Back to overview
Risk
Real key in the README
The README is documentation – and therefore especially visible.
In the README you like to show an example of how to configure something. If a real key is left in place instead of a placeholder, the secret sits in the most visible spot of the project.
What happens
A real key ends up as an example in the README – a file that search engines and platforms like GitHub display prominently.
Why it's dangerous
READMEs get indexed and automatically scanned for secrets. A key here is often found and abused within minutes.
How Env Clinic helps
Env Clinic rates keys in the README as especially critical and suggests replacing them with clear placeholders.
env-clinic scan .
- Flags README findings as critical
- Recommends placeholders over real values
- Can generate a safe .env.example