Will It Vibe?High-entropy secret literal (heuristic)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A long quoted base64-style literal with mixed case and digits looks like a random secret. This is an entropy heuristic and can match legitimate encoded data, so it is kept low severity.
Why it matters
A long, high-entropy base64-style literal with mixed case and digits looks like a randomly generated secret. This is an entropy heuristic and can match legitimate encoded data such as small binary blobs or hashes, so confirm before acting. When it is a real secret, it is exposed to anyone with repo access.
How to fix it
If it is a secret, move it into an environment variable or secret store and rotate it with the provider. If it is legitimate encoded data (an asset, a hash, a public value), leave it, or relocate it so it is clearly not a credential. Add a suppression comment only after confirming it is safe.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo