react-doctor/repository-secret-file

A committed env file, credential, or token is exposed to anyone with repo access and must be rotated, even after you remove it.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires only on committed credential/config FILES: any .env* file, .npmrc, or a *credential(s)*/service-account/serviceAccount/firebase-admin/google-service-account/gcp-service-account*.{json,env,pem,key} file: whose CONTENTS contain either a hard secret value (AWS AKIA…, github_pat_/gh*_, GitLab glpat-, Slack xox*, Stripe sk_live/test_, Anthropic sk-ant-…, npm token, SendGrid SG.…, a Slack/Discord webhook URL, service_role, a -----BEGIN … PRIVATE KEY-----, or a real postgres://user:pass@host/ URL) or a public-env secret name. Redacted templates (.env.example/.sample/.template/.dist/.defaults, *example|sample|template* files) and test fixtures are exempt.

Suppress when: a placeholder/sample value the patterns still caught: though the DB-URL pattern already skips common user:password@localhost docker/compose placeholders, so a remaining hit is usually a real credential; verify the value is fake before suppressing.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Delete the file from the working tree, purge it from git history (for example git filter-repo), and add its path to .gitignore. Rotate every credential it held, because a committed secret is compromised even after removal. Keep only a redacted *.example/*.template checked in, and load real secrets at runtime from a secrets manager or an untracked local env file.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.