adyen-webhooks

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged a real secret: the Adyen HMAC key appears as a full hex string in multiple test files. This is a high-entropy, 64-hex-character value (looks like a real Customer Area HMAC key) assigned directly to ADYEN_HMAC_KEY / HMAC_KEY — a usable signing secret that should not be committed.

I ignored low-entropy/example values found elsewhere: the example HMAC signature strings in payload samples (e.g., "coqCmt/...") are reference signatures, and Basic Auth test credentials like "user"/"pass" or simple placeholders (your_hex_hmac_key_here) are low-entropy examples/placeholders per the rules and are not flagged.