type.secret_exposed: Secret value is sent, stored, logged or read as text

Secret value is sent, stored, logged or read as text.

Area 19, Standard library; not declinable; the next step is usually the agent's.

A secret value ("Secret values") is never sent, logged, stored or shown: an Output, a failure's fields, an event, an email, a message and an entity refuse one, however deep, and so does any operation, operator or construction but the one made to take it. It arrives in an Input. A client that needs to know whether a key is set is sent that instead.

example

type PartnerName = Text {    max_length: 100}/// What the partners page shows of a partner.type PartnerProfile = Output {    name: PartnerName    partner_key: ApiKey}

jadpo checkcheck failed: 1 error, 1 file

error PartnerProfile.partner_key holds an ApiKey

--> main.jadpo:8:18

  |8 |     partner_key: ApiKey  |                  ^^^^^^ sent to a client

reason: An ApiKey is a secret value: it is never sent, logged, stored or shown. A response is written out, logged by proxies and kept by browsers, and a client never needs a secret back.
next: Remove partner_key, and send what the client needs instead, such as whether one is set (agent)
rule: type.secret_exposed
help: https://jadpo.dev/docs/errors/type.secret_exposed