Repository navigation
Inclusion of example JWT in README.md is being flagged by secret scanning #36
Description
Activity
I assume
[]byte("secret")is the problematic part? IF you propose something that will pass your checks we probably can change it so.Thanks for the quick reply! The ticket being opened on our side begins:
Finding Name: HTTP bearer authentication header Finding Description: GitHub Advanced security has discovered a secret in the repository "[repository name]" using the secret scanning pattern "HTTP bearer authentication header"and simply highlights the full JWT text content. I believe more details are here.
I think changing the content of the token to something like
YOURTOKENwould resolve the issue.Ok, if it is Github then ChatGPT suggets that
If you routinely include such headers in docs, add .github/secret_scanning.yml to auto-close alerts for specific paths (e.g., README or /docs/**):
paths-ignore: - "README.md" # or, for all docs: # - "docs/**"
This will close matching alerts as “ignored by configuration.”
PR for
github/secret_scanning.ymlwould be OK from our sideThanks again, I have created a PR with the suggested change.
alright, PR is merged, I hope it helps.
My employer has a Go repository which uses echo-jwt as a dependency, referenced as part of the vendored files in go.mod. The example JWT included in the README.md (both in a sample call and response) is getting flagged as an issue by secret scanning software. We can add an exclusion for this specific JWT as a work-around, but perhaps a documentation update to a use a placeholder would also be appropriate?