Will It Vibe?Secret passed through a build ARG
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A secret-looking ARG is declared, meaning the value is supplied at build time with --build-arg and captured in the image history and build cache. Use BuildKit secret mounts instead. Heuristic.
Why it matters
A secret-looking ARG means the value is supplied at build time with --build-arg. That value is recorded in the image history (docker history) and in the build cache, so it leaks even though it is not an ENV. This is a heuristic based on the argument name.
How to fix it
Use BuildKit secret mounts (RUN --mount=type=secret,id=token ...) so the value is available during that RUN but never written to a layer. Remove the build ARG for the secret. If the ARG is not actually a secret, the finding is safe to ignore.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo