better-auth

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the document for literal, high-entropy credentials. I found a Google OAuth client secret hardcoded in examples:
• The string "GOCSPX-aBcDeFgHiJkLmNoPqRsTuVwXyZ" appears as an inlined google clientSecret in the "Incorrect (hardcoded secret)" example and in the .env.local sample. This is a random-looking, high-entropy bearer secret and qualifies as a secret per the rules.

Ignored / not flagged:

• GITHUB_CLIENT_SECRET=ghp_xxxxxxxxxxxx — redacted/truncated (contains x's), so treated as redacted and ignored.
• GOOGLE_CLIENT_ID = 987654321-abcdef.apps.googleusercontent.com and Iv1.abc123 — client IDs are public identifiers (low sensitivity) and low-entropy; not secrets.
• BETTER_AUTH_SECRET=YkV3...32-bytes-base64 — truncated/placeholder; example shows truncation, so ignored.
• Any email addresses, example tokens like "generateToken()", or simple strings in examples are documentation placeholders and ignored per the guidelines.

Therefore a real, high-entropy secret is present (the Google clientSecret).