flask-docs

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged only literal, high-entropy secret values that appear to be real secrets embedded in the docs. Specifically:
• quickstart.md: app.secret_key = b'_5#y2L"F4Q8z\n\xec]/' — a non-trivial, random-looking byte string used as a secret key example (high entropy).
• config.md: export FLASK_SECRET_KEY="5f352379324c22463451387a6aec5d2d" — a long hex string presented as an example FLASK_SECRET_KEY (high entropy).
• tutorial.md: SECRET_KEY = '192b9bdd22ab9ed4d12e236c78afcb9a393ec15f71bbf5dc987d54727823bcbf' — a long hex string placed in an example instance config (high entropy).

I ignored obvious placeholders and low-entropy setup values per the rules:

• SKILL.md (app.secret_key = b'your-secret-key') — documentation placeholder / low entropy.
• config.md (SECRET_KEY = b'secret') — low-entropy example.
• tutorial.md (SECRET_KEY='dev') — clearly a placeholder used in tutorial.
• error-handling.md (sentry_sdk.init('YOUR_DSN_HERE')) — placeholder.
• Any simple usernames/passwords like "test", "secret", or obvious example hosts (smtp.example.com, admin@example.com) — these are examples or low-entropy setup values and therefore ignored.

Decision: the documentation contains literal high-entropy secrets (the three items above), so I mark this as containing secrets.