# SECRET_IN_SOURCE: Secret in the component's code

> Secret in the component's code

| Severity | Fault                         | Stage          |
| -------- | ----------------------------- | -------------- |
| error    | customer (the source package) | source package |

## What it means

A file of the source package (its content or its name), the bundle built from it or the declaration its code produced holds a credential: an AWS access key, a Google Cloud OAuth client secret, a Cloudflare API token or key, a Stripe secret, restricted or webhook key, a GitHub, OpenAI, Anthropic or Taggor API key, or a PEM private key. A component's code is public: anyone who opens a page with the component can read it, so the build refuses it. The diagnostic shows at most the first characters of the value, never the random part. Keys that are public by design, such as Stripe publishable keys (pk_…) and Google API keys (AIza…), are accepted, and so are obvious placeholders: a value ending in EXAMPLE (AKIAIOSFODNN7EXAMPLE), one whose random part is a single repeated character (sk_test_xxxxxxxxxxxxxxxx, tgr_test_0000…) and the provider's own published samples. Every file of the package counts, documentation such as README.md included, even when the bundle does not use it.

## How to fix

Remove the key from the component and revoke it at its provider: treat it as leaked. Keep secrets on a server the component calls, or use the provider's public key (Stripe pk_…) in the browser. In documentation, write a placeholder such as sk_test_xxxxxxxxxxxxxxxx instead of a key.