Problem
A service role token is embedded directly in an npm script, creating credential leakage risk.
Evidence
Scope
- Move token to environment variable or local-only secrets file ignored by git
- Add script validation for required env vars
- Rotate leaked token if it was ever valid/shared
Acceptance Criteria
- No hardcoded JWTs in repo scripts
- Local audit script works with env-based secret injection
- Security guidance updated
Problem
A service role token is embedded directly in an npm script, creating credential leakage risk.
Evidence
Scope
Acceptance Criteria