Netlify PR build preview failing due to suspected secret in Service tutorial pages

[dipesh-rawat]

This is a Bug Report

Problem:
Netlify PR preview builds are currently failing (since last night) due to a detected “likely secret” in multiple documentation files. The error appears during the secrets scanning phase:

5:05:19 PM: Scanning for secrets in code and build output.                
5:05:19 PM: ────────────────────────────────────────────────────────────────
5:05:19 PM: ​
5:05:19 PM: ​
5:05:19 PM: ❯ Scanning complete. 43400 file(s) scanned. Secrets scanning found 0 instance(s) of secrets and 1 instance(s) of likely secrets in build output or repo code.
5:05:19 PM: ​
5:05:19 PM: "LS0t***" detected as a likely secret:
5:05:19 PM:   found value at line 373 in content/en/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 374 in content/en/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 240 in content/id/docs/concepts/services-networking/connect-applications-service.md
5:05:19 PM:   found value at line 241 in content/id/docs/concepts/services-networking/connect-applications-service.md
5:05:19 PM:   found value at line 294 in content/ja/docs/concepts/services-networking/connect-applications-service.md
5:05:19 PM:   found value at line 295 in content/ja/docs/concepts/services-networking/connect-applications-service.md
5:05:19 PM:   found value at line 290 in content/ja/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 291 in content/ja/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 285 in content/ko/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 286 in content/ko/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 556 in content/zh-cn/docs/tutorials/services/connect-applications-service.md
5:05:19 PM:   found value at line 557 in content/zh-cn/docs/tutorials/services/connect-applications-service.md
5:05:19 PM: ​
5:05:19 PM: To prevent exposing secrets, the build will fail until these likely secret values are not found in build output or repo files.

Affected PR logs:

• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685c1c38007f0e0008042f69
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685c1f339f0cdb0008cdc0fa
• https://app.netlify.com/projects/kubernetes-io-vnext-staging/deploys/685c21ddadb064000803141a
• https://app.netlify.com/projects/kubernetes-io-vnext-staging/deploys/685c2f8b7deca20008e6a0ee
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685c6e7e7968b30008dac691
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685c7d4d9bb1f7000853fe08
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685cac02b6115b0008262671
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685cb5ea2304b200084d6485
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685ceca72b7a0100082e99a5
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685cf3548d82d900089fa2f9
• https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/685d04f0c0cdea0008527858

Looks like any new PR build is failing now, preventing contributors from receiving Netlify preview.

Proposed Solution:

• Verify if this is real secret data
• Replace with mock or redact
• Whitelist if false positive

Additional Information:
The lines that is triggering the warning has been present in the repo since 2019 (for 'en' language, check commit 9ba54f5), so it’s unclear why this only started causing errors now.

