davila7/claude-code-templates · critical

SEM_E013

SEM_E013

Error message

Hardcoded secret/token detected

What it means

SEM_E013 is a critical finding from checkSensitiveData: /(?:secret|token)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi matched. It flags a 'secret' or 'token' assignment whose value is 20+ alphanumeric characters, e.g. a GitHub PAT, Slack token body, or JWT-like string embedded in component markdown.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:127

    ];

    // Sensitive data patterns
    this.SENSITIVE_DATA_PATTERNS = [
      {
        pattern: /(?:password|passwd|pwd)\s*[:=]\s*[^\s]+/gi,
        code: 'SEM_E011',
        message: 'Hardcoded password detected',
        severity: 'critical'
      },
      {
        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E012',
        message: 'Hardcoded API key detected',
        severity: 'critical'
      },
      {
        pattern: /(?:secret|token)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi,
        code: 'SEM_E013',
        message: 'Hardcoded secret/token detected',
        severity: 'critical'
      }
    ];
  }

  /**
   * Validate component semantics and content
   * @param {object} component - Component data
   * @param {string} component.content - Raw markdown content
   * @param {string} component.path - File path
   * @param {string} component.type - Component type
   * @param {object} options - Validation options
   * @param {boolean} options.strict - Enable strict mode (warnings become errors)
   * @returns {Promise<object>} Validation results
   */
  async validate(component, options = {}) {
    this.reset();

View on GitHub (pinned to a0851ed10c)

Solutions

1. Swap the literal for an environment variable reference (secret: $WEBHOOK_SECRET) or remove the line and document the env var
2. Rotate any real token that was embedded
3. For examples, use a value with dashes/underscores or under 20 chars so it clearly reads as a placeholder

Example fix

# before
secret: 8f14e45fceea167a5a36dedd4bea2543
# after
secret: $SIGNING_SECRET   # provide via environment

const tokRegex = /(?:secret|token)\s*[:=]\s*['"]?[a-zA-Z0-9]{20,}['"]?/gi;
if (tokRegex.test(component.content)) { /* replace with $ENV ref */ }

When it happens

Trigger: validate() where content includes lines like 'token: ghp_'... note the value must be 20+ chars of only letters/digits (quotes optional); underscores/dashes break the match, so 'ghp_abc...' may not match but a raw hex/alphanumeric token will.

Common situations: Webhook/CI examples in commands or hooks that paste a real DISCORD_WEBHOOK_URL token body, 'secret:' blocks in MCP config examples, or long example hex strings labeled 'token'.

Related errors

• SEM_E011
• SEM_E012
• SEM_E015
• Invalid agent name
• Access denied

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/9c4185184be796e1. Report an issue: GitHub.