Z201: CREDENTIAL_SECRET

Severity: error Penalty: 0.0 (Fatal Exit 2) Category: security Auto-fixable: No

Rationale

This security breach rule (Exit 2) is emitted when the Polyglot Credential Scanner detects private keys, API tokens, AWS keys, or passwords embedded in Markdown prose or code blocks.

Hardcoding secrets in documentation source files exposes infrastructure credentials to public repository leaks.

How to Fix

Inspect the flagged location in the Markdown file and update the content or configuration:

Bad (Triggers Z201)

# BAD: Real credential hardcoded in documentation snippet
aws_secret = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

Good (Resolves Z201)

# GOOD: Use environment variables or sanitized placeholders
aws_secret = os.environ["AWS_SECRET_ACCESS_KEY"]

Configuration

# Non-suppressible security code. Triggers Security Override (DQS -> 0/100).

Reference

See the Finding Codes Index for finding code details.