Committed secret or environment file
Detects environment files and common API key/token patterns in source files.
| Detail | Value |
|---|---|
| Check ID | COMMITTED_SECRET |
| Severity | High |
| How it runs | Deterministic scan and agent review |
Anchor to How to fixHow to fix
Remove committed secrets, rotate exposed values, and store them in environment variables.
The scan keys on the value, not the name. Evidence is a Shopify credential in a recognizable format, such as a shpat_ access token, or a tracked .env.secrets, .env.keys, secrets.json, or credentials.json file that's empty, because its history might still hold what it used to contain. A secret-sounding variable with a placeholder value, such as in the usual .env.example, isn't a finding, and neither is an environment file that Git ignores and doesn't track. Passing --no-git-ignore turns Git ignore off for gathering, and an untracked ignored secret is then no longer reported as COMMITTED_SECRET. Agent review then inspects files that the scan skipped.
app/shopify.server.ts
shopify app security check, the command that runs this check- All app security checks