SH012: Secret baked into Dockerfile

Severity: high · Category: security · Applies to: docker

Why it matters

ENV and ARG values stay readable in the image history for anyone who can pull it.

How to fix

Pass secrets at runtime, or use BuildKit --mount=type=secret during the build.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH012

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH012