Skip to content

fix: suppress Snyk hardcoded-secret false positive in bundler test fixtures - #391

Merged
reeshika-h merged 1 commit into
mainfrom
fix/snyk
Aug 10, 2026
Merged

fix: suppress Snyk hardcoded-secret false positive in bundler test fixtures#391
reeshika-h merged 1 commit into
mainfrom
fix/snyk

Conversation

@reeshika-h

Copy link
Copy Markdown
Contributor

Summary

  • Snyk Code (CWE-547, score 450) flagged `apiKey: 'test_key'` on line 56 in `test/bundlers/esbuild-app/src/index.js` and `test/bundlers/rollup-app/src/index.js` as a Hardcoded Non-Cryptographic Secret.
  • Previously ignored via the Snyk Web UI (ignored 6 months ago by nadeem.patwekar@contentstack.com, reason: test value, not an exposed hardcoded secret).
  • Replaced the org-level UI ignore with an inline `// deepcode ignore HardcodedNonCryptoSecret: ...` annotation so the suppression lives with the code and survives outside the Snyk org config.

Test plan

  • snyk code test test/bundlers/esbuild-app — 0 total issues
  • snyk code test test/bundlers/rollup-app — 0 total issues
  • snyk code test ... --include-ignores — no ignored issues remain (confirms inline suppression works)
  • trufflehog filesystem test/bundlers/esbuild-app test/bundlers/rollup-app — 0 verified secrets, 0 unverified secrets

🤖 Generated with Claude Code

…xtures

Test fixtures use placeholder API keys/tokens, not real secrets. Add
inline deepcode ignore annotations so Snyk Code suppresses the finding
at the source instead of relying on org-level web UI ignores.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@reeshika-h
reeshika-h requested a review from a team as a code owner August 10, 2026 07:10
@snyk-io

snyk-io Bot commented Aug 10, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@github-actions

Copy link
Copy Markdown

Coverage report

St.
Category Percentage Covered / Total
🟢 Statements 98.89% 984/995
🟢 Branches 96.44% 298/309
🟢 Functions 97.77% 219/224
🟢 Lines 99.36% 937/943

Test suite run success

708 tests passing in 35 suites.

Report generated by 🧪jest coverage report action from 7bfe452

@reeshika-h
reeshika-h merged commit 59deac8 into main Aug 10, 2026
10 checks passed
@reeshika-h
reeshika-h deleted the fix/snyk branch August 10, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants