Skip to content
deedglassdocs

secret_in_policy

A policy diagnostic from deedglass policy lint and the policy routes.

Severity: warning

A line looks like an API key or token (for example a Deedglass, Stripe, GitHub, Slack or AWS key). Policies are stored, versioned and shown to admins, so a secret in a policy is a secret shared with everyone who can read it. The policy is accepted; the message shows only the key’s prefix.

deedglass: policy/v1
name: storage
description: Uses key AKIAIOSFODNN7EXAMPLE for uploads.
defaults:
  decision: deny
  reason: No rule allows this action.
○ policy.yaml:3:23 · secret_in_policy
  Line 3 looks like a secret (AKIA…).
  hint: Policies are stored and shown to admins. Keep secrets in the connector vault.

Fix: remove the key from the policy, keep it in the connector vault, and rotate it if the file was ever shared.

Section titled “Related”