Cloudinary credential-URL pattern appears in public content
ShipReady found a non-placeholder string matching its supported credential-bearing Cloudinary URL pattern in scanned page or script content.
Why it matters
If the matched value is real, it should be kept in protected server-side configuration rather than delivered in a public browser asset.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for a cloudinary:// URL with a numeric identifier, credential-shaped segment, and cloud name, while applying its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches ShipReady's supported Cloudinary credential-URL format.
What the evidence shows
The scanner observed a string matching the supported Cloudinary credential-URL pattern and retains only a redacted prefix in the report.
Limits of this check
ShipReady does not connect to Cloudinary, validate the URL, inspect its account or permissions, or read, upload, replace, or delete media. The format match does not prove that the URL is active or grants administrative access.
How to fix it
Trace the configuration source
Find the source file, environment substitution, or build step that placed the credential-shaped URL in public content.
Keep confirmed credentials server-side
Remove real Cloudinary credentials from client assets and store them only in trusted server-side secret configuration.
Review a confirmed credential
If investigation confirms a real credential, use the account owner's rotation and access-review process.
How to verify the change
Inspect deployed output
Search deployed HTML and JavaScript after release.
Expected: No unintended string matching the supported Cloudinary credential-URL pattern remains in public content.