website/content/en/docs/tutorials/services/connect-applications-service.md

Lines 373 to 374 in a2145d1

tls.crt: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURIekNDQWdlZ0F3SUJBZ0lKQUp5M3lQK0pzMlpJTUEwR0NTcUdTSWIzRFFFQkJRVUFNQ1l4RVRBUEJnTlYKQkFNVENHNW5hVzU0YzNaak1SRXdEd1lEVlFRS0V3aHVaMmx1ZUhOMll6QWVGdzB4TnpFd01qWXdOekEzTVRKYQpGdzB4T0RFd01qWXdOekEzTVRKYU1DWXhFVEFQQmdOVkJBTVRDRzVuYVc1NGMzWmpNUkV3RHdZRFZRUUtFd2h1CloybHVlSE4yWXpDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBSjFxSU1SOVdWM0IKMlZIQlRMRmtobDRONXljMEJxYUhIQktMSnJMcy8vdzZhU3hRS29GbHlJSU94NGUrMlN5ajBFcndCLzlYTnBwbQppeW1CL3JkRldkOXg5UWhBQUxCZkVaTmNiV3NsTVFVcnhBZW50VWt1dk1vLzgvMHRpbGhjc3paenJEYVJ4NEo5Ci82UVRtVVI3a0ZTWUpOWTVQZkR3cGc3dlVvaDZmZ1Voam92VG42eHNVR0M2QURVODBpNXFlZWhNeVI1N2lmU2YKNHZpaXdIY3hnL3lZR1JBRS9mRTRqakxCdmdONjc2SU90S01rZXV3R0ljNDFhd05tNnNTSzRqYUNGeGpYSnZaZQp2by9kTlEybHhHWCtKT2l3SEhXbXNhdGp4WTRaNVk3R1ZoK0QrWnYvcW1mMFgvbVY0Rmo1NzV3ajFMWVBocWtsCmdhSXZYRyt4U1FVQ0F3RUFBYU5RTUU0d0hRWURWUjBPQkJZRUZPNG9OWkI3YXc1OUlsYkROMzhIYkduYnhFVjcKTUI4R0ExVWRJd1FZTUJhQUZPNG9OWkI3YXc1OUlsYkROMzhIYkduYnhFVjdNQXdHQTFVZEV3UUZNQU1CQWY4dwpEUVlKS29aSWh2Y05BUUVGQlFBRGdnRUJBRVhTMW9FU0lFaXdyMDhWcVA0K2NwTHI3TW5FMTducDBvMm14alFvCjRGb0RvRjdRZnZqeE04Tzd2TjB0clcxb2pGSW0vWDE4ZnZaL3k4ZzVaWG40Vm8zc3hKVmRBcStNZC9jTStzUGEKNmJjTkNUekZqeFpUV0UrKzE5NS9zb2dmOUZ3VDVDK3U2Q3B5N0M3MTZvUXRUakViV05VdEt4cXI0Nk1OZWNCMApwRFhWZmdWQTRadkR4NFo3S2RiZDY5eXM3OVFHYmg5ZW1PZ05NZFlsSUswSGt0ejF5WU4vbVpmK3FqTkJqbWZjCkNnMnlwbGQ0Wi8rUUNQZjl3SkoybFIrY2FnT0R4elBWcGxNSEcybzgvTHFDdnh6elZPUDUxeXdLZEtxaUMwSVEKQ0I5T2wwWW5scE9UNEh1b2hSUzBPOStlMm9KdFZsNUIyczRpbDlhZ3RTVXFxUlU9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"

tls.key: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2RhaURFZlZsZHdkbFIKd1V5eFpJWmVEZWNuTkFhbWh4d1NpeWF5N1AvOE9ta3NVQ3FCWmNpQ0RzZUh2dGtzbzlCSzhBZi9WemFhWm9zcApnZjYzUlZuZmNmVUlRQUN3WHhHVFhHMXJKVEVGSzhRSHA3VkpMcnpLUC9QOUxZcFlYTE0yYzZ3MmtjZUNmZitrCkU1bEVlNUJVbUNUV09UM3c4S1lPNzFLSWVuNEZJWTZMMDUrc2JGQmd1Z0ExUE5JdWFubm9UTWtlZTRuMG4rTDQKb3NCM01ZUDhtQmtRQlAzeE9JNHl3YjREZXUraURyU2pKSHJzQmlIT05Xc0RadXJFaXVJMmdoY1kxeWIyWHI2UAozVFVOcGNSbC9pVG9zQngxcHJHclk4V09HZVdPeGxZZmcvbWIvNnBuOUYvNWxlQlkrZStjSTlTMkQ0YXBKWUdpCkwxeHZzVWtGQWdNQkFBRUNnZ0VBZFhCK0xkbk8ySElOTGo5bWRsb25IUGlHWWVzZ294RGQwci9hQ1Zkank4dlEKTjIwL3FQWkUxek1yall6Ry9kVGhTMmMwc0QxaTBXSjdwR1lGb0xtdXlWTjltY0FXUTM5SjM0VHZaU2FFSWZWNgo5TE1jUHhNTmFsNjRLMFRVbUFQZytGam9QSFlhUUxLOERLOUtnNXNrSE5pOWNzMlY5ckd6VWlVZWtBL0RBUlBTClI3L2ZjUFBacDRuRWVBZmI3WTk1R1llb1p5V21SU3VKdlNyblBESGtUdW1vVlVWdkxMRHRzaG9reUxiTWVtN3oKMmJzVmpwSW1GTHJqbGtmQXlpNHg0WjJrV3YyMFRrdWtsZU1jaVlMbjk4QWxiRi9DSmRLM3QraTRoMTVlR2ZQegpoTnh3bk9QdlVTaDR2Q0o3c2Q5TmtEUGJvS2JneVVHOXBYamZhRGR2UVFLQmdRRFFLM01nUkhkQ1pKNVFqZWFKClFGdXF4cHdnNzhZTjQyL1NwenlUYmtGcVFoQWtyczJxWGx1MDZBRzhrZzIzQkswaHkzaE9zSGgxcXRVK3NHZVAKOWRERHBsUWV0ODZsY2FlR3hoc0V0L1R6cEdtNGFKSm5oNzVVaTVGZk9QTDhPTm1FZ3MxMVRhUldhNzZxelRyMgphRlpjQ2pWV1g0YnRSTHVwSkgrMjZnY0FhUUtCZ1FEQmxVSUUzTnNVOFBBZEYvL25sQVB5VWs1T3lDdWc3dmVyClUycXlrdXFzYnBkSi9hODViT1JhM05IVmpVM25uRGpHVHBWaE9JeXg5TEFrc2RwZEFjVmxvcG9HODhXYk9lMTAKMUdqbnkySmdDK3JVWUZiRGtpUGx1K09IYnRnOXFYcGJMSHBzUVpsMGhucDBYSFNYVm9CMUliQndnMGEyOFVadApCbFBtWmc2d1BRS0JnRHVIUVV2SDZHYTNDVUsxNFdmOFhIcFFnMU16M2VvWTBPQm5iSDRvZUZKZmcraEppSXlnCm9RN3hqWldVR3BIc3AyblRtcHErQWlSNzdyRVhsdlhtOElVU2FsbkNiRGlKY01Pc29RdFBZNS9NczJMRm5LQTQKaENmL0pWb2FtZm1nZEN0ZGtFMXNINE9MR2lJVHdEbTRpb0dWZGIwMllnbzFyb2htNUpLMUI3MkpBb0dBUW01UQpHNDhXOTVhL0w1eSt5dCsyZ3YvUHM2VnBvMjZlTzRNQ3lJazJVem9ZWE9IYnNkODJkaC8xT2sybGdHZlI2K3VuCnc1YytZUXRSTHlhQmd3MUtpbGhFZDBKTWU3cGpUSVpnQWJ0LzVPbnlDak9OVXN2aDJjS2lrQ1Z2dTZsZlBjNkQKckliT2ZIaHhxV0RZK2Q1TGN1YSt2NzJ0RkxhenJsSlBsRzlOZHhrQ2dZRUF5elIzT3UyMDNRVVV6bUlCRkwzZAp4Wm5XZ0JLSEo3TnNxcGFWb2RjL0d5aGVycjFDZzE2MmJaSjJDV2RsZkI0VEdtUjZZdmxTZEFOOFRwUWhFbUtKCnFBLzVzdHdxNWd0WGVLOVJmMWxXK29xNThRNTBxMmk1NVdUTThoSDZhTjlaMTltZ0FGdE5VdGNqQUx2dFYxdEYKWSs4WFJkSHJaRnBIWll2NWkwVW1VbGc9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K"

