Heads-up: rag-template is mentioned in an upcoming blog post about secret scanners (positive)

[onfafanutifafa]

Hi,

Short note in case you'd like to weigh in before publication.

I'm shipping a blog post in the next day or two about how I scanned 20
public AI-starter repos with a secret-scanning tool I work on
(getdebug), expected to find
leaked API keys, and instead found that every single one of my
scanner's findings was a false positive — including 7 critical
"findings" against stackitcloud/rag-template.

The post quotes your repo by name. The framing is that your repo
was correct and my scanner was wrong: the 7 hits were all
placeholder values in .env.template files (STACKIT_VLLM_API_KEY= your-stackit-vllm-api-key, etc.) and import.meta.env.X env-var
name reads — none of them were real credentials. The point of the
post is that I had to fix three detector rules in my own tool
(broader env-template matching + doc-context suppression + env-var-
read skip in entropy) to stop generating that noise.

Draft is here (unlisted Gist, ~5 min read):
https://gist.github.com/onfafanutifafa/a8643f15e6f2fc07102db7a853b5f55e

The section that mentions you is "What we expected vs. what we found".

Two asks:

1. Want me to anonymize the repo name? I can swap it for "a
   popular RAG template" if you'd rather not be a named example in a
   post about a scanner being wrong. I default to naming because it
   makes the post more credible (readers can verify), but I'd
   rather have your blessing than the credibility.

2. Anything factually off? I checked the findings against the
   current main branch but a fresh second pair of eyes is welcome.

Either way, thanks for shipping your scaffold publicly — it's the
exact kind of mid-popularity real-world code that exposes detector
noise floors. The fixes that came out of this scan are in the
linked blog post.

— Fafa (nutifafadav@gmail.com)

[a-klos]

Hey @onfafanutifafa,

Thanks for the heads-up and for checking with us before publishing.

I’m fine with you naming stackitcloud/rag-template, since the post clearly frames the repo as clean and the scanner findings as false positives. The examples you mention are indeed placeholders in .env.template and env-var reads, not real credentials.

One small request: in the table/summary, could you phrase it as “7 false-positive critical alerts” or “7 scanner alerts, all false positives” rather than just “7 critical”? That would avoid readers skimming the post and accidentally thinking the repo contained leaked secrets.

Other than that, the framing looks fair to me. Thanks for the responsible disclosure-style heads-up and for using the results to improve the scanner.

[onfafanutifafa]

Thanks for the quick and generous response.

I'll update the post to "7 scanner alerts, all false positives" in the table and summary callouts, and mirror it in the social copy — you're right that "7 critical" reads the wrong way to a skim-reader.

Quick context: detector tuning is still early — your repo surfaced three rules I needed to fix (broader env-template matching, doc-context suppression, env-var-read skip in entropy). That's why the heads-up went out before the post.

Shipping in the next 24h or so with the revised phrasing. Thanks again.

— Fafa