sesf

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the entire skill documentation for high-entropy literal values that could be usable credentials.

Flagged item:

• whsec_K8e2pQ9xVn3bRtYm — appears verbatim in references/examples.md (Example 1 / Webhook Signature Validator) as "Signing secret: whsec_K8e2pQ9xVn3bRtYm (loaded from WEBHOOK_SECRET env var)."

Rationale for flagging:

• This is a literal token with a non-trivial, random-looking suffix and a recognizable "whsec_" prefix used by webhook signing secrets (e.g., Stripe-style secrets). It is not a placeholder like "YOUR_API_KEY" or redacted/truncated, and it appears as a concrete value rather than an env-var name only — so it meets the definition of a secret.

Ignored / not flagged:

• Environment variable names (e.g., WEBHOOK_SECRET) — these are just variable names, not secret values.
• All other config values, file paths, numeric thresholds, and simple example passwords or literal words are low-entropy or clearly documentation examples and thus ignored per the rules.