code-review
Fail
Audited by Snyk on Jul 8, 2026
Risk Level: HIGH
Full Analysis
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). I flagged the literal API key in the React login form because it is a high-entropy, live-style key (sk_live_...), i.e. a real-looking secret hardcoded in source and usable as an API credential. I did not flag the JWT fallback "dev-secret" in orders.js — that is a simple, low-entropy setup/default string (ignored per rules). No other high-entropy secrets (PEM blocks, tokens, or keys) were present.
Issues (1)
W008
HIGHSecret detected in skill content (API keys, tokens, passwords).
Audit Metadata