- Analyzer
- textscan
- Category
- Secrets
- Default severity
- CRITICAL
- CWE
- CWE-798
- Execution
- Passive
- Authentication
- Not required
- Applicability
- javascript, typescript
- Availability
- stable
What it detects
AWS access-key ID literal embedded in JavaScript source: a secrets check run by the textscan analyzer.
Evidence
The matching source path, line, and bounded code observation produced by the native rule.
Remediation
Load credentials from process.env or the AWS SDK's default chain. Rotate the exposed key.
Limitations
This check is limited to the applicability and evidence delivered by textscan. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Checks sharing a CWE
Remediation guidance: Remediation and fix verification · Baselines and suppressions
Other secrets checks
- python-legacy-cipher-import
- python-md5-used-for-password
- python-random-for-token-generation
- python-sha1-used-for-password
- python-aws-access-key-id-literal
- python-gcp-service-account-inline
- python-hardcoded-db-url
- python-hardcoded-secret-assignment
- python-pem-private-key-literal
- python-slack-webhook-url-literal