No material or immediate-danger concern was identified in this review.
This advisory report describes what the named tools and review process found at one exact commit. Unknown or unobserved behavior may still exist.
0 immediate danger0 material2 low
What this review found
No material or immediate-danger item was identified.
Contextual expected matches (2)
Gitleaks reported jwt
Expected behavior · high confidence
The matched value is a public anonymous API key for JanitorAI's authentication service, intentionally embedded in client-side code and used only to communicate with JanitorAI's own servers. It does not grant privileged access on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt. The match applies to this repository.
Contextual assessment: The scanner matched a JWT-like pattern on the JANITOR_ANON_KEY constant. This is a Supabase-style anon key used as the apikey and Bearer header when calling JanitorAI auth endpoints (auth.janitorai.com). Such anon keys are public-by-design identifiers embedded in frontend JavaScript; they do not authenticate a user and real access requires the user-supplied JWT. The matched value was redacted in the supplied evidence, so no live secret is exposed in the review data. The key is sent only to JanitorAI's own endpoints, consistent with the project's stated purpose of restoring JanitorAI integration.
The matched value is a public anonymous API key for JanitorAI's authentication service, intentionally embedded in client-side code and used only to communicate with JanitorAI's own servers. It does not grant privileged access on its own.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt. The match applies to this repository.
Contextual assessment: The scanner matched a JWT-like pattern on the JANITOR_ANON_KEY constant. This is a Supabase-style anon key used as the apikey and Bearer header when calling JanitorAI auth endpoints (auth.janitorai.com). Such anon keys are public-by-design identifiers embedded in frontend JavaScript; they do not authenticate a user and real access requires the user-supplied JWT. The matched value was redacted in the supplied evidence, so no live secret is exposed in the review data. The key is sent only to JanitorAI's own endpoints, consistent with the project's stated purpose of restoring JanitorAI integration.