pikvm

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for literal high-entropy credentials and ignored obvious placeholders and simple example passwords (per the provided rules).

Flagged:

• The TOTP secret literal in references/api-auth.md: secret = "3OBBOGSJRYRBZH35PGXURM4CMWTH3WSU" This is a base32-looking TOTP secret (high entropy) and is used in the doc as "from /etc/kvmd/totp.secret", so it appears to be a real secret example and should be treated as sensitive.

Ignored (not flagged) and why:

• All occurrences of "admin" (e.g., X-KVMD-User: admin, curl -u admin:admin, sample pikvm_passwd: admin) — low-entropy demo/setup examples.
• Template/placeholders such as "{{ vault_pikvm_passwd }}", "", "<hex_token>", "YOUR_API_KEY", "sk-xxxx" (none of which contain real secrets).
• Simple example passwords mentioned in examples or integration config (e.g., pikvm_passwd: admin) — documented setup/test values, low entropy.
• Environment variable names and doc fragment parameter names (e.g., pikvm_totp_secret) — no literal secret value provided.

Therefore there is one actual high-entropy secret present (the TOTP secret).