PyPI API-token pattern appears in public content
ShipReady found a non-placeholder string matching its supported PyPI API-token pattern in scanned page or script content.
Why it matters
A real registry credential should be held in protected publishing configuration rather than in a public browser asset.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for the supported PyPI token prefix and body format, while applying its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported PyPI API-token pattern.
What the evidence shows
The scanner observed a string matching its PyPI-specific token format and reports a redacted prefix only.
Limits of this check
ShipReady does not authenticate to PyPI, validate the token, inspect project permissions, or upload or download packages. The matched format does not prove that a token is active, usable, or able to publish a release.
How to fix it
Trace the source
Find the source, environment substitution, or build step that introduced the matched string.
Remove real credentials from public output
Keep confirmed PyPI tokens in server-side secret storage used only by trusted release automation.
Review a confirmed token
If the value is confirmed as a real token, review and replace it through the owning PyPI account or release process.
How to verify the change
Inspect generated public assets
Search deployed HTML and JavaScript after the change.
Expected: No unintended string matching ShipReady's supported PyPI token pattern remains in public content.