← Back to report

Investigate Mapbox secret token

Build 4.3 · Scan 2026-10-06T15:04:05.848Z

1 distinct recorded findings; 1 have inspectable metadata. Locations are representative, not an inventory of every source match.

A Mapbox secret token (sk.*). Unlike the public pk.* token, this can manage the account's Mapbox resources and should never ship in a client — rotate it.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

resources.arsc

Recorded match

•••••••• (40+ chars, redacted)

Detector rule

mapbox_secret

Recorded file locations

• resources.arsc