From 8a2b1e4dd5327cd1db131406a86b94c26f0fe59a Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 20 Aug 2026 01:47:45 -0400 Subject: [PATCH] docs(SECRETS): use non-key-shaped example in placeholder description SonarCloud's hardcoded-credential rule can flag any string that starts with the 'AIzaSy' prefix even if it's clearly marked as a placeholder. Update SECRETS.md to use the same non-key-shaped self-describing placeholder string as the source code does. --- SECRETS.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/SECRETS.md b/SECRETS.md index cfbc7503e..ba46bd821 100644 --- a/SECRETS.md +++ b/SECRETS.md @@ -16,9 +16,10 @@ project for where to obtain each key. |---|---|---| | `GD_FIREBASE_API_KEY` | `newIDE/app/src/Utils/GDevelopServices/ApiConfigs.js` (`GDevelopFirebaseConfig.apiKey`) | Upstream (`4ian/GDevelop`) | -If `GD_FIREBASE_API_KEY` is unset, the app falls back to a string beginning -with `AIzaSyDUMMY…`, which will not authenticate against Firebase. Build -failures and sign-in errors when this happens are expected. +If `GD_FIREBASE_API_KEY` is unset, the app falls back to a non-key-shaped +placeholder string (`GD_FIREBASE_API_KEY-env-var-not-set-see-SECRETS.md`), +which will not authenticate against Firebase. Build failures and sign-in +errors when this happens are expected. ## Required for the Firebase extension end-to-end test @@ -45,7 +46,8 @@ cp .env.example .env.local ## Reporting new leaks If you find a secret in this branch that should not be there, open a PR -replacing it with a clearly-marked placeholder (`AIzaSyDUMMY…` for Google -keys, `ghp_DUMMY…` for GitHub PATs, etc.) and add the corresponding env +replacing it with a clearly-marked, non-key-shaped placeholder (e.g. +`YOUR_GOOGLE_API_KEY_HERE` for Google keys, `YOUR_GITHUB_PAT_HERE` for +GitHub PATs, etc.) and add the corresponding env var to this table. Do **not** rewrite git history for keys that aren't yours — flag the original owner instead.