Mapbox secret-token pattern appears in public content
ShipReady found a non-placeholder string matching its supported Mapbox secret-token pattern in scanned page or script content.
Why it matters
A real secret token should not be included in browser-delivered code. Mapbox public pk. tokens are intentionally outside this rule.
Review a matched sk. value before treating it as a real credential.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for the supported Mapbox sk.eyJ... secret-token format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported Mapbox secret-token pattern.
What the evidence shows
The scanner observed a string matching its Mapbox secret-token format and keeps only a redacted prefix in evidence.
Limits of this check
ShipReady does not call Mapbox, validate the value, inspect token scopes, or perform account or map operations. The rule does not flag Mapbox pk. public-token formats, and a match does not prove that the sk. value is active or usable.
How to fix it
Locate the matched value
Trace the public asset to the source or build configuration that supplied the token-shaped string.
Keep confirmed secret tokens server-side
Remove real sk. tokens from browser bundles and use server-side secret storage where a secret token is required.
Review confirmed credentials
If the value is confirmed as real, review and replace it through the account owner's Mapbox controls.
How to verify the change
Inspect the deployed bundle
Search deployed HTML and JavaScript after remediation.
Expected: No unintended string matching the supported Mapbox secret-token pattern remains in public content.