Snyk issue: code analysis (CWE-547)

[pgangwani]

Issue and Steps to Reproduce

Hello @guillaume-chervet and maintainers, I am seeing below error of snyk in analysis:

Avoid hardcoding values that are meant to be secret. Found a hardcoded string used in here. CWE-547

Versions

all versions (7.18.1 and above)

Screenshots

Expected

No snyk issue should come from library generated files

Actual

CWE-547 is found in public files specifically OidcServiceWorker.js

Additional Details

• Installed packages:

[guillaume-chervet]

hi @pgangwani thank you again for your issue :)

It is a false positive. These values are not secrets

[pgangwani]

Yeah I understand it is treating as hardcoding of accesstoken but actually this placeholder. There is recommendation in tool:

Not sure if we can do this. This might break. Thoughts?

[jafin]

@pgangwani that recommendation appears to be for a secret, as @guillaume-chervet as hinted, this is not a secret, its a const value. I think the best thing you may try is in SYNK set the issue to ignore as false positive.

[pgangwani]

if any of you can answer #1420 , I can close both.

[pgangwani]

Closing as last comment in #1420