Maybe a recent Netlify config or dependency update might be triggering stricter scanning?

[dipesh-rawat]

This seems potentially high-priority, but I’ll defer to @kubernetes/website-admins to determine if it’s connected to any recent Netlify configuration changes that might be causing this behavior.

[Caesarsage]

This seems potentially high-priority, but I’ll defer to @kubernetes/website-admins to determine if it’s connected to any recent Netlify configuration changes that might be causing this behavior.

hello @dipesh-rawat , i check these.

The “likely secret” detected (LS0t***) in the flagged files is a base64-encoded certificate and key used as an example in our documentation for creating Kubernetes TLS secrets. These values are not real secrets—they are public, non-sensitive, and intended solely for demonstration purposes.

I can submit a PR to REDACT the affected files accordingly by language.

[Caesarsage]

/assign

[BenTheElder]

I can submit a PR to REDACT the affected files accordingly by language.

Seems like we should be able to mark these as not a real secret instead of removing the example.

[BenTheElder]

3:59:47 PM: ❯ Scanning complete. 43399 file(s) scanned. Secrets scanning found 0 instance(s) of secrets and 1 instance(s) of likely secrets in build output or repo code.
3:59:47 PM: ​
3:59:47 PM: "LS0t***" detected as a likely secret:
3:59:47 PM:   found value at line 373 in content/en/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 374 in content/en/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 240 in content/id/docs/concepts/services-networking/connect-applications-service.md
3:59:47 PM:   found value at line 241 in content/id/docs/concepts/services-networking/connect-applications-service.md
3:59:47 PM:   found value at line 294 in content/ja/docs/concepts/services-networking/connect-applications-service.md
3:59:47 PM:   found value at line 295 in content/ja/docs/concepts/services-networking/connect-applications-service.md
3:59:47 PM:   found value at line 290 in content/ja/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 291 in content/ja/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 285 in content/ko/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 286 in content/ko/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 556 in content/zh-cn/docs/tutorials/services/connect-applications-service.md
3:59:47 PM:   found value at line 557 in content/zh-cn/docs/tutorials/services/connect-applications-service.md
3:59:47 PM: ​
3:59:47 PM: To prevent exposing secrets, the build will fail until these likely secret values are not found in build output or repo files.
3:59:47 PM: ​
3:59:47 PM: If these are expected, use SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES, or SECRETS_SCAN_SMART_DETECTION_ENABLED to prevent detecting.
3:59:47 PM: ​
3:59:47 PM: For more information on secrets scanning, see the Netlify Docs: https://ntl.fyi/configure-secrets-scanning
3:59:47 PM: ​
3:59:47 PM: Secrets scanning detected secrets in files during build.      
3:59:47 PM: ────────────────────────────────────────────────────────────────

