API key or credential committed
Credentials committed in the change. Masked in every output.
Why it matters
Agents are trying to make the code run. If an environment variable is missing, pasting the key the user shared into the source is the quickest way to get a working call, and an agent may also write a real .env file and leave it tracked. The change works, so nothing prompts anyone to look twice.
Once a key reaches a remote, removing the line does not help: it stays in history, and keys pushed to public repositories are routinely scraped and used. The cost is whatever the key can do, from model usage billed to your account to live payment operations.
Example
import OpenAI from "openai";
-const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });
+const client = new OpenAI({
+ apiKey: "sk-proj-8fQ2mZr71LkPw3xVt9Nc4HbY6sJd0GaE5uWq",
+});
export async function summarize(text: string) {
What it detects
- Known provider key formats: OpenAI, Anthropic, Google, AWS access key IDs, GitHub tokens, Stripe live keys, Slack, SendGrid, npm, Twilio, Supabase secret keys, and PEM private key blocks.
- A tracked .env, .env.local, .env.production or .env.prod file, whatever is in it.
- Matching is format based rather than entropy based. Values that look like placeholders (xxxx, your_api_key, example, dummy, 123456) or that lack either letters or digits are ignored.
- Keys in documentation and tests are reported at lower severity, and keys inside test assertions are skipped. Every value is masked in the report, so the tool is never a second place the key leaks.
What to do when it fires
Revoke the key at the provider first, even if the commit never left your machine. Then read it from an environment variable, add the file to .gitignore if it is a .env, and keep a .env.example with names but no values.
If the file is already tracked, run git rm --cached on it so future commits stop including it. Rewriting history is optional; rotating the key is not.