New
Introducing React Bench, see how different models perform on React code
Menu
What Is React Doctor?
Quickstart
Install for Coding Agents
How to Fix Issues
GitHub Actions Setup
Updating CI
Other CI Providers
Migrating to CI v2
Config Files
ESLint & oxlint Plugins
Add Custom Rules
CLI Reference
GitHub Action Reference
Node.js API
Changelog
Modified MIT License
Terms of Service
Privacy Policy
Data Use
Security
Support
Rules reference

react-doctor/key-lifecycle-risk

A private key or release credential committed inline to the repo is exposed in git history and must be rotated and revoked.

  • Category: Security
  • Severity: error
  • Source: oxlint-plugin-react-doctor
  • Framework: global
  • Enabled when: any scanned text/config/secret file except test and documentation/markdown (.md/.mdx) paths
  • Tags: security-scan
  • Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires when the file contains a PEM private-key header (-----BEGIN [RSA|EC|OPENSSH|DSA ]PRIVATE KEY-----) followed by a real base64 body of ≥38 chars, or a release-key NAME assigned an inline literal — SSH_PRIVATE_KEY/GPG_PRIVATE_KEY/DEPLOY_KEY/SIGNING_KEY set to a '…' string of ≥16 chars. FALSE POSITIVE: the PEM header is a placeholder with no/short body, is preceded within ~40 chars by placeholder/example/sample/dummy/fake, or is a truncated docs sample (a ... ellipsis appears early in the body) — all excluded — and a key-shaped env NAME that merely references a secret store (no inline literal value) is not flagged, because a name alone is the correct way to point at a secret.

Fix prompt

Use this once validation confirms the diagnostic is real.

Remove the private key or inline credential from source and purge it from git history (for example git filter-repo), then rotate and revoke it now, because the history is already compromised. Load key material at runtime from a secrets manager or CI secret store referenced by name only, prefer short-lived scoped deploy credentials, and document the rotation, expiry, and revocation procedure for any long-lived release or signing key.

More Security rules from the rules reference:

  • react-doctor/local-rpc-native-bridge-risk: A localhost or native bridge that accepts loose origins and exposes install/update or shell commands lets a malicious web page drive native actions on the user's machine.
  • react-doctor/mcp-tool-capability-risk: An MCP tool runs with the connecting client's authority, so reaching shell, filesystem, or network primitives without validation lets injected input abuse them.
  • react-doctor/mdx-ssr-execution-risk: Compiling untrusted MDX with the full pipeline runs attacker-supplied JSX and expressions on your server, which can lead to code execution.
  • react-doctor/nextjs-no-side-effect-in-get-handler: Move the side effect to a POST handler and use a <form> or fetch with method POST — GET requests can be triggered by prefetching and are vulnerable to CSRF
  • react-doctor/no-danger: Flag dangerouslySetInnerHTML — raw HTML injection bypasses JSX escaping and invites cross-site scripting.