PEM private-key material appears in public content
ShipReady found a supported PEM private-key header followed by key-shaped material in scanned page or script content.
Why it matters
Private-key material should be kept out of browser-delivered content and protected according to its actual purpose.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for supported PEM private-key headers followed within a short span by at least 40 base64 characters.
What triggers a finding
The rule triggers for a supported private-key header with the required nearby key-shaped material. A header alone does not trigger the finding.
What the evidence shows
The scanner observed a supported PEM private-key marker with adjacent key-shaped content. It reports the public header marker, not the key body.
Limits of this check
ShipReady does not parse or validate the key, determine its owner or use, test cryptographic operations, or inspect where it is trusted. It excludes public-key headers and does not claim that a matching private key is usable.
How to fix it
Locate the key material
Trace the public asset to the source, build process, or deployment configuration that introduced the PEM content.
Remove private-key material from public output
Keep confirmed private keys in an appropriate server-side key-management or secret-storage system and remove them from client assets.
Review the key's actual use
If a real key is confirmed, identify its purpose and follow the owning system's replacement process.
How to verify the change
Inspect deployed assets
Search deployed HTML and JavaScript for private-key headers and key material after release.
Expected: Public assets do not contain unintended PEM private-key material.