Potential secret-shaped value appears in public code
ShipReady found a quoted, mixed-character value assigned to a secret-like name in scanned page or script content, without a recognised provider format.
Why it matters
A credential placed in a public client asset needs investigation, but this heuristic is intentionally less certain than a provider-specific credential format match.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for quoted values assigned with secret, token, private, or password names.
What triggers a finding
The rule triggers only when the assigned value has at least 24 letters, digits, underscores, or hyphens and contains lowercase letters, uppercase letters, and digits. Provider-specific matches take precedence over this generic rule.
What the evidence shows
The scanner observed a value matching its bounded generic-secret heuristic in a secret-like assignment. It records only four characters and the value length.
Limits of this check
This is medium-confidence heuristic evidence, not proof that the value is a credential, valid, or usable. ShipReady does not identify a provider, validate the value, inspect permissions, or call any service. It intentionally does not flag shorter values, readable identifiers without the required character mix, placeholders, or some nonconforming secrets.
How to fix it
Identify what the value represents
Trace the assignment using the reported location, prefix, and length to determine whether it is a credential, test value, or non-secret identifier.
Remove confirmed secrets from public code
If it is a real credential, move it to server-only secret storage and remove it from browser-delivered assets.
Review confirmed credentials
Use the credential owner's normal replacement process only after confirming the value is a real secret.
How to verify the change
Inspect deployed content
Search generated public assets for the identified assignment after remediation.
Expected: No unintended secret-like assignment remains in public client content.