# Secret assigned in serverless environment

A Serverless Framework provider or function environment entry whose name looks like a password, secret, or token, and whose value is a non-empty literal.

Area: Security

## What you need to supply

The Serverless Framework config. The config is not executed. An IpAddress of 0.0.0.0/0 is checked, and other condition operators are not.

## If it reports a finding

High severity. The suggested next step is to reference the value with a Serverless variable such as ${env:TOKEN}.

## What this does not prove

${env:TOKEN} and ${self:custom.x} are not this finding. A value that appears only in a comment is not this finding.

## Environment entry that this check is written to notice

```
provider:
  environment:
    password: hunter2
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/secret-assigned-in-serverless-environment.