yamadashy/repomix · warning

Security issues found in ${contentType}, but they will still

Error message

Security issues found in ${contentType}, but they will still be included in the output

What it means

This is not an exception but a logger.warn emitted by logSuspiciousContentWarning when the Repomix security check finds suspicious patterns (e.g. possible secrets, API keys, credentials) inside Git diff content, and that content is nonetheless going to be included in the packed output. Repomix filters suspicious regular files out by default, but Git diffs and Git logs are only warned about because excluding them would break the diff/log output contract. It informs the developer that sensitive-looking data may leak into the generated bundle.

Source

Thrown at src/core/security/validateFileSafety.ts:59

  const safeRawFiles = deps.filterOutUntrustedFiles(rawFiles, suspiciousFilesResults);
  const safeFilePaths = safeRawFiles.map((file) => file.path);
  logger.trace('Safe files count:', safeRawFiles.length);

  return {
    safeRawFiles,
    safeFilePaths,
    suspiciousFilesResults,
    suspiciousGitDiffResults,
    suspiciousGitLogResults,
  };
};

const logSuspiciousContentWarning = (contentType: string, results: SuspiciousFileResult[]) => {
  if (results.length === 0) {
    return;
  }

  logger.warn(`Security issues found in ${contentType}, but they will still be included in the output`);
  for (const result of results) {
    const issueCount = result.messages.length;
    const issueText = issueCount === 1 ? 'issue' : 'issues';
    logger.warn(`  - ${result.filePath}: ${issueCount} ${issueText} detected`);
  }
};

View on GitHub (pinned to f465ad9093)

Solutions

1. Review the flagged diffs/logs and remove the secret from history (git filter-repo / BFG) or rotate the credential
2. Re-run repomix with --no-security-check only if you are certain the flagged content is a false positive (e.g. test fixtures with dummy keys)
3. Exclude diffs/logs from the pack by dropping --include-diffs / --include-logs or setting output.git.includeDiffs/includeLogs to false
4. If files must keep secrets, pre-commit hooks like gitleaks or trufflehog prevent them from entering history in the first place

Example fix

// before (CLI)
repomix --include-diffs --include-logs
// after (secret removed from history, then safe to pack)
git filter-repo --replace-text <(echo 'my-api-key==>REDACTED')
repomix --include-diffs --include-logs

import { runSecurityCheck } from './src/core/security/securityCheck.js';
const results = await runSecurityCheck(rawFiles, () => {}, gitDiffResult, gitLogResult);
const diffOrLogHits = results.filter(r => r.type === 'gitDiff' || r.type === 'gitLog');
if (diffOrLogHits.length > 0) {
  console.error('Secrets detected in diffs/logs:', diffOrLogHits.map(r => `${r.filePath}: ${r.messages.length} issue(s)`));
  process.exit(1); // block packing before it happens
}

When it happens

Trigger: Running repomix with security.enableSecurityCheck enabled (the default) while including git diffs (--include-diffs) or git logs (--include-logs), and runSecurityCheck flags one or more matching patterns (keys, tokens, secrets) in those diffs/logs. validateFileSafety then calls logSuspiciousContentWarning('Git diffs', ...) or ('Git logs', ...) with a non-empty results array.

Common situations: Packing a repo whose commit history or uncommitted changes contain API keys, .env values, private keys, or hardcoded passwords; committing a secret and then packing the repo including git logs so the secret appears in commit metadata.

Related errors

• - ${result.filePath}: ${issueCount} ${issueText} detected
• Refusing to trust ${configName}: the remote repository's con
• Refusing to trust ${configName}: it resolves outside the clo
• Remote config not trusted
• Invalid repository URL. URL contains potentially dangerous p

AI-assisted analysis of yamadashy/repomix@f465ad9093 (2026-08-29). Data as JSON: /api/errors/268b18e640b69851. Report an issue: GitHub.