Trivy detects potential secret (GCP Service Account)

The Trivy scan on the application image detected two "secret" findings in the file GoogleApiServiceClientForm.php, part of the contrib module google_api_client. One classified as CRITICAL (GCP Service Account) and another as HIGH (Asymmetric Private Key).

Reported severity

• CRITICAL: Google (gcp-service-account)
• HIGH: AsymmetricPrivateKey (private-key)

Location

src/Form/GoogleApiServiceClientForm.php
Lines: 68 and 71

Scan evidence

CRITICAL: Google (gcp-service-account)
Line 68 (offset: 2048 bytes)

HIGH: AsymmetricPrivateKey (private-key)
Line 71 (offset: 2192 bytes)

Code context flagged:

'#placeholder' => $this->t('Example: {
   "project_id": "SERVICEACCOUNT",
   "private_key_id": "PRIVATE_KEY_ID",
   ...
   "private_key": "-----BEGIN PRIVATE KEY----- [...] -----END PRIVATE KEY-----",
   "client_email": "google-service-account@servicesaccount.iam.gserviceaccount.com",

Preliminary analysis

The flagged block corresponds to a sample/placeholder text (#placeholder) shown in a form field, used to illustrate the expected JSON format of a Google service account credentials file. The values (SERVICEACCOUNT, PRIVATE_KEY_ID, the BEGIN/END PRIVATE KEY block, the email google-service-account@servicesaccount.iam.gserviceaccount.com) are generic sample values, not a real private key or functional credentials.

This suggests a likely false positive from the secret scanner, since the structural pattern of a GCP private key/service account matches Trivy's detection regex regardless of whether the content is real or just an example.

Steps to reproduce

1. Build the project's Docker image (includes the google_api_client contrib module).
2. Run the scan: trivy image :.
3. Observe the finding in the secrets section for the file mentioned above.