SH203: Private key or keystore file in project

Severity: critical · Category: secrets · Applies to: all projects

Why it matters

SSH keys and certificate keystores grant access to systems and must stay private.

How to fix

Remove the file from the repository, rotate the key, and add it to .gitignore.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH203

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH203