Will It Vibe?Private key material embedded in config
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 25 points from that category, once per scan, no matter how many places it turns up.
What it detects
A PEM private key block (BEGIN PRIVATE KEY) is embedded directly in a config or env file. Committed private keys let an attacker impersonate the service or decrypt its traffic, and stay usable until the key is rotated.
Why it matters
A PEM private key committed in config is a live credential that lets an attacker impersonate the service, sign as it, or decrypt its traffic. Unlike passwords, key files rarely expire on their own, so an old leak stays exploitable for years, and git history keeps the key after you delete it.
How to fix it
Remove the key from the repo, add matching patterns to .gitignore, and load it at runtime from a secret manager or a mounted path outside the repo. Regenerate the key pair and redeploy, since the committed key must be treated as compromised. If the block is actually a public certificate, it can stay, but keep private key material out.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo