spree-typescript-sdk

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged only the high-entropy literal that looks like an API key. Specifically:
• SKIP/IGNORE: publishableKey: 'pk_test' (tests) — obvious placeholder/example.
• SKIP/IGNORE: process.env.* usages (e.g., SPREE_ADMIN_SECRET_KEY, SPREE_WEBHOOK_SECRET) — only environment variable names, no literal values.
• SKIP/IGNORE: resource IDs like 'prod_86Rf07xd4z', 'store_k5nR8xLq', and other prefixed IDs — they are identifiers, not credentials.
• SKIP/IGNORE: the inline comment "// sk_…" — truncated/redaction-like, not a literal key.

FLAG: publishableKey: 'pk_CzEKBTWFiuNLgz4wciLsS59n' — a literal, random-looking API key string present in the Quickstart example. Per the secret definition (high-entropy API key), this is treated as a secret.