---
number: 9605
title: 'Security: Fix vulnerabilities found by automated scan'
author: NLmejiro
state: CLOSED
createdAt: '2026-03-31T06:17:10Z'
updatedAt: '2026-03-31T07:36:20Z'
closedAt: '2026-03-31T06:29:11Z'
mergedAt: null
head: fix/security-findings-20260331-061224
base: main
url: 'https://github.com/neomjs/neo/pull/9605'
---
## Security Findings Summary

- **Total**: 41
- **Critical**: 9
- **High**: 32

## Findings

- [CRITICAL] gitleaks: generic-api-key in `/tmp/scan_targets/neo/apps/covid/view/mapboxGl/Component.mjs:17`
  Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
- [CRITICAL] gitleaks: generic-api-key in `/tmp/scan_targets/neo/apps/devindex/resources/data/users.jsonl:27682`
  Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
- [CRITICAL] gitleaks: generic-api-key in `/tmp/scan_targets/neo/apps/devindex/resources/data/users.jsonl:39224`
  Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
- [CRITICAL] gitleaks: generic-api-key in `/tmp/scan_targets/neo/apps/sharedcovid/view/mapboxGl/Component.mjs:17`
  Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
- [CRITICAL] gitleaks: jwt in `/tmp/scan_targets/neo/examples/component/wrapper/cesiumJS/neo-config.json:4`
  Secret leak: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user da
- [CRITICAL] gitleaks: gcp-api-key in `/tmp/scan_targets/neo/examples/component/wrapper/googleMaps/neo-config.json:5`
  Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
- [CRITICAL] gitleaks: gcp-api-key in `/tmp/scan_targets/neo/learn/tutorials/Earthquakes.md:1207`
  Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
- [CRITICAL] gitleaks: gcp-api-key in `/tmp/scan_targets/neo/resources/data/deck/training/pages/2022-12-31T22-11-55-555Z.md:33`
  Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
- [CRITICAL] gitleaks: gcp-api-key in `/tmp/scan_targets/neo/resources/data/deck/training/pages/2023-01-01T21-14-45-740Z.md:37`
  Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
- [HIGH] semgrep: generic.secrets.security.detected-jwt-token.detected-jwt-token in `/tmp/scan_targets/neo/apps/covid/view/mapboxGl/Component.mjs:17`
  JWT token detected
... and 31 more findings

## Comments

### `@NLmejiro` commented on 2026-03-31T06:29:10Z

Closing: this PR was created by automated scanning but contained no actual code fixes. Apologies for the noise.

---

### `@tobiu` commented on 2026-03-31T06:59:04Z

@NLmejiro Thanks for the report. Most items are actually fully intentional: the neo website is hosted on github pages, and there are demos for e.g. CesiumJS, MapboxGL, Googlemaps. Since there is no backend, this is the only way to show the content. "Free" API keys though, so not much damage can happen (except for hitting rate limits).

devindex app: if a user would enter an api key on their public github profile, it would appear here.

trainings deck: this is old code from @maxrahder . those keys could get removed.

in case you want to do a PR, please use the latest version of the dev branch as the base. re-added 9k historical commits is impossible.

---

### `@NLmejiro` commented on 2026-03-31T07:36:20Z

@tobiu Thank you for the detailed explanation — really appreciate you taking the time.

You're right, the demo API keys for GitHub Pages make complete sense. We'll improve our scanning pipeline to filter out intentional frontend demo keys and non-actionable historical commit findings.

If we find time to clean up the training deck keys from @maxrahder's old code, we'll submit a proper PR against the `dev` branch.

Again, apologies for the noise and thanks for the guidance.

---

