reactome-database

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the entire skill content for hardcoded credentials. There are no API keys, PEM/private-key blocks, or environment variable values. However the documentation includes a literal, base64-looking analysis token value "MzUxODM3NTQzMDAwMDA1ODI4MA==" in multiple example responses and examples of GET /token/{token} usage.

I treat that string as a potential secret because:

• It is a non-trivial, high-entropy literal (base64-encoded) rather than an obvious placeholder like YOUR_API_KEY or sk-xxxx.
• It represents an analysis token that could be used with the AnalysisService token endpoints to retrieve results (i.e., it grants access to data).
• The token is not marked as redacted and is given verbatim in example responses, so it could be a real token copied into the docs.

I did NOT flag other items because they are non-secrets: URLs, example pathway IDs (e.g., R-HSA-69278), numeric version strings, example gene identifiers, and other sample data are documentation examples or low-entropy placeholders and do not constitute credentials per the provided rules.