Will It Vibe?Secret exposed as an environment variable
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
Injecting a Secret through env valueFrom.secretKeyRef exposes it to child processes, crash dumps, and kubectl describe. A mounted volume is generally safer.
Why it matters
Injecting a secret through env valueFrom.secretKeyRef makes the value available to every child process, to crash dumps and core files, and to anyone who can run kubectl describe pod. Environment variables are also easy to log accidentally. A mounted secret volume avoids these exposures. This is a hardening preference, so the finding is low severity and a heuristic.
How to fix it
Where practical, mount the secret as a volume and have the application read it from a file, which keeps it out of the process environment and describe output. If an environment variable is required by the application, restrict who can read the pod and its secret with RBAC, and make sure the value is never logged.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo