Security / Public reference

Secret assigned in serverless environment

A Serverless Framework provider or function environment entry whose name looks like a password, secret, or token, and whose value is a non-empty literal.

What you need to supply

The Serverless Framework config. The config is not executed. An IpAddress of 0.0.0.0/0 is checked, and other condition operators are not.

If it reports a finding

High severity. The suggested next step is to reference the value with a Serverless variable such as ${env:TOKEN}.

What this does not prove

${env:TOKEN} and ${self:custom.x} are not this finding. A value that appears only in a comment is not this finding.

Environment entry that this check is written to notice

provider:
  environment:
    password: hunter2

All review checks. Reading this page does not submit your infrastructure.