SVG path in React component is detected and constants as hard coded credentials

[insidersec]

SVG path in React component is detected and constants as hard coded credentials

[juris]

Having about the same issue. Moreover, excluding svg files does not help.

Insider launch

docker run --rm -v $(pwd):/target-project insidersec/insider -v -tech javascript -target /target-project -exclude client/public/res/* -exclude test/*

Output

...
CVSS 7
Severity 
Class pencil.svg (0:0)
VulnerabilityID d3fcec32a5bdfc4891b31b00d27d9d0c
Description Credentials must not be stored in the code, an attacker could decompile the application and obtain the credential.
ClassMessage client/public/res/icons/streamline/pencil.svg (0:0)
Recomendation There are ‘Secrets Management’ solutions that can be used to store secrets.
...