Secret or private key committed to source
Gaphigh severity · reads .ts .tsx .js .jsx .mjs .cjs .py .env .json .yaml .yml .tomlBeta
Anyone with read access to the repo, or a leaked copy of it, can use this key. When Lintsure finds this, it marks it as a Gap: the code itself shows the problem.
What it looks like
A line Lintsure flags in its own test app:
// src/config.ts
export const stripeKey = "sk_live_FAKEFAKEFAKEFAKE0000";How to fix it
Move the secret to an environment variable or secrets manager, then rotate it: it is already in your git history.
Through a coding agent, Lintsure suggests the change and waits. Nothing is edited until you approve it.
Controls it relates to
- SOC 2CC6.1Logical access security
- ISO 27001A.8.24Use of cryptography
- GDPRArt. 32Security of processing
What the framework asks
EU AI Act Art. 15: Accuracy, robustness, security
The system should perform as stated, cope with errors and resist attacks such as data poisoning or prompt injection.
Evidence a reviewer may ask for: Test results and the security measures in place.
GDPR Art. 32: Security of processing
Protect personal data with security that fits the risk: encryption, access control, testing and the ability to recover.
Evidence a reviewer may ask for: Security measures and when they were last tested.
SOC 2 CC6.1: Logical access
Only the right people and systems can reach data. Secrets are protected, passwords are stored safely.
Evidence a reviewer may ask for: Access settings, secret storage and password hashing.
ISO 27001 A.8.24: Use of cryptography
Use strong cryptography correctly and manage keys safely, not in source code.
Evidence a reviewer may ask for: Crypto and key management rules.
Summaries are our own reading of the public texts, not the official wording.
Read more: How to keep secrets out of your code
Check your code for this
Runs on your machine. Your code is never uploaded.
npx lintsure scanThis rule is in Beta: its mapping to framework controls is waiting for review by a qualified compliance professional. Lintsure is a readiness tool, not an audit or legal advice. A finding, or the lack of one, doesn't make you compliant. Disclaimer