So we can add them to SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES ?

[dipesh-rawat]

So we can add them to SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES ?

Based on the Netlify docs (here), we should be able to bypass this issue using SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES, telling the scanner not to treat them as secrets.

[dipesh-rawat]

Some digging around - the example string that’s being flagged has actually been in the repo since 2019. From what I can tell, earlier PR builds were passing because the secret detection scanner was disabled (based on the logs).

Check passed log here

1:24:16 PM: Netlify Build                                                 
1:24:16 PM: ────────────────────────────────────────────────────────────────
1:24:16 PM: ​
1:24:16 PM: ❯ Version
1:24:16 PM:   @netlify/build 33.4.6
1:24:16 PM: ​
1:24:16 PM: ❯ Flags
1:24:16 PM:   accountId: 595fccb76f4c5019236cda4d
1:24:16 PM:   apiHost: api.netlify.com
1:24:16 PM:   baseRelDir: false
1:24:16 PM:   branch: npa-26073
1:24:16 PM:   buildId: 685bea50c26da800080f5601
1:24:16 PM:   buildbotServerSocket: /tmp/netlify-buildbot-socket
1:24:16 PM:   cacheDir: /opt/build/cache
1:24:16 PM:   cachedConfigPath: /tmp/netlify_config.json
1:24:16 PM:   context: deploy-preview
1:24:16 PM:   cwd: /opt/build/repo
1:24:16 PM:   deployId: 685bea50c26da800080f5603
1:24:16 PM:   edgeFunctionsDistDir: /tmp/edge-685bea50c26da800080f5603
1:24:16 PM:   enhancedSecretScan: false <--- Disabled here
1:24:16 PM:   featureFlags:
1:24:16 PM:     - netlify_build_updated_plugin_compatibility
....
....

As of yesterday, we’re seeing that the enhancedSecretScan: true flag is now being passed, which seems to have triggered the stricter scanning and caused builds to start failing.

Check failed logs here

3:53:04 AM: Netlify Build                                                 
3:53:04 AM: ────────────────────────────────────────────────────────────────
3:53:04 AM: ​
3:53:04 AM: ❯ Version
3:53:04 AM:   @netlify/build 33.4.6
3:53:04 AM: ​
3:53:04 AM: ❯ Flags
3:53:04 AM:   accountId: 595fccb76f4c5019236cda4d
3:53:04 AM:   apiHost: api.netlify.com
3:53:04 AM:   baseRelDir: false
3:53:04 AM:   branch: volume-group-snapshot-v1beta2-blog
3:53:04 AM:   buildId: 685cb5ea2304b200084d6483
3:53:04 AM:   buildbotServerSocket: /tmp/netlify-buildbot-socket
3:53:04 AM:   cacheDir: /opt/build/cache
3:53:04 AM:   cachedConfigPath: /tmp/netlify_config.json
3:53:04 AM:   context: deploy-preview
3:53:04 AM:   cwd: /opt/build/repo
3:53:04 AM:   deployId: 685cb5ea2304b200084d6485
3:53:04 AM:   edgeFunctionsDistDir: /tmp/edge-685cb5ea2304b200084d6485
3:53:04 AM:   enhancedSecretScan: true <--- Enabled here
3:53:04 AM:   featureFlags:
3:53:04 AM:     - netlify_build_updated_plugin_compatibility
3:53:04 AM:   framework: hugo
3:53:04 AM:   functionsDistDir: /tmp/zisi-685cb5ea2304b200084d6485
3:53:04 AM:   mode: buildbot

Would be great if one of the SIG leads or someone from the website admin team could check the Netlify console and confirm if there were any recent configuration or environment variable changes.