# Secret assigned in an image variable

A Dockerfile ENV or ARG whose name is password, passwd, secret, api_key, apikey, auth_token, access_key, private_key, or token, with a non-empty literal value.

Area: Security

## What you need to supply

The Dockerfile text. The check does not build the image.

## If it reports a finding

High severity. The suggested next step is to pass the value at runtime or from a secret mount.

## What this does not prove

ENV NODE_ENV=production, ENV PATH=/usr/bin, ARG VERSION=1, ENV TOKEN=$TOKEN, and ENV TOKEN=${TOKEN} are not this finding. A commented assignment is not a finding.

## Instruction that this check is written to notice

```
ENV API_KEY=abcd
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/secret-assigned-in-an-image-variable.