definition of a secret.
• Ignored items (not flagged):
• Many occurrences of simple example passwords like "123456" (low-entropy demo credentials) — treated as documentation examples and explicitly excluded by the rules.
• Placeholder or redacted-style values like "xxxx-xxxx-..." or "token" or "xxxxxxxxx" — documentation placeholders and not real secrets.
• Random-looking token examples in token-style.md (e.g., "gfuPSwZsnUhwgz08GTCH4...") and other sample tokens: although high-entropy-looking, they appear as illustrative examples of token formats rather than an explicitly named secret configuration (and are presented as sample/generated tokens), so I treated them as documentation samples and did not flag them.
• The jwtSecretKey and other config keys are present but set to null or not given literal secret values.

If you want, I can redact the flagged value and provide a patch or suggest replacement guidance (use placeholders or env vars) for all detected credential-like literals.