src/content/docs/linter/rules/no-secrets.mdx
import { Tabs, TabItem } from '@astrojs/starlight/components';
<Tabs> <TabItem label="JavaScript (and super languages)" icon="seti:javascript"> ## Summary - Rule available since: `v1.9.0` - Diagnostic Category: [`lint/security/noSecrets`](/reference/diagnostics#diagnostic-category) - This rule isn't recommended, so you need to enable it. - This rule doesn't have a fix. - The default severity of this rule is [**information**](/reference/diagnostics#information). - Sources: - Inspired from [`no-secrets/no-secrets`](https://github.com/nickdeis/eslint-plugin-no-secrets/blob/master/README.md){
"linter": {
"rules": {
"security": {
"noSecrets": "error"
}
}
}
}
Disallow usage of sensitive data such as API keys and tokens.
This rule checks for high-entropy strings and matches common patterns for secrets, including AWS keys, Slack tokens, and private keys. It aims to help users identify immediate potential secret leaks in their codebase, especially for those who may not be aware of the risks associated with sensitive data exposure.
The following list contains the patterns we detect:
ey...xox[baprs]-...https://hooks.slack.com/services/...ya29...AKIA followed by 16 alphanumeric charactersprotocol://user:pass@...)SK... followed by 32 characters-----BEGIN RSA PRIVATE KEY----------BEGIN OPENSSH PRIVATE KEY----------BEGIN DSA PRIVATE KEY----------BEGIN EC PRIVATE KEY----------BEGIN PGP PRIVATE KEY BLOCK-----In addition to detecting the above patterns, we also employ a string entropy checker to catch potential secrets based on their entropy (randomness). The entropy checker is configurable through the entropyThreshold option (see below), allowing customization of thresholds for string entropy to fine-tune detection and minimize false positives.
While this rule helps with most common cases, it is not intended to handle all of them. Therefore, always review your code carefully and consider implementing additional security measures, such as automated secret scanning in your CI/CD and git pipeline.
Some recommended tools for more comprehensive secret detection include:
const secret = "AKIA1234567890EXAMPLE";
const nonSecret = "hello world";
The rule supports the following option:
{
"linter": {
"rules": {
"security": {
"noSecrets": {
"options": {
"entropyThreshold": 41
}
}
}
}
}
}
entropyThresholdSets the sensitivity threshold for the high‑entropy detection pass.
The underlying algorithm computes an adjusted entropy score for string tokens; if the score
exceeds entropyThreshold / 10 (e.g. 41 => 4.1), and the string does not match any known
safe pattern, it is reported as a potential secret.
Increase the value to reduce false positives (stricter: fewer strings flagged). Decrease the value to increase sensitivity (more strings flagged).
Default:
41
Example raising the threshold (fewer detections):
{
"linter": {
"rules": {
"security": {
"noSecrets": {
"options": {
"entropyThreshold": 50
}
}
}
}
}
}