A supported public JSON configuration path contains credential-like fields
A supported public JSON configuration path contained non-empty values under ShipReady's strong credential-field heuristic.
Why it matters
Public configuration should contain only values intended for visitors. A configuration response with strong credential-like field signals warrants an owner review of the published artifact.
How ShipReady detects it
What it inspects
ShipReady probes only /appsettings.json, /config.json, /secrets.json, and /credentials.json on the scanned origin.
A response must be HTTP 200, non-HTML, non-SPA-fallback, and parse as JSON. ShipReady recursively examines non-empty string values.
What triggers a finding
The rule triggers when a string is under a key containing a strong credential token such as password, secret, privatekey, accesskey, connectionstring, or clientsecret, or when a string contains password= or pwd=.
What the evidence shows
The reported supported path returned parseable JSON containing non-empty values matching ShipReady's credential-field heuristic. The report retains field names, not values.
Limits of this check
Field names and non-empty values do not prove a value is a real secret, valid, usable, or compromised. ShipReady does not inspect arbitrary configuration paths or authenticate. Non-200, malformed, HTML, fallback-like, unanswered, or edge-blocked responses do not trigger the rule.
How to fix it
Review the exact published configuration
Confirm whether the reported JSON file and the named fields are intentionally public before changing values.
Remove unintended server configuration
Publish only client-safe configuration and remove unintended configuration files from public static output.
How to verify the change
Request the reported path after deployment
Fetch the exact reported configuration path without credentials.
Expected: The path no longer returns unintended configuration content, or contains only intentionally public values.