react-doctor/artifact-secret-leak

A live credential (API key, token, or connection string) sits in a browser bundle or static asset, so anyone can read it, and it must be treated as compromised.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires only in a browser-shipped artifact (generated/minified bundle, .map, or under public//dist/assets//.next/static//out//storybook-static/; .md/.mdx docs excluded) whose content matches a known secret-VALUE shape: AWS access keys (AKIA…/ASIA…, AWS_SECRET_ACCESS_KEY=…), GitHub ghp_/gho_/github_pat_, GitLab glpat-, Slack xox[baprs]- tokens and incoming-webhook URLs, Discord webhook URLs, Stripe/RevenueCat sk_live/sk_test/rk_…, OpenAI sk-…, Anthropic sk-ant-api…, Linear lin_api/lin_oauth_, Vercel vercel_, Sentry sntrys_, Mailgun key-<hex>, npm npm_, SendGrid SG.…, Supabase sb_secret_/service_role, PEM -----BEGIN … PRIVATE KEY-----, plus postgres|mysql|mongodb|redis://user:pass@host.tld connection strings.

Suppress when: largely pre-filtered: DB URLs with documented placeholder passwords (password, changeme, ${VAR}, <...>) or dotless/localhost hosts are skipped; a remaining FP is a string that merely matches a prefix shape but is a known-dummy/example value, not a live credential.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Remove the credential from everything that ships to the browser (bundles, source maps, static assets) and rotate it now, because a shipped secret is already exposed. Move every call that needs it behind server-only code (API route, server action, edge or serverless function) and read the key from a server-only env var there. Never embed database or service connection URLs in client code; proxy that access through your backend.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.