sa-token-api-security

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the provided documentation for literal, high-entropy credentials.

Found real-looking secrets:

• sa-token sign secret-key: "kQwIOrYvnXmSDkwEiFngrKidMcdrgKor" (in references/api-sign.md). This is a high-entropy string configured as a signing secret.
• jwt-secret-key: "JfdDSgfCmPsDfmsAaQwnXk" (in references/temp-token.md). This is a high-entropy JWT secret.

Both are literal, random-looking values used as configuration secrets and should be treated as real credentials.

Ignored items / not flagged:

• "AK-xxx" in API key examples — documentation placeholder.
• "AK-xxx" occurrences in code examples and other simple/example tokens — placeholders.
• Any simple example values or code-sample tokens (e.g., numeric IDs like 10001) — low-entropy examples, not secrets.