# Secret file copied into an image

A Dockerfile COPY or ADD whose source is .env, id_rsa, id_ed25519, a .pem file, or a path ending in credentials.

Area: Security

## What you need to supply

The Dockerfile text. The check does not read the copied file.

## If it reports a finding

High severity. The suggested next step is to keep the secret file out of the image and mount it at runtime.

## What this does not prove

COPY package.json is not this finding. A copy instruction that appears only in a comment is not a finding.

## Instruction that this check is written to notice

```
COPY .env /app/.env
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/secret-file-copied-into-an-image.