{"record":{"id":"9c4185184be796e1","repo":"davila7/claude-code-templates","slug":"sem-e013","errorCode":"SEM_E013","errorMessage":"Hardcoded secret/token detected","messagePattern":"Hardcoded secret/token detected","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli-tool/src/validation/validators/SemanticValidator.js","lineNumber":127,"sourceCode":"    ];\n\n    // Sensitive data patterns\n    this.SENSITIVE_DATA_PATTERNS = [\n      {\n        pattern: /(?:password|passwd|pwd)\\s*[:=]\\s*[^\\s]+/gi,\n        code: 'SEM_E011',\n        message: 'Hardcoded password detected',\n        severity: 'critical'\n      },\n      {\n        pattern: /(?:api[_-]?key|apikey)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi,\n        code: 'SEM_E012',\n        message: 'Hardcoded API key detected',\n        severity: 'critical'\n      },\n      {\n        pattern: /(?:secret|token)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi,\n        code: 'SEM_E013',\n        message: 'Hardcoded secret/token detected',\n        severity: 'critical'\n      }\n    ];\n  }\n\n  /**\n   * Validate component semantics and content\n   * @param {object} component - Component data\n   * @param {string} component.content - Raw markdown content\n   * @param {string} component.path - File path\n   * @param {string} component.type - Component type\n   * @param {object} options - Validation options\n   * @param {boolean} options.strict - Enable strict mode (warnings become errors)\n   * @returns {Promise<object>} Validation results\n   */\n  async validate(component, options = {}) {\n    this.reset();","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/davila7/claude-code-templates/blob/a0851ed10c7c60463dac8cfaaca124cf32d5804d/cli-tool/src/validation/validators/SemanticValidator.js#L109-L145","documentation":"SEM_E013 is a critical finding from checkSensitiveData: /(?:secret|token)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi matched. It flags a 'secret' or 'token' assignment whose value is 20+ alphanumeric characters, e.g. a GitHub PAT, Slack token body, or JWT-like string embedded in component markdown.","triggerScenarios":"validate() where content includes lines like 'token: ghp_'... note the value must be 20+ chars of only letters/digits (quotes optional); underscores/dashes break the match, so 'ghp_abc...' may not match but a raw hex/alphanumeric token will.","commonSituations":"Webhook/CI examples in commands or hooks that paste a real DISCORD_WEBHOOK_URL token body, 'secret:' blocks in MCP config examples, or long example hex strings labeled 'token'.","solutions":["Swap the literal for an environment variable reference (secret: $WEBHOOK_SECRET) or remove the line and document the env var","Rotate any real token that was embedded","For examples, use a value with dashes/underscores or under 20 chars so it clearly reads as a placeholder"],"exampleFix":"# before\nsecret: 8f14e45fceea167a5a36dedd4bea2543\n# after\nsecret: $SIGNING_SECRET   # provide via environment","handlingStrategy":"validation","validationCode":"const tokRegex = /(?:secret|token)\\s*[:=]\\s*['\"]?[a-zA-Z0-9]{20,}['\"]?/gi;\nif (tokRegex.test(component.content)) { /* replace with $ENV ref */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Webhook URLs and tokens go in .env / wrangler secrets, never markdown","Run gitleaks on the repo","Rotate any token that touched a file"],"tags":["hardcoded-credentials","secret-token","security"],"backgroundTag":"hardcoded-secret-detected","analyzedSha":"a0851ed10c7c60463dac8cfaaca124cf32d5804d","analyzedAt":"2026-08-28T14:11:56.058